Count matches from a set of patterns.

8 files changed, 835 insertions, 8 deletions

diff --git a/src/analysis/scan/exprs/Makefile.am b/src/analysis/scan/exprs/Makefile.am
index d1a122a..a0b2f3d 100644
--- a/src/analysis/scan/exprs/Makefile.am
+++ b/src/analysis/scan/exprs/Makefile.am
@@ -27,6 +27,8 @@ libanalysisscanexprs_la_SOURCES =			\
 	relational.h relational.c				\
 	set-int.h								\
 	set.h set.c								\
+	setcounter-int.h						\
+	setcounter.h setcounter.c				\
 	strop-int.h								\
 	strop.h strop.c
 
diff --git a/src/analysis/scan/exprs/setcounter-int.h b/src/analysis/scan/exprs/setcounter-int.h
new file mode 100644
index 0000000..fbed209
--- /dev/null
+++ b/src/analysis/scan/exprs/setcounter-int.h
@@ -0,0 +1,62 @@
+
+/* Chrysalide - Outil d'analyse de fichiers binaires
+ * setcounter-int.h - prototypes internes pour le décompte global de correspondances locales
+ *
+ * Copyright (C) 2023 Cyrille Bagard
+ *
+ *  This file is part of Chrysalide.
+ *
+ *  Chrysalide is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  Chrysalide is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with Foobar.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+
+#ifndef _ANALYSIS_SCAN_EXPRS_SETCOUNTER_INT_H
+#define _ANALYSIS_SCAN_EXPRS_SETCOUNTER_INT_H
+
+
+#include "setcounter.h"
+
+
+#include "../expr-int.h"
+
+
+
+/* Décompte global de correspondances locales (instance) */
+struct _GScanSetMatchCounter
+{
+    GScanExpression parent;                 /* A laisser en premier        */
+
+    GSearchPattern **patterns;              /* Motifs associés             */
+    size_t count;                           /* Nombre de ces motifs        */
+
+    ScanSetCounterType type;                /* Type de décompte            */
+    size_t number;                          /* Eventuel volume associé     */
+
+};
+
+/* Décompte global de correspondances locales (classe) */
+struct _GScanSetMatchCounterClass
+{
+    GScanExpressionClass parent;            /* A laisser en premier        */
+
+};
+
+
+
+/* Met en place un décompte de motifs avec correspondances. */
+bool g_scan_set_match_counter_create(GScanSetMatchCounter *, GSearchPattern ** const, size_t);
+
+
+
+#endif  /* _ANALYSIS_SCAN_EXPRS_SETCOUNTER_INT_H */
diff --git a/src/analysis/scan/exprs/setcounter.c b/src/analysis/scan/exprs/setcounter.c
new file mode 100644
index 0000000..14e7676
--- /dev/null
+++ b/src/analysis/scan/exprs/setcounter.c
@@ -0,0 +1,368 @@
+
+/* Chrysalide - Outil d'analyse de fichiers binaires
+ * setcounter.c - décompte global de correspondances locales
+ *
+ * Copyright (C) 2023 Cyrille Bagard
+ *
+ *  This file is part of Chrysalide.
+ *
+ *  Chrysalide is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  Chrysalide is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with Foobar.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+
+#include "setcounter.h"
+
+
+#include "setcounter-int.h"
+#include "literal.h"
+
+
+
+/* --------------------- INSTANCIATION D'UNE FORME DE CONDITION --------------------- */
+
+
+/* Initialise la classe des opérations booléennes. */
+static void g_scan_set_match_counter_class_init(GScanSetMatchCounterClass *);
+
+/* Initialise une instance d'opération booléenne. */
+static void g_scan_set_match_counter_init(GScanSetMatchCounter *);
+
+/* Supprime toutes les références externes. */
+static void g_scan_set_match_counter_dispose(GScanSetMatchCounter *);
+
+/* Procède à la libération totale de la mémoire. */
+static void g_scan_set_match_counter_finalize(GScanSetMatchCounter *);
+
+
+
+/* --------------------- IMPLEMENTATION DES FONCTIONS DE CLASSE --------------------- */
+
+
+/* Réduit une expression à une forme plus simple. */
+static ScanReductionState g_scan_set_match_counter_reduce(const GScanSetMatchCounter *, GScanContext *, GScanScope *, GScanExpression **);
+
+
+
+/* ---------------------------------------------------------------------------------- */
+/*                       INSTANCIATION D'UNE FORME DE CONDITION                       */
+/* ---------------------------------------------------------------------------------- */
+
+
+/* Indique le type défini pour un décompte de résultats lors d'une recherche de motifs. */
+G_DEFINE_TYPE(GScanSetMatchCounter, g_scan_set_match_counter, G_TYPE_SCAN_EXPRESSION);
+
+
+/******************************************************************************
+*                                                                             *
+*  Paramètres  : klass = classe à initialiser.                                *
+*                                                                             *
+*  Description : Initialise la classe des opérations booléennes.              *
+*                                                                             *
+*  Retour      : -                                                            *
+*                                                                             *
+*  Remarques   : -                                                            *
+*                                                                             *
+******************************************************************************/
+
+static void g_scan_set_match_counter_class_init(GScanSetMatchCounterClass *klass)
+{
+    GObjectClass *object;                   /* Autre version de la classe  */
+    GScanExpressionClass *expr;             /* Version de classe parente   */
+
