syara-x 0.3.1

Super YARA — extends YARA-compatible rules with semantic, classifier, and LLM-based matching
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

/*!
SYARA-X — Super YARA in Rust.

Extends the YARA rule format with semantic, ML-classifier, and LLM-based matching.

# Example

```rust
use syara_x;

let rules = syara_x::compile_str(r#"
    rule test_rule {
        strings:
            $s1 = "hello world" nocase
        condition:
            $s1
    }
"#).unwrap();

let matches = rules.scan("Hello World");
assert_eq!(matches.iter().filter(|m| m.matched).count(), 1);
```
*/

pub(crate) mod cache;
pub mod compiled_rules;
pub(crate) mod compiler;
pub(crate) mod condition;
pub(crate) mod config;
pub mod engine;
pub mod error;
pub mod models;
pub(crate) mod parser;

pub use compiled_rules::CompiledRules;
pub use error::SyaraError;
pub use models::{Match, MatchDetail, Rule};

use std::path::Path;

/// Compile rules from a `.syara` file.
pub fn compile(path: impl AsRef<Path>) -> Result<CompiledRules, SyaraError> {
    let rules = parser::SyaraParser::new().parse_file(path)?;
    let registry = config::Registry::new();
    compiler::Compiler::compile(rules, registry)
}

/// Compile rules from a string.
pub fn compile_str(src: &str) -> Result<CompiledRules, SyaraError> {
    let rules = parser::SyaraParser::new().parse_str(src)?;
    let registry = config::Registry::new();
    compiler::Compiler::compile(rules, registry)
}