{"action":"created","issue":{"url":"https://api.github.com/repos/VirusTotal/yara/issues/584","repository_url":"https://api.github.com/repos/VirusTotal/yara","labels_url":"https://api.github.com/repos/VirusTotal/yara/issues/584/labels{/name}","comments_url":"https://api.github.com/repos/VirusTotal/yara/issues/584/comments","events_url":"https://api.github.com/repos/VirusTotal/yara/issues/584/events","html_url":"https://github.com/VirusTotal/yara/issues/584","id":196393017,"number":584,"title":"Yara does not accept Regex having negative lookahead","user":{"login":"chintanhshah","id":8774676,"avatar_url":"https://avatars.githubusercontent.com/u/8774676?v=3","gravatar_id":"","url":"https://api.github.com/users/chintanhshah","html_url":"https://github.com/chintanhshah","followers_url":"https://api.github.com/users/chintanhshah/followers","following_url":"https://api.github.com/users/chintanhshah/following{/other_user}","gists_url":"https://api.github.com/users/chintanhshah/gists{/gist_id}","starred_url":"https://api.github.com/users/chintanhshah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chintanhshah/subscriptions","organizations_url":"https://api.github.com/users/chintanhshah/orgs","repos_url":"https://api.github.com/users/chintanhshah/repos","events_url":"https://api.github.com/users/chintanhshah/events{/privacy}","received_events_url":"https://api.github.com/users/chintanhshah/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-12-19T11:37:08Z","updated_at":"2016-12-20T06:57:58Z","closed_at":null,"body":"Hi , \r\n\r\nJust wanted to point out that Yara 3.4 does not accept the regex having negative lookahead . It throws exceptions on invalid characters . Following is the regex that I am trying to use : \r\n\r\n([^\\=]*)0x[a-f0-9]{1,3}\\s0x[a-f0-9]{8}\\s(?!nt|win) \r\n\r\nAbove regex I was apparently attempting to match the line not having  either \"nt\" or \"win\" after the space character . While compiling the rule, it throws following error . \r\n **error: invalid regular expression \"$nt_ssdt\": syntax error, unexpected '?'**\r\n\r\nPlease suggest any alternative way of writing negative lookahead regex or fix the issue. "},"comment":{"url":"https://api.github.com/repos/VirusTotal/yara/issues/comments/268169947","html_url":"https://github.com/VirusTotal/yara/issues/584#issuecomment-268169947","issue_url":"https://api.github.com/repos/VirusTotal/yara/issues/584","id":268169947,"user":{"login":"chintanhshah","id":8774676,"avatar_url":"https://avatars.githubusercontent.com/u/8774676?v=3","gravatar_id":"","url":"https://api.github.com/users/chintanhshah","html_url":"https://github.com/chintanhshah","followers_url":"https://api.github.com/users/chintanhshah/followers","following_url":"https://api.github.com/users/chintanhshah/following{/other_user}","gists_url":"https://api.github.com/users/chintanhshah/gists{/gist_id}","starred_url":"https://api.github.com/users/chintanhshah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chintanhshah/subscriptions","organizations_url":"https://api.github.com/users/chintanhshah/orgs","repos_url":"https://api.github.com/users/chintanhshah/repos","events_url":"https://api.github.com/users/chintanhshah/events{/privacy}","received_events_url":"https://api.github.com/users/chintanhshah/received_events","type":"User","site_admin":false},"created_at":"2016-12-20T06:57:58Z","updated_at":"2016-12-20T06:57:58Z","body":"Ah ok..I will have to spend some time trying a workaround to this. It would solve quite a bit of FP problems if that works ..\r\n\r\nThanks for your quick suggestion . "}}
{"actor":{"display_login":"chintanhshah"}}