+    object = G_OBJECT_CLASS(klass);
+
+    object->dispose = (GObjectFinalizeFunc/* ! */)g_scan_set_match_counter_dispose;
+    object->finalize = (GObjectFinalizeFunc)g_scan_set_match_counter_finalize;
+
+    expr = G_SCAN_EXPRESSION_CLASS(klass);
+
+    expr->cmp_rich = (compare_expr_rich_fc)NULL;
+    expr->reduce = (reduce_expr_fc)g_scan_set_match_counter_reduce;
+
+}
+
+
+/******************************************************************************
+*                                                                             *
+*  Paramètres  : op = instance à initialiser.                                 *
+*                                                                             *
+*  Description : Initialise une instance d'opération booléenne.               *
+*                                                                             *
+*  Retour      : -                                                            *
+*                                                                             *
+*  Remarques   : -                                                            *
+*                                                                             *
+******************************************************************************/
+
+static void g_scan_set_match_counter_init(GScanSetMatchCounter *counter)
+{
+    counter->patterns = NULL;
+    counter->count = 0;
+
+    counter->type = SSCT_NONE;
+    counter->number = 0;
+
+}
+
+
+/******************************************************************************
+*                                                                             *
+*  Paramètres  : op = instance d'objet GLib à traiter.                        *
+*                                                                             *
+*  Description : Supprime toutes les références externes.                     *
+*                                                                             *
+*  Retour      : -                                                            *
+*                                                                             *
+*  Remarques   : -                                                            *
+*                                                                             *
+******************************************************************************/
+
+static void g_scan_set_match_counter_dispose(GScanSetMatchCounter *counter)
+{
+    size_t i;                               /* Boucle de parcours          */
+
+    for (i = 0; i < counter->count; i++)
+         g_clear_object(&counter->patterns[i]);
+
+    G_OBJECT_CLASS(g_scan_set_match_counter_parent_class)->dispose(G_OBJECT(counter));
+
+}
+
+
+/******************************************************************************
+*                                                                             *
+*  Paramètres  : op = instance d'objet GLib à traiter.                        *
+*                                                                             *
+*  Description : Procède à la libération totale de la mémoire.                *
+*                                                                             *
+*  Retour      : -                                                            *
+*                                                                             *
+*  Remarques   : -                                                            *
+*                                                                             *
+******************************************************************************/
+
+static void g_scan_set_match_counter_finalize(GScanSetMatchCounter *counter)
+{
+    if (counter->patterns != NULL)
+        free(counter->patterns);
+
+    G_OBJECT_CLASS(g_scan_set_match_counter_parent_class)->finalize(G_OBJECT(counter));
+
+}
+
+
+/******************************************************************************
+*                                                                             *
+*  Paramètres  : patterns = motifs à impliquer.                               *
+*                count    = quantité de ces motifs.                           *
+*                                                                             *
+*  Description : Constitue un décompte de motifs avec correspondances.        *
+*                                                                             *
+*  Retour      : Expression mise en place.                                    *
+*                                                                             *
+*  Remarques   : -                                                            *
+*                                                                             *
+******************************************************************************/
+
+GScanExpression *g_scan_set_match_counter_new(GSearchPattern ** const patterns, size_t count)
+{
+    GScanExpression *result;                /* Structure à retourner       */
+
+    result = g_object_new(G_TYPE_SCAN_SET_MATCH_COUNTER, NULL);
+
+    if (!g_scan_set_match_counter_create(G_SCAN_SET_MATCH_COUNTER(result), patterns, count))
+        g_clear_object(&result);
+
+    return result;
+
+}
+
+
+/******************************************************************************
+*                                                                             *
+*  Paramètres  : counter  = instance à initialiser pleinement.                *
