wide strings match only UTF16-LE
Describe the bug
The example string "Borland" from https://yara.readthedocs.io/en/v4.2.3/writingrules.html#wide-character-strings is there encoded as B\x00o\x00r\x00l\x00a\x00n\x00d\x00 but that's just the LE version of UTF16 with BE being\x00B\x00o\x00r\x00l\x00a\x00n\x00d (\x00 in front). So the example rule from the docs doesn't match UTF16-BE:
rule WideCharTextExample1
{
strings:
$wide_string = "Borland" wide
condition:
$wide_string
}UTF16-LE is by far the most common case but I stumbled upon the string Qi Lijun in UTF16-BE in
2fb7a38e69a88e3da8fece4c6a1a81842c1be6ae9d6ac299afa4aef4eb55fd4b
(however that happened ...)

(Actually this is more unexpected behavior than a bug but that fits better than a feature request.)
To Reproduce
rule WideCharTextExample1
{
strings:
$wide_string = "Qi Lijun" wide
condition:
$wide_string
}Doesn't match:
$ yara test.yar 2fb7a38e69a88e3da8fece4c6a1a81842c1be6ae9d6ac299afa4aef4eb55fd4bExpected behavior There would be several options to handle the problem:
Back to the
Borlandexample, the perfect solution would be to search for both UTF16-LE and UTF16-BE.UTF16-LE: B\x00o\x00r\x00l\x00a\x00n\x00d\x00UTF16-BE: \x00B\x00o\x00r\x00l\x00a\x00n\x00dThe faster and memory saving would be to strip the \x00 in the end of the existing implementation and search for:
B\x00o\x00r\x00l\x00a\x00n\x00d
That might hit wrong on very short strings (which shouldn't happen that often because of the performance and false positive problems).
Introduce e.g.
widebeas a new string modifier, similar to uint16be.Explain the issue in the docs and recommend to use hex for UTF16-BE.
Please complete the following information:
- OS: Linux
- YARA version: 4.3.0
Additional context
This also affects string search on VT. This search doesn't show any results: content:"Qi Lijun" tag:peexe
This shows 10 hits: content:{00 51 00 69 00 20 00 4c 00 69 00 6a 00 75 00 6e} (same string in hex(UTF16-BE) )
Source: VirusTotal/yara