Rule Variables

Used with d7x, KillEmAll, and CryptoPrevent

These Rule Variables are not supported in all ‘rules’ or ‘definition’ files.  Currently supported areas include:

• d7x – Uninstall/Delete > File System/Registry Deletion tabs.
  • (Certain variables are supported in MalwareScan whitelists, these will be clarified at a later time.)
• KillEmAll v5+ (stand-alone and d7x integrated) – Allowed Program Rules
• CryptoPrevent v8+ – Command line options, FolderWatch, SRP policies

Description:

A ‘variable’ refers to the same thing you might remember from Algebra, however for for these purposes specifically it is a plain text word, that is interpreted by the software and evaluated to determine if it should be replaced with different text for any reason.  This evaluation and decision would be performed based on certain conditions that could change the necessity of the textual data to be processed.

For our purposes, these Rule Variables have the following characteristics:

• Each variable (or lack thereof) in the ‘Search Path’ table will be evaluated to a certain file system location where files (programs) reside.

Normalizing:

When adding rules to a definition file in KillEmAll v5, you are presented with an automatic conversion to the appropriate matching Rule Variable as defined below.  This process is called “Normalizing” and is used by the software when comparing target items to the rules in your definition files.

In our case for example, one may wish to normalize an entry by substituting the word/variable “pf” to mean “Program Files” or “Program Files (x86)” (or both locations) depending on whether the operating system was 64bit or not.  (Note that normalizing to short words mean smaller data files, and subsequently faster interpretation by the application should files get very large.)

Normalizing is recommended but not necessary (nor is it desired in all cases) as one may want to intend for a very specific file/path to be interpreted instead of a general one.

Variable Delimiters:

Every variable needs a ‘delimiter’ to separate it from the text to be interpreted literally.  The delimiters in this case are  < and > which surround the variable.

Note the variable MUST begin with the < sign, and end with the > sign, and does not include a trailing backslash when replaced! 

• e.g.  <var>\path\file.exe

Examples:

• <d>\partial path\name.ext
  • evaluates to:
    • %systemdrive%\partial path\name.ext
    • (aka C:\ on most systems)

• <s>\file name.exe
  • evaluates to BOTH:
    • %windir%\system32\file name.exe
    • %windir%\syswow64\file name.exe
    • (aka C:\Windows\syswow64\file name.exe)

• <s32>\file name.exe
  • on 32bit systems AND/OR 64bit systems, evaluates to ONLY:
    • %windir%\system32\file name.exe
    • (aka C:\Windows\system32\file name.exe)

• <s64>\file name.exe
  • on 32bit systems, evaluates to ONLY:
    • %windir%\system32\file name.exe
    • (aka C:\Windows\system32\file name.exe)
  • on 64bit systems, evaluates to BOTH:
    • %windir%\system32\file name.exe
    • %windir%\syswow64\file name.exe
    • (aka C:\Windows\system32\file name.exe and C:\Windows\syswow64\file name.exe respectively)

32/64bit notes:

(although below is only given with <s> variant examples, the 32/64bit concept applies to similar variable variations e.g. <pf> and <cf>)

• use <s64> for 32bit only apps
  • (meaning it will be found in system32 on 32bit systems, or syswow64 on 64bit systems)
• use <s32> for 64bit only apps
  • (meaning it will always be found in system32)
• use <s> for unknown or both *bit apps
  • (evaluating to either/both system32 and/or syswow64 no matter what system it is on)

Windows Environment Variable notation (note the %variables% in the chart below) is provided as shorthand and for more knowledgable users and is explained below the variable in the first few occurrences, but may not be explained repetitively everywhere.  

Registry Variables

Additional registry variables can be used in the “Delete Rules (Registry Keys)” and “Delete Rules (Registry Values)” areas of the “File System/Registry Deletions” tab in d7x and in KillEmAll.

Examples:

• <sw>\some company name
  • evaluates to:
    • HKLM\Software\some company name
    • and HKCU\Software\some company name
    • and HKU\[user GUID]\Software\some company name

You are not required to use Registry Rule Variables with d7x. 

The rules defined here aren’t necessary, just a convenience factor for targeting multiple locations with a single entry.

Registry key/value rules support an absolute path, and the registry key/value rules on the Uninstall/Delete > File System/Registry Deletion tabs support both “HKLM” and “HKEY_LOCAL_MACHINE” syntax, so both forms are perfectly valid.  Valid examples include:

• HKLM\Software\some company name
• HKEY_LOCAL_MACHINE\Software\some company name