+*                patterns = motifs à impliquer.                               *
+*                count    = quantité de ces motifs.                           *
+*                                                                             *
+*  Description : Met en place un décompte de motifs avec correspondances.     *
+*                                                                             *
+*  Retour      : Bilan de l'opération.                                        *
+*                                                                             *
+*  Remarques   : -                                                            *
+*                                                                             *
+******************************************************************************/
+
+bool g_scan_set_match_counter_create(GScanSetMatchCounter *counter, GSearchPattern ** const patterns, size_t count)
+{
+    bool result;                            /* Bilan à retourner           */
+    size_t i;                               /* Boucle de parcours          */
+
+    result = g_scan_expression_create(G_SCAN_EXPRESSION(counter), SRS_WAIT_FOR_SCAN);
+    if (!result) goto exit;
+
+    counter->patterns = malloc(count * sizeof(GSearchPattern *));
+    counter->count = count;
+
+    for (i = 0; i < count; i++)
+    {
+        counter->patterns[i] = patterns[i];
+        g_object_ref(G_OBJECT(patterns[i]));
+    }
+
+ exit:
+
+    return result;
+
+}
+
+
+/******************************************************************************
+*                                                                             *
+*  Paramètres  : counter  = décompte à compléter.                             *
+*                patterns = motifs à impliquer.                               *
+*                count    = quantité de ces motifs.                           *
+*                                                                             *
+*  Description : Ajoute de nouveaux motifs à un ensemble à décompter.         *
+*                                                                             *
+*  Retour      : -                                                            *
+*                                                                             *
+*  Remarques   : -                                                            *
+*                                                                             *
+******************************************************************************/
+
+void g_scan_set_match_counter_add_extra_patterns(GScanSetMatchCounter *counter, GSearchPattern ** const patterns, size_t count)
+{
+    size_t first;                           /* Premier emplacement libre   */
+    size_t i;                               /* Boucle de parcours          */
+
+    first = counter->count;
+
+    counter->count += count;
+    counter->patterns = realloc(counter->patterns, counter->count * sizeof(GSearchPattern *));
+
+    for (i = 0; i < count; i++)
+    {
+        counter->patterns[first + i] = patterns[i];
+        g_object_ref(G_OBJECT(patterns[i]));
+    }
+
+}
+
+
+/******************************************************************************
+*                                                                             *
+*  Paramètres  : counter = décompte à configurer.                             *
+*                type    = type de décompte à considérer.                     *
+*                number  = volume minimal de motifs avec correspondances.     *
+*                                                                             *
+*  Description : Précise le volume de motifs avec correspondances à retrouver.*
+*                                                                             *
+*  Retour      : Bilan de validité des arguments fournis.                     *
+*                                                                             *
+*  Remarques   : -                                                            *
+*                                                                             *
+******************************************************************************/
+
+bool g_scan_set_match_counter_define_expected_matches(GScanSetMatchCounter *counter, ScanSetCounterType type, size_t *number)
+{
+    bool result;                            /* Bilan à retourner           */
+
+    counter->type = type;
+
+    if (type == SSCT_NUMBER)
+    {
+        counter->number = *number;
+        result = (counter->number <= counter->count);
+    }
+    else
+        result = true;
+
+    return result;
+
+}
+
+
+
+/* ---------------------------------------------------------------------------------- */
+/*                       IMPLEMENTATION DES FONCTIONS DE CLASSE                       */
+/* ---------------------------------------------------------------------------------- */
+
+
+/******************************************************************************
+*                                                                             *
+*  Paramètres  : expr  = expression à consulter.                              *
+*                ctx   = contexte de suivi de l'analyse courante.             *
+*                scope = portée courante des variables locales.               *
+*                out   = zone d'enregistrement de la réduction opérée. [OUT]  *
+*                                                                             *
