boreal 0.1.0

A library to evaluate YARA rules, used to scan bytes for textual and binary pattern
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91

use boreal::scanner::ScanParams;

use crate::utils::Checker;

#[test]
fn test_limit_match_max_length() {
    let rule = r#"
rule a {
    strings:
        $r1 = /ba+b/
    condition:
        any of them
}
"#;

    let mut full_text: Vec<_> = Vec::new();
    full_text.push(b'b');
    full_text.extend(std::iter::repeat(b'a').take(1024));
    full_text.push(b'b');

    let checker = Checker::new(rule);
    checker.check_full_matches(
        &full_text,
        vec![
            // r1 match but is trimmed to 512 chars
            (
                "default:a".to_owned(),
                vec![("r1", vec![(&full_text[0..512], 0, 1026)])],
            ),
        ],
    );

    let mut checker = Checker::new_without_yara(rule);
    checker.set_scan_params(ScanParams::default().match_max_length(100_000));
    checker.check_full_matches(
        &full_text,
        vec![
            // r1 match but is trimmed to 512 chars
            (
                "default:a".to_owned(),
                vec![("r1", vec![(&full_text, 0, 1026)])],
            ),
        ],
    );
}

#[test]
fn test_limit_string_max_nb_matches() {
    let mem: Vec<_> = std::iter::repeat(0).take(1_100_000).collect();

    // Default for boreal is limited to 1_000
    let checker = Checker::new(
        r#"
rule a {
    strings:
        $a = { 00 }
    condition:
        #a == 1000
}
"#,
    );
    checker.check_boreal(&mem, true);

    // For YARA this is 1_000_000, but it exhibits the same behavior.
    let mut checker = Checker::new(
        r#"
rule a {
    strings:
        $a = { 00 }
    condition:
        #a == 1000000
}
"#,
    );
    checker.set_scan_params(ScanParams::default().string_max_nb_matches(1_000_000));
    checker.check(&mem, true);

    // Do this with a non-atomizable regex, to check the limit is also done outside of the ac scan
    // pass.
    let checker = Checker::new(
        r#"
rule a {
    strings:
        $a = { ?? }
    condition:
        #a == 1000
}
"#,
    );
    checker.check_boreal(&mem, true);
}