yara-x-cli 1.22.1

A command-line interface for YARA-X. 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126

use assert_cmd::{Command, cargo_bin};
use assert_fs::TempDir;
use assert_fs::prelude::*;

#[test]
fn ast() {
    Command::new(cargo_bin!("yr"))
        .arg("debug")
        .arg("ast")
        .arg("src/tests/testdata/foo.yar")
        .assert()
        .success();
}

#[test]
fn cst() {
    Command::new(cargo_bin!("yr"))
        .arg("debug")
        .arg("cst")
        .arg("src/tests/testdata/foo.yar")
        .assert()
        .success();
}

#[test]
fn wasm() {
    let temp_dir = TempDir::new().unwrap();
    let input_file = temp_dir.child("rule.yar");

    input_file.write_str("rule test { condition: true }").unwrap();

    Command::new(cargo_bin!("yr"))
        .arg("debug")
        .arg("wasm")
        .arg(input_file.path())
        .assert()
        .success();

    if !input_file.with_extension("wasm").exists() {
        panic!("`yr debug wasm` didn't create .wasm file")
    }
}

#[test]
fn atoms() {
    let temp_dir = TempDir::new().unwrap();
    let input_file = temp_dir.child("rule.yar");

    input_file
        .write_str(
            r#"
rule test {
    strings:
        $a = "ABCD"
        $b = { 01 02 03 04 }
        $c = { 30 ( 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 ) }

    condition:
        any of them
}
"#,
        )
        .unwrap();

    Command::new(cargo_bin!("yr"))
        .arg("debug")
        .arg("atoms")
        .arg(input_file.path())
        .assert()
        .success()
        .stdout(
            "\
rule test
  $a
    41424344 (ABCD)
  $b
    01020304
  $c
    3030..3039 (00..09)
",
        );

    Command::new(cargo_bin!("yr"))
        .arg("debug")
        .arg("atoms")
        .arg("--json")
        .arg(input_file.path())
        .assert()
        .success()
        .stdout(
            "\
[
  {
    \"rule\": \"test\",
    \"pattern\": \"$a\",
    \"atoms\": [
      \"41424344\"
    ]
  },
  {
    \"rule\": \"test\",
    \"pattern\": \"$b\",
    \"atoms\": [
      \"01020304\"
    ]
  },
  {
    \"rule\": \"test\",
    \"pattern\": \"$c\",
    \"atoms\": [
      \"3030\",
      \"3031\",
      \"3032\",
      \"3033\",
      \"3034\",
      \"3035\",
      \"3036\",
      \"3037\",
      \"3038\",
      \"3039\"
    ]
  }
]
",
        );
}