+*  Description : Réduit une expression à une forme plus simple.               *
+*                                                                             *
+*  Retour      : Bilan de l'opération : false en cas d'erreur irrécupérable.  *
+*                                                                             *
+*  Remarques   : -                                                            *
+*                                                                             *
+******************************************************************************/
+
+static ScanReductionState g_scan_set_match_counter_reduce(const GScanSetMatchCounter *expr, GScanContext *ctx, GScanScope *scope, GScanExpression **out)
+{
+    ScanReductionState result;              /* Etat synthétisé à retourner */
+    size_t matched;                         /* Qté de motifs avec résultats*/
+    size_t i;                               /* Boucle de parcours          */
+    size_t count;                           /* Quantité de correspondances */
+    bool status;                            /* Bilan d'évaluation finale   */
+
+    if (g_scan_context_is_scan_done(ctx))
+    {
+        matched = 0;
+
+        for (i = 0; i < expr->count; i++)
+        {
+            g_scan_context_get_full_matches(ctx, expr->patterns[i], &count);
+
+            if (count > 0)
+                matched++;
+
+        }
+
+        switch (expr->type)
+        {
+            case SSCT_NONE:
+                status = (matched == 0);
+                break;
+
+            case SSCT_ANY:
+                status = (matched >= 1);
+                break;
+
+            case SSCT_ALL:
+                status = (matched == expr->count);
+                break;
+
+            case SSCT_NUMBER:
+                status = (matched >= expr->number);
+                break;
+
+        }
+
+        *out = g_scan_literal_expression_new(LVT_BOOLEAN, &status);
+
+        result = SRS_REDUCED;
+
+    }
+    else
+        result = SRS_WAIT_FOR_SCAN;
+
+    return result;
+
+}
diff --git a/src/analysis/scan/exprs/setcounter.h b/src/analysis/scan/exprs/setcounter.h
new file mode 100644
index 0000000..59762f9
--- /dev/null
+++ b/src/analysis/scan/exprs/setcounter.h
@@ -0,0 +1,75 @@
+
+/* Chrysalide - Outil d'analyse de fichiers binaires
+ * setcounter.h - prototypes pour le décompte global de correspondances locales
+ *
+ * Copyright (C) 2023 Cyrille Bagard
+ *
+ *  This file is part of Chrysalide.
+ *
+ *  Chrysalide is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  Chrysalide is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with Foobar.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+
+#ifndef _ANALYSIS_SCAN_EXPRS_SETCOUNTER_H
+#define _ANALYSIS_SCAN_EXPRS_SETCOUNTER_H
+
+
+#include <glib-object.h>
+
+
+#include "../expr.h"
+#include "../pattern.h"
+
+
+
+#define G_TYPE_SCAN_SET_MATCH_COUNTER            g_scan_set_match_counter_get_type()
+#define G_SCAN_SET_MATCH_COUNTER(obj)            (G_TYPE_CHECK_INSTANCE_CAST((obj), G_TYPE_SCAN_SET_MATCH_COUNTER, GScanSetMatchCounter))
+#define G_IS_SCAN_SET_MATCH_COUNTER(obj)         (G_TYPE_CHECK_INSTANCE_TYPE((obj), G_TYPE_SCAN_SET_MATCH_COUNTER))
+#define G_SCAN_SET_MATCH_COUNTER_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST((klass), G_TYPE_SCAN_SET_MATCH_COUNTER, GScanSetMatchCounterClass))
+#define G_IS_SCAN_SET_MATCH_COUNTER_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE((klass), G_TYPE_SCAN_SET_MATCH_COUNTER))
+#define G_SCAN_SET_MATCH_COUNTER_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS((obj), G_TYPE_SCAN_SET_MATCH_COUNTER, GScanSetMatchCounterClass))
+
+
+/* Décompte global de correspondances locales (instance) */
+typedef struct _GScanSetMatchCounter GScanSetMatchCounter;
+
+/* Décompte global de correspondances locales (classe) */
+typedef struct _GScanSetMatchCounterClass GScanSetMatchCounterClass;
+
+
+/* Indique le type défini pour un décompte de résultats lors d'une recherche de motifs. */
+GType g_scan_set_match_counter_get_type(void);
+
+/* Met en place un décompte de correspondances obtenues. */
+GScanExpression *g_scan_set_match_counter_new(GSearchPattern ** const, size_t);
+
+/* Ajoute de nouveaux motifs à un ensemble à décompter. */
+void g_scan_set_match_counter_add_extra_patterns(GScanSetMatchCounter *, GSearchPattern ** const, size_t);
+
+/* Formes de volume de correspondances */
+typedef enum _ScanSetCounterType
+{
+    SSCT_NONE,                              /* Aucun motif avec résultats  */
+    SSCT_ANY,                               /* Au moins un motif trouvé    */
+    SSCT_ALL,                               /* Tous les motifs présents    */
+    SSCT_NUMBER,                            /* Au moins n motifs avec rés. */
+
+} ScanSetCounterType;
+
+/* Précise le volume de motifs avec correspondances à retrouver. */
+bool g_scan_set_match_counter_define_expected_matches(GScanSetMatchCounter *, ScanSetCounterType, size_t *);
+
+
+
+#endif  /* _ANALYSIS_SCAN_EXPRS_SETCOUNTER_H */
diff --git a/src/analysis/scan/grammar.y b/src/analysis/scan/grammar.y
index 70382cf..9ee0f28 100644
--- a/src/analysis/scan/grammar.y
+++ b/src/analysis/scan/grammar.y
@@ -37,6 +37,7 @@ typedef void *yyscan_t;
 #include "exprs/literal.h"
 #include "exprs/logical.h"
 #include "exprs/set.h"
+#include "exprs/setcounter.h"
 #include "exprs/relational.h"
 #include "exprs/strop.h"
 #include "patterns/modifier.h"
@@ -128,6 +129,7 @@ YY_DECL;
 
