rebuild_yara_rule does not return rule comments

Hi. The method rebuild_yara_rule() seems to be striping off rule comments. For example, the following rule:

rule sample
{
    strings:
        $ = { 01 02 03 04 } // string 1
        $ = { 01 02 03 05 } // string 2
    condition:
        all of ($) // condition
}

Is correctly parsed (including comments):

[{'condition_terms': ['all', 'of', '(', '$', ')'], 'raw_strings': 'strings:\n        $ = { 01 02 03 04 } // string 1\n        $ = { 01 02 03 05 } // string 2\n    ', 'raw_condition': 'condition:\n        all of ($) // condition\n', 'comments': ['// condition', '// string 2', '// string 1'], 'rule_name': 'sample', 'stop_line': 8, 'start_line': 1, 'strings': [{'name': '$', 'value': '{ 01 02 03 04 }'}, {'name': '$', 'value': '{ 01 02 03 05 }'}]}]

But then rebuild_yara_rule() ignores comments:

rule sample {
        strings:
                $ = { 01 02 03 04 }
                $ = { 01 02 03 05 }
        condition:
                all of ($)
} 

Is this intentional? On the one hand this is not an issue if the rebuild rule is passed to yara for scanning. On the other hand, if you are rebuilding a rule for intel sharing, the rebuilder should preserve the rule comments.

Thanks in advance! RD

[utkonos]

This is intentional. The comments key in the dictionary representation of the rule that plyara returns is just a list of comments. It doesn’t return positional information, so the data for where to put them is not available during the rebuild process.

Line numbers are available during the parsing process, so this is definitely a do-able enhancement. It would break the schema of the resulting data, so it’s a breaking change compatibility-wise.

This feature can be added as an option, or it can be added as a full feature with a new major version. I’ll see what the other maintainers have to say.

[utkonos]

I’ve opened a separate issue for the change in 3.0