yara-x-cli 1.22.1

A command-line interface for YARA-X. 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

use std::fs::File;
use std::path::PathBuf;

use anyhow::Context;
use clap::{Arg, ArgAction, ArgMatches, Command, arg, value_parser};
use yansi::Color::Cyan;
use yansi::Paint;

use crate::commands::{
    compilation_args, compile_rules, path_with_namespace_parser,
};
use crate::config::Config;

pub fn compile() -> Command {
    super::command("compile")
        .about("Compile rules to binary form")
        .arg(
            Arg::new("[NAMESPACE:]RULES_PATH")
                .required(true)
                .help("Path to a YARA source file or directory (optionally prefixed with a namespace)")
                .value_parser(path_with_namespace_parser)
                .action(ArgAction::Append)
        )
        .args(itertools::merge(compilation_args(), [
            arg!(-o --"output" <OUTPUT_PATH>)
                .help("Output file with compiled results")
                .default_value("output.yarc")
                .value_parser(value_parser!(PathBuf))]))
}

pub fn exec_compile(args: &ArgMatches, config: &Config) -> anyhow::Result<()> {
    let rules_path = args
        .get_many::<(Option<String>, PathBuf)>("[NAMESPACE:]RULES_PATH")
        .unwrap();

    let output_path = args.get_one::<PathBuf>("output").unwrap();
    let (rules, ignored_rules) = compile_rules(rules_path, args, config)?;

    let output_file = File::create(output_path).with_context(|| {
        format!("can not write `{}`", output_path.display())
    })?;

    rules.serialize_into(&output_file)?;

    // With `--ignore-invalid-rules` the valid rules are still written, but exit
    // with an error listing the ignored rules and reasons.
    if !ignored_rules.is_empty() {
        eprintln!(
            "{} {}",
            "note:".paint(Cyan).bold(),
            Paint::bold(&"the following rules were ignored:")
        );

        for (rule_name, reason) in &ignored_rules {
            eprintln!("  - {}: {}", rule_name.paint(Cyan).bold(), reason);
        }
    }

    Ok(())
}