 
 %token BYTES_ID
+%token BYTES_FUZZY_ID
 %token BYTES_ID_COUNTER
 %token BYTES_ID_START
 %token BYTES_ID_LENGTH
@@ -220,6 +222,7 @@ YY_DECL;
 %type <sized_cstring> INFO_KEY
 
 %type <sized_cstring> BYTES_ID
+%type <sized_cstring> BYTES_FUZZY_ID
 %type <sized_cstring> BYTES_ID_COUNTER
 %type <sized_cstring> BYTES_ID_START
 %type <sized_cstring> BYTES_ID_LENGTH
@@ -272,7 +275,9 @@ YY_DECL;
 %type <expr> relational_expr
 %type <expr> string_op
 %type <expr> arithm_expr
-%type <expr> set_counter
+%type <expr> set_match_counter
+%type <expr> pattern_set
+%type <expr> pattern_set_items
 %type <expr> set
 %type <expr> set_items
 %type <expr> set_access
@@ -514,7 +519,7 @@ YY_DECL;
                            char *_msg;
                            int _ret;
 
-                           _ret = asprintf(&_msg, _("unknown modifier: \"%s\""), $1.data);
+                           _ret = asprintf(&_msg, _("Unknown modifier: \"%s\""), $1.data);
 
                            if (_ret != -1)
                            {
@@ -839,7 +844,7 @@ YY_DECL;
                    | relational_expr { $$ = $1; }
                    | string_op { $$ = $1; }
                    | arithm_expr { $$ = $1; }
-                   | set_counter { $$ = $1; }
+                   | set_match_counter { $$ = $1; }
                    | set { $$ = $1; }
                    | set_access { $$ = $1; }
                    | intersection { $$ = $1; }
@@ -993,10 +998,210 @@ relational_expr : cexpression "<" cexpression  { $$ = g_scan_relational_operatio
                 | cexpression "%" cexpression { $$ = g_scan_arithmetic_operation_new(AEO_MOD, $1, $3); }
                 ;
 
