❯ python scripts/capa2yara.py -q rules/host-interaction/file-system/reference-absolute-stream-path-on-windows.yml > test.yar
...

import "pe"


private rule capa_pe_file : CAPA {
    meta:
        description = "Match in PE files. Used by other CAPA rules"
    condition:
        uint16be(0) == 0x4d5a
        or uint16be(0) == 0x558b
        or uint16be(0) == 0x5649
}


rule capa_reference_absolute_stream_path_on_Windows : CAPA  {
  meta:
 	description = "reference absolute stream path on Windows (converted from capa rule)"
	namespace = "host-interaction/file-system"
	static scope = "basic block"
	dynamic scope = "call"
	hash = "51828683DC26BFABD3994494099AE97D"
	reference = "This YARA rule converted from capa rule: https://github.com/mandiant/capa-rules/blob/master/rules/host-interaction/file-system/reference-absolute-stream-path-on-windows.yml"
	capa_nursery = "False"
	date = "2024-04-05"
	minimum_yara = "3.8"
	license = "Apache-2.0 License"

  strings:
 	$re_aaa = /\x00(\\\\\?\\)?([\w]\:|\\)(\\((?![\<\>\"\/\|\*\?\:\\])[\x20-\x5B\x5D-\x7E])+)+\:\$?[a-zA-Z0-9_]+/ ascii wide

  condition:
    capa_pe_file and
 (
			$re_aaa
	)
}

❯ yara test.yar 51828683dc26bfabd3994494099ae97d.elf_
error: rule "capa_reference_absolute_stream_path_on_Windows" in test.yar(43): invalid regular expression "$re_aaa": syntax error

def get_unescaped_regex(regex):
    unescaped = regex.replace("\\\\", "\\")
    unescaped = unescaped.replace("\\/", "/")
    
    # Remove escaping of other special characters that don't need escaping in YARA
    unescaped = unescaped.replace("\\(", "(").replace("\\)", ")").replace("\\[", "[").replace("\\]", "]")
    
    return unescaped

# ... (rest of the imports and global variables)

def convert_rule(rule, rulename, cround, depth):
    # ... (previous code remains the same)

    elif s_type == "regex":
        regex = kid.get_value_str()
        logger.info("doing regex: %r", regex)

        # Use the new function to get unescaped regex
        regex = get_unescaped_regex(regex)

        # change capas /xxx/i to yaras /xxx/ nocase, count will be used later to decide appending 'nocase'
        regex, count = re.subn(r"/i$", "/", regex)

        # remove / in the beginning and end
        regex = regex[1:-1]

        # all .* in the regexes of capa look like they should be maximum 100 chars so take 1000 to speed up rules and prevent yara warnings on poor performance
        regex = regex.replace(".*", ".{,1000}")

        # capa uses python regex which accepts /reg(|.exe)/ but yaras regex engine doesn't not => fix it
        # /reg(|.exe)/ => /reg(.exe)?/
        regex = re.sub(r"\(\|([^\)]+)\)", r"(\1)?", regex)

        # change beginning of line to null byte, e.g. /^open => /\x00open
        regex = re.sub(r"^\^", r"\\x00", regex)

        regex = "/" + regex + "/"
        if count:
            regex += " nocase"

        var_name = "re_" + var_names.pop(0)
        yara_strings += "\t" + "$" + var_name + " = " + regex + " ascii wide " + convert_description(kid) + "\n"
        yara_condition += "\t" + "$" + var_name + " "

    # ... (rest of the code remains the same)

# ... (rest of the functions and main() remain the same)