def get_yara_condition_string(self, indicator_node, parameters_node, ids_to_process, condition_string='<STR_LIT>',<EOL>joining_value='<STR_LIT>'):
indicator_node_id = str(indicator_node.get('<STR_LIT:id>'))<EOL>if indicator_node_id not in ids_to_process:<EOL><INDENT>msg = '<STR_LIT>'.format(indicator_node_id)<EOL>raise YaraConversionError(msg)<EOL><DEDENT>expected_tag = '<STR_LIT>'<EOL>if indicator_node.tag != expected_tag:<EOL><INDENT>raise YaraConversionError('<STR_LIT>' % expected_tag)<EOL><DEDENT>is_set = None<EOL>for param in parameters_node.xpath('<STR_LIT>'.format(indicator_node_id)):<EOL><INDENT>if param.attrib['<STR_LIT:name>'] == '<STR_LIT>':<EOL><INDENT>is_set = True<EOL>set_count = param.findtext('<STR_LIT:value>', None)<EOL>try:<EOL><INDENT>temp = int(set_count)<EOL>if temp < <NUM_LIT:1>:<EOL><INDENT>raise YaraConversionError('<STR_LIT>')<EOL><DEDENT>if temp > len(indicator_node.getchildren()):<EOL><INDENT>msg = '<STR_LIT>''<STR_LIT>' % str(indicator_node_id)<EOL>raise YaraConversionError(msg)<EOL><DEDENT><DEDENT>except ValueError:<EOL><INDENT>raise YaraConversionError('<STR_LIT>')<EOL><DEDENT>set_dict = {'<STR_LIT>': set_count, '<STR_LIT>': []}<EOL><DEDENT><DEDENT>for node in indicator_node.getchildren():<EOL><INDENT>node_id = node.get('<STR_LIT:id>')<EOL>safe_node_id = node_id.replace('<STR_LIT:->', '<STR_LIT>')<EOL>if node_id not in ids_to_process:<EOL><INDENT>continue<EOL><DEDENT>if node.tag == '<STR_LIT>':<EOL><INDENT>if is_set:<EOL><INDENT>set_dict['<STR_LIT>'].append('<STR_LIT:$>' + safe_node_id)<EOL><DEDENT>else:<EOL><INDENT>mapping = {'<STR_LIT>': '<STR_LIT:$>', '<STR_LIT>': safe_node_id, '<STR_LIT>': '<STR_LIT>', '<STR_LIT>': '<STR_LIT>'}<EOL>use_condition_template = False<EOL>negation = node.get('<STR_LIT>')<EOL>condition = node.get('<STR_LIT>')<EOL>search = node.xpath('<STR_LIT>')[<NUM_LIT:0>]<EOL>content = node.findtext('<STR_LIT>')<EOL>yara_condition = self.condition_to_yara_map[condition]<EOL>if not yara_condition:<EOL><INDENT>msg = '<STR_LIT>' % (str(node_id), str(condition))<EOL>raise YaraConversionError(msg)<EOL><DEDENT>if negation.lower() == '<STR_LIT:true>':<EOL><INDENT>negation = True<EOL><DEDENT>else:<EOL><INDENT>negation = False<EOL><DEDENT>if search == '<STR_LIT>':<EOL><INDENT>mapping['<STR_LIT>'] = '<STR_LIT>'<EOL>mapping['<STR_LIT>'] = '<STR_LIT>'<EOL>mapping['<STR_LIT>'] = '<STR_LIT:U+0020>' + content<EOL>mapping['<STR_LIT>'] = yara_condition<EOL>use_condition_template = True<EOL><DEDENT>elif search == '<STR_LIT>':<EOL><INDENT>if content not in self.ioc_names_set:<EOL><INDENT>if mangle_name(content) in self.ioc_names_mangled_set:<EOL><INDENT>msg = '<STR_LIT>'.format(mangle_name(content),<EOL>node_id)<EOL>log.warning(msg)<EOL>content = mangle_name(content)<EOL><DEDENT>else:<EOL><INDENT>log.warning('<STR_LIT>'<EOL>'<STR_LIT>'.format(content, node_id))<EOL><DEDENT><DEDENT>if mangle_name(content) != content:<EOL><INDENT>msg = '<STR_LIT>''<STR_LIT>'.format(node_id)<EOL>raise YaraConversionError(msg)<EOL><DEDENT>mapping['<STR_LIT>'] = '<STR_LIT>'<EOL>mapping['<STR_LIT>'] = content<EOL><DEDENT>else:<EOL><INDENT>xp = '<STR_LIT>''<STR_LIT>'.format(node_id)<EOL>params = parameters_node.xpath(xp)<EOL>if len(params) > <NUM_LIT:1>:<EOL><INDENT>msg = '<STR_LIT>'.format(node_id)<EOL>raise YaraConversionError(msg)<EOL><DEDENT>for param in params:<EOL><INDENT>param_name = param.get('<STR_LIT:name>', None)<EOL>if param_name == '<STR_LIT>':<EOL><INDENT>log.debug('<STR_LIT>' % (param.attrib['<STR_LIT:name>'], node_id))<EOL>mapping['<STR_LIT>'] = '<STR_LIT:#>'<EOL>mapping['<STR_LIT>'] = '<STR_LIT:U+0020>' + param.findtext('<STR_LIT:value>')<EOL>mapping['<STR_LIT>'] = yara_condition<EOL>use_condition_template = True<EOL>break<EOL><DEDENT>elif param_name == '<STR_LIT>':<EOL><INDENT>log.debug('<STR_LIT>' % (param.attrib['<STR_LIT:name>'], node_id))<EOL>mapping['<STR_LIT>'] = '<STR_LIT>'<EOL>mapping['<STR_LIT>'] = '<STR_LIT:U+0020>' + param.findtext('<STR_LIT:value>')<EOL>use_condition_template = True<EOL>break<EOL><DEDENT>elif param_name == '<STR_LIT>':<EOL><INDENT>log.debug('<STR_LIT>' % (param.attrib['<STR_LIT:name>'], node_id))<EOL>mapping['<STR_LIT>'] = '<STR_LIT>'<EOL>mapping['<STR_LIT>'] = '<STR_LIT:U+0020>' + param.findtext('<STR_LIT:value>')<EOL>use_condition_template = True<EOL>break<EOL><DEDENT><DEDENT><DEDENT>if use_condition_template:<EOL><INDENT>temp_string = self.yara_II_condition_template % mapping<EOL><DEDENT>else:<EOL><INDENT>temp_string = self.yara_II_template % mapping<EOL><DEDENT>if condition_string == '<STR_LIT>':<EOL><INDENT>condition_string = temp_string<EOL><DEDENT>else:<EOL><INDENT>condition_string = '<STR_LIT:U+0020>'.join([condition_string, joining_value, temp_string])<EOL><DEDENT><DEDENT><DEDENT>elif node.tag == '<STR_LIT>':<EOL><INDENT>if is_set:<EOL><INDENT>raise YaraConversionError('<STR_LIT>')<EOL><DEDENT>operator = node.get('<STR_LIT>').lower()<EOL>if operator not in ['<STR_LIT>', '<STR_LIT>']:<EOL><INDENT>raise YaraConversionError('<STR_LIT>' % (id, operator))<EOL><DEDENT>recursed_condition = self.get_yara_condition_string(node, parameters_node, ids_to_process, '<STR_LIT>', operator)<EOL>xp = '<STR_LIT>'.format(node_id)<EOL>if (not parameters_node.xpath(xp)) and has_siblings(node):<EOL><INDENT>recursed_condition = '<STR_LIT>' % recursed_condition<EOL><DEDENT>if condition_string == '<STR_LIT>':<EOL><INDENT>condition_string = recursed_condition<EOL><DEDENT>else:<EOL><INDENT>condition_string = '<STR_LIT:U+0020>'.join([condition_string, joining_value, recursed_condition])<EOL><DEDENT><DEDENT>else:<EOL><INDENT>raise YaraConversionError('<STR_LIT>' % str(id))<EOL><DEDENT><DEDENT>if is_set:<EOL><INDENT>log.debug('<STR_LIT>' % indicator_node_id)<EOL>if len(set_dict['<STR_LIT>']) == <NUM_LIT:0>:<EOL><INDENT>raise YaraConversionError('<STR_LIT>')<EOL><DEDENT>elif len(set_dict['<STR_LIT>']) == <NUM_LIT:1>:<EOL><INDENT>log.warning('<STR_LIT>' % node_id)<EOL>set_ids = '<STR_LIT>'.join(set_dict['<STR_LIT>'])<EOL><DEDENT>else:<EOL><INDENT>set_ids = '<STR_LIT:U+002C>'.join(set_dict['<STR_LIT>'])<EOL><DEDENT>set_dict['<STR_LIT>'] = set_ids<EOL>temp_set_string = self.yara_set_string_template % set_dict<EOL>if condition_string == '<STR_LIT>':<EOL><INDENT>condition_string = temp_set_string<EOL><DEDENT>else:<EOL><INDENT>condition_string = '<STR_LIT:U+0020>'.join(<EOL>[condition_string, indicator_node.getparent().get('<STR_LIT>').lower(), temp_set_string])<EOL><DEDENT><DEDENT>return condition_string<EOL>
get_yara_condition_string

input
    indicator_node: this is the node we walk down
    parameters_node: this contains all the parameters in the ioc, so we
        can look up parameters nodes as we walk them.
    ids_to_process: set of ids to upgrade
    condition_string: This represnts the yara condition string.  This
        string grows as we walk nodes.
return
    returns True upon completion
    may raise ValueError