-set_counter : "none" "of" "them" { $$ = g_scan_literal_expression_new(LVT_BOOLEAN, (bool []){ true }); }
-            | "any" "of" "them"  { $$ = g_scan_literal_expression_new(LVT_BOOLEAN, (bool []){ true }); }
-            | "all" "of" "them"  { $$ = g_scan_literal_expression_new(LVT_BOOLEAN, (bool []){ true }); }
-            ;
+
+ set_match_counter : "none" "of" pattern_set
+                   {
+                       GScanSetMatchCounter *__counter;
+                       __counter = G_SCAN_SET_MATCH_COUNTER($3);
+                       g_scan_set_match_counter_define_expected_matches(__counter, SSCT_NONE, NULL);
+                       $$ = $3;
+                   }
+                   | "any" "of" pattern_set
+                   {
+                       GScanSetMatchCounter *__counter;
+                       __counter = G_SCAN_SET_MATCH_COUNTER($3);
+                       g_scan_set_match_counter_define_expected_matches(__counter, SSCT_ANY, NULL);
+                       $$ = $3;
+                   }
+                   | "all" "of" pattern_set
+                   {
+                       GScanSetMatchCounter *__counter;
+                       __counter = G_SCAN_SET_MATCH_COUNTER($3);
+                       g_scan_set_match_counter_define_expected_matches(__counter, SSCT_ALL, NULL);
+                       $$ = $3;
+                   }
+                   | UNSIGNED_INTEGER "of" pattern_set
+                   {
+                       GScanSetMatchCounter *__counter;
+                       size_t __number;
+                       bool __status;
+
+                       __counter = G_SCAN_SET_MATCH_COUNTER($3);
+                       __number = $1;
+
+                       __status = g_scan_set_match_counter_define_expected_matches(__counter,
+                                                                                   SSCT_NUMBER, &__number);
+
+                       if (!__status)
+                       {
+                           char *_msg;
+                           int _ret;
+
+                           _ret = asprintf(&_msg, _("Expected matches counter too high: %zu"), __number);
+
+                           if (_ret != -1)
+                           {
+                               raise_error(_msg);
+                               free(_msg);
+                           }
+
+                           YYERROR;
+                       }
+
+                       $$ = $3;
+
+                   }
+                   ;
+
+       pattern_set : "them"
+                   {
+                       size_t __count;
+                       GSearchPattern **__patterns;
+                       size_t __i;
+
+                       __patterns = g_scan_rule_get_local_variables(*built_rule, NULL, &__count);
+
+                       $$ = g_scan_set_match_counter_new(__patterns, __count);
+
+                       for (__i = 0; __i < __count; __i++)
+                           g_object_unref(G_OBJECT(__patterns[__i]));
+
+                       free(__patterns);
+
+                   }
+                   | "(" pattern_set_items ")"
+                   {
+                       $$ = $2;
+                   }
+                   ;
+
+ pattern_set_items : BYTES_ID
+                   {
+                       GSearchPattern *__pat;
+
+                       __pat = g_scan_rule_get_local_variable(*built_rule, $1.data);
+
+                       if (__pat == NULL)
+                       {
+                           char *_msg;
+                           int _ret;
+
+                           _ret = asprintf(&_msg, _("Pattern not found: \"%s\""), $1.data);
+
+                           if (_ret != -1)
+                           {
+                               raise_error(_msg);
