Internal variables for rules

libyara/compiler.c

@@ -270,6 +270,9 @@ YR_API int yr_compiler_create(
   if (result == ERROR_SUCCESS)
     result = yr_hash_table_create(1000, &new_compiler->objects_table);
 
+  if (result == ERROR_SUCCESS)
+    result = yr_hash_table_create(10, &new_compiler->current_internal_variables_table);
+
   if (result == ERROR_SUCCESS)
     result = yr_hash_table_create(10000, &new_compiler->strings_table);
 
@@ -322,6 +325,10 @@ YR_API void yr_compiler_destroy(
       compiler->objects_table,
       (YR_HASH_TABLE_FREE_VALUE_FUNC) yr_object_destroy);
 
+  yr_hash_table_destroy(
+      compiler->current_internal_variables_table,
+      (YR_HASH_TABLE_FREE_VALUE_FUNC) yr_object_destroy);
+
   if (compiler->atoms_config.free_quality_table)
     yr_free(compiler->atoms_config.quality_table);
 
@@ -702,6 +709,7 @@ static int _yr_compiler_compile_rules(
 {
   YR_RULE null_rule;
   YR_EXTERNAL_VARIABLE null_external;
+  YR_INTERNAL_VARIABLE null_internal;
 
   uint8_t halt = OP_HALT;
 
@@ -735,6 +743,17 @@ static int _yr_compiler_compile_rules(
       sizeof(YR_EXTERNAL_VARIABLE),
       NULL));
 
+  // Write a null internal indicating the end.
+  memset(&null_internal, 0xFA, sizeof(YR_INTERNAL_VARIABLE));
+  null_internal.type = OBJECT_TYPE_UNDEFINED;
+
+  FAIL_ON_ERROR(yr_arena_write_data(
+      compiler->arena,
+      YR_INTERNAL_VARIABLES_TABLE,
+      &null_internal,
+      sizeof(YR_INTERNAL_VARIABLE),
+      NULL));
+
   // Write Aho-Corasick automaton to arena.
   FAIL_ON_ERROR(yr_ac_compile(
       compiler->automaton,

libyara/exec.c

@@ -899,14 +899,59 @@ int yr_execute_code(
         #endif
 
         r1.o = (YR_OBJECT*) yr_hash_table_lookup(
-            context->objects_table,
+            context->internal_variable_tables[current_rule_idx],
             identifier,
             NULL);
 
+        if(r1.o == NULL)
+            r1.o = (YR_OBJECT*) yr_hash_table_lookup(
+                context->objects_table,
+                identifier,
+                NULL);
+
         assert(r1.o != NULL);
         push(r1);
         break;
 
+      case OP_OBJ_STORE:
+        identifier = *(char**)(ip);
+        ip += sizeof(uint64_t);
+
+        #if YR_PARANOID_EXEC
+        ensure_within_rules_arena(identifier);
+        #endif
+
+        pop(r1);
+
+        YR_OBJECT* obj = (YR_OBJECT*) yr_hash_table_lookup(
+                context->internal_variable_tables[current_rule_idx],
+                identifier,
+                NULL);
+
+        assert(obj != NULL);
+
+        switch(obj->type) {
+            case OBJECT_TYPE_INTEGER:
+                yr_object_set_integer(r1.i, obj, NULL);
+                break;
+            case OBJECT_TYPE_FLOAT:
+                yr_object_set_float(r1.d, obj, NULL);
+                break;
+            case OBJECT_TYPE_STRING:
+                yr_object_set_string(
+                    r1.ss->c_string,
+                    strlen(r1.ss->c_string),
+                    obj,
+                    NULL);
+                break;
+            case OBJECT_TYPE_STRUCTURE:
+                yr_object_set_object(r1.o, obj, NULL);
+                break;
+            default:
+                assert(false);
+        }
+        break;
+
       case OP_OBJ_FIELD:
         identifier = *(char**)(ip);
         ip += sizeof(uint64_t);
@@ -957,7 +1002,12 @@ int yr_execute_code(
             else
               r1.ss = r1.o->value.ss;
             break;
-
+          case OBJECT_TYPE_STRUCTURE:
+          case OBJECT_TYPE_DICTIONARY:
+          case OBJECT_TYPE_ARRAY:
+          case OBJECT_TYPE_FUNCTION:
+            // do nothing
+            break;
           default:
             assert(false);
         }