diff --git a/plugins/yara_rules/romfs/rules/language.yar b/plugins/yara_rules/romfs/rules/language.yar new file mode 100644 index 000000000..1b5af9567 --- /dev/null +++ b/plugins/yara_rules/romfs/rules/language.yar @@ -0,0 +1,25 @@ +rule CppExecutable { + meta: + category = "Programming Language" + name = "C++" + + strings: + $exception_windows = "_CxxThrowException" ascii fullword + $iostreams = "iostream" ascii + + condition: + any of them +} + +rule CppMSVC { + meta: + category = "Compiler" + name = "MSVC" + + strings: + $iostreams_mangled_name = "$basic_iostream@DU" ascii + $std_namespace = "@@std@@" ascii + + condition: + any of them and CppExecutable +} \ No newline at end of file