+                               free(_msg);
+                           }
+
+                           YYERROR;
+                       }
+
+                       $$ = g_scan_set_match_counter_new((GSearchPattern *[]) { __pat }, 1);
+
+                       g_object_unref(G_OBJECT(__pat));
+
+                   }
+                   | BYTES_FUZZY_ID
+                   {
+                       size_t __count;
+                       GSearchPattern **__patterns;
+                       size_t __i;
+
+                       __patterns = g_scan_rule_get_local_variables(*built_rule, $1.data, &__count);
+
+                       if (__count == 0)
+                       {
+                           char *_msg;
+                           int _ret;
+
+                           _ret = asprintf(&_msg, _("Patterns not found: \"%s\""), $1.data);
+
+                           if (_ret != -1)
+                           {
+                               raise_error(_msg);
+                               free(_msg);
+                           }
+
+                           YYERROR;
+                       }
+
+                       $$ = g_scan_set_match_counter_new(__patterns, __count);
+
+                       for (__i = 0; __i < __count; __i++)
+                           g_object_unref(G_OBJECT(__patterns[__i]));
+
+                       free(__patterns);
+
+                   }
+                   | pattern_set_items "," BYTES_ID
+                   {
+                       GSearchPattern *__pat;
+                       GScanSetMatchCounter *__counter;
+
+                       __pat = g_scan_rule_get_local_variable(*built_rule, $3.data);
+
+                       if (__pat == NULL)
+                       {
+                           char *_msg;
+                           int _ret;
+
+                           _ret = asprintf(&_msg, _("Pattern not found: \"%s\""), $3.data);
+
+                           if (_ret != -1)
+                           {
+                               raise_error(_msg);
+                               free(_msg);
+                           }
+
+                           YYERROR;
+                       }
+
+                       __counter = G_SCAN_SET_MATCH_COUNTER($1);
+                       g_scan_set_match_counter_add_extra_patterns(__counter, (GSearchPattern *[]) { __pat }, 1);
+
+                       g_object_unref(G_OBJECT(__pat));
+
+                       $$ = $1;
+
+                   }
+                   | pattern_set_items "," BYTES_FUZZY_ID
+                   {
+                       size_t __count;
+                       GSearchPattern **__patterns;
+                       GScanSetMatchCounter *__counter;
+                       size_t __i;
+
+                       __patterns = g_scan_rule_get_local_variables(*built_rule, $3.data, &__count);
+
+                       if (__count == 0)
+                       {
+                           char *_msg;
+                           int _ret;
+
+                           _ret = asprintf(&_msg, _("Patterns not found: \"%s\""), $3.data);
+
+                           if (_ret != -1)
+                           {
+                               raise_error(_msg);
+                               free(_msg);
+                           }
+
+                           YYERROR;
+                       }
+
+                       __counter = G_SCAN_SET_MATCH_COUNTER($1);
+                       g_scan_set_match_counter_add_extra_patterns(__counter, __patterns, __count);
+
+                       for (__i = 0; __i < __count; __i++)
+                           g_object_unref(G_OBJECT(__patterns[__i]));
+
+                       free(__patterns);
+
+                       $$ = $1;
+
+                   }
+                   ;
 
 
             set : "(" ")"
diff --git a/src/analysis/scan/rule.c b/src/analysis/scan/rule.c
index 1d68b80..7719e8a 100644
--- a/src/analysis/scan/rule.c
+++ b/src/analysis/scan/rule.c
@@ -25,12 +25,15 @@
 
 
 #include <assert.h>
-#include <strings.h>
+#include <regex.h>
+#include <string.h>
 
 
 #include "rule-int.h"
 #include "matches/bytes.h"
 #include "patterns/token.h"
+#include "../../common/extstr.h"
+#include "../../core/logs.h"
 
 
 
@@ -276,6 +279,108 @@ GSearchPattern *g_scan_rule_get_local_variable(GScanRule *rule, const char *targ
 
 /******************************************************************************
 *                                                                             *
+*  Paramètres  : rule   = règle de détection à consulter.                     *
+*                target = nom d'une variable locale à retrouver.              *
+*                count  = quantité de motifs renvoyés. [OUT]                  *
+*                                                                             *
+*  Description : Fournit une liste de variables locales à partir d'un nom.    *
+*                                                                             *
+*  Retour      : Motifs de détection retrouvés ou NULL en cas d'échec.        *
+*                                                                             *
+*  Remarques   : -                                                            *
+*                                                                             *
+******************************************************************************/
+
+GSearchPattern **g_scan_rule_get_local_variables(GScanRule *rule, const char *target, size_t *count)
+{
+    GSearchPattern **result;                /* Variables à retourner       */
+    size_t i;                               /* Boucle de parcours          */
+    char *regex;                            /* Définition complète         */
+    regex_t preg;                           /* Expression compilée         */
+    int ret;                                /* Bilan d'un appel            */
+    const char *name;                       /* Désignation d'un motif      */
+
+    result = NULL;
+
+    *count = 0;
+
+    /* Premier cas de figure : la liste complète est attendue */
+
+    if (target == NULL)
+    {
+        *count = rule->bytes_used;
+        result = malloc(*count * sizeof(GSearchPattern *));
+
+        for (i = 0; i < rule->bytes_used; i++)
+        {
+            result[i] = rule->bytes_locals[i];
+            g_object_ref(G_OBJECT(result[i]));
+        }
+
+    }
+
+    /* Second cas de figure : une expression régulière est vraisemblablement de mise */
+
+    else
+    {
+        regex = strdup(target);
+
+        regex = strrpl(regex, "*", ".*");
+        regex = strprep(regex, "^");
+        regex = stradd(regex, "$");
+
+        printf("regex: %s\n", regex);
+
+        ret = regcomp(&preg, regex, REG_NOSUB);
+
+        if (ret != 0)
+        {
+            LOG_ERROR_REGCOMP(&preg, ret);
+            goto done;
+        }
+
+        result = malloc(rule->bytes_used * sizeof(GSearchPattern *));
+
+        for (i = 0; i < rule->bytes_used; i++)
+        {
+            name = g_search_pattern_get_name(rule->bytes_locals[i]);
+
+            ret = regexec(&preg, name, 0, NULL, 0);
+
+            if (ret != REG_NOMATCH)
+            {
+                result[*count] = rule->bytes_locals[i];
+                g_object_ref(G_OBJECT(result[*count]));
+
+                (*count)++;
+
+            }
+
+        }
+
+        printf(" ==> found: %zu patterns for '%s'\n", *count, target);
+
+        if (*count == 0)
+        {
+            free(result);
+            result = NULL;
+        }
+
+        regfree(&preg);
+
+ done:
+
+        free(regex);
+
+    }
+
+    return result;
+
+}
+
+
+/******************************************************************************
+*                                                                             *
 *  Paramètres  : rule = règle de détection à compléter.                       *
 *                expr = expression de condition à satisfaire.                 *
 *                                                                             *
diff --git a/src/analysis/scan/rule.h b/src/analysis/scan/rule.h
index cb2c287..20a688c 100644
--- a/src/analysis/scan/rule.h
+++ b/src/analysis/scan/rule.h
@@ -68,6 +68,9 @@ void g_scan_rule_add_local_variable(GScanRule *, GSearchPattern *);
 /* Fournit une variable locale à une règle selon un nom. */
 GSearchPattern *g_scan_rule_get_local_variable(GScanRule *, const char *);
 
+/*  Fournit une liste de variables locales à partir d'un nom. */
+GSearchPattern **g_scan_rule_get_local_variables(GScanRule *, const char *, size_t *);
+
 /* Définit l'expression d'une correspondance recherchée. */
 void g_scan_rule_set_match_condition(GScanRule *, GScanExpression *);
 
diff --git a/src/analysis/scan/tokens.l b/src/analysis/scan/tokens.l
index 1cf65fb..92cc858 100644
--- a/src/analysis/scan/tokens.l
+++ b/src/analysis/scan/tokens.l
@@ -368,6 +368,7 @@ reg_classes \\w|\\W|\\s|\\S|\\d|\\D|\\b|\\B
 
 
 bytes_id [A-Za-z_][A-Za-z0-9_]*
+bytes_fuzzy_id [\*A-Za-z_][\*A-Za-z0-9_]*
 
 
 %%
@@ -903,6 +904,12 @@ bytes_id [A-Za-z_][A-Za-z0-9_]*
                                         return BYTES_ID;
                                     }
 
+      <condition>${bytes_fuzzy_id}  {
+                                        yylval->sized_cstring.data = yytext + 1;
+                                        yylval->sized_cstring.len = yyleng - 1;
+                                        return BYTES_FUZZY_ID;
+                                    }
+
              <condition>#{bytes_id} {
                                         yylval->sized_cstring.data = yytext + 1;
                                         yylval->sized_cstring.len = yyleng - 1;