yara-x-parser 1.12.0

A parsing library for YARA rules.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273

Begin { kind: SOURCE_FILE, span: Span(0..572) }
Token { kind: COMMENT, span: Span(0..50) }
Token { kind: NEWLINE, span: Span(50..51) }
Token { kind: NEWLINE, span: Span(51..52) }
Begin { kind: RULE_DECL, span: Span(52..148) }
Token { kind: RULE_KW, span: Span(52..56) }
Token { kind: WHITESPACE, span: Span(56..57) }
Token { kind: IDENT, span: Span(57..61) }
Token { kind: WHITESPACE, span: Span(61..62) }
Token { kind: L_BRACE, span: Span(62..63) }
Token { kind: NEWLINE, span: Span(63..64) }
Token { kind: WHITESPACE, span: Span(64..66) }
Token { kind: COMMENT, span: Span(66..76) }
Token { kind: NEWLINE, span: Span(76..77) }
Token { kind: WHITESPACE, span: Span(77..78) }
Begin { kind: CONDITION_BLK, span: Span(78..133) }
Token { kind: CONDITION_KW, span: Span(78..87) }
Token { kind: COLON, span: Span(87..88) }
Token { kind: NEWLINE, span: Span(88..89) }
Token { kind: WHITESPACE, span: Span(89..91) }
Begin { kind: BOOLEAN_EXPR, span: Span(91..133) }
Begin { kind: BOOLEAN_TERM, span: Span(91..133) }
Begin { kind: EXPR, span: Span(91..96) }
Begin { kind: TERM, span: Span(91..92) }
Token { kind: INTEGER_LIT, span: Span(91..92) }
End { kind: TERM, span: Span(91..92) }
Token { kind: WHITESPACE, span: Span(92..93) }
Token { kind: ADD, span: Span(93..94) }
Token { kind: WHITESPACE, span: Span(94..95) }
Begin { kind: TERM, span: Span(95..96) }
Token { kind: INTEGER_LIT, span: Span(95..96) }
End { kind: TERM, span: Span(95..96) }
End { kind: EXPR, span: Span(91..96) }
Token { kind: NEWLINE, span: Span(96..97) }
Token { kind: WHITESPACE, span: Span(97..99) }
Token { kind: COMMENT, span: Span(99..109) }
Token { kind: NEWLINE, span: Span(109..110) }
Token { kind: WHITESPACE, span: Span(110..112) }
Token { kind: EQ, span: Span(112..114) }
Token { kind: WHITESPACE, span: Span(114..115) }
Token { kind: COMMENT, span: Span(115..125) }
Token { kind: NEWLINE, span: Span(125..126) }
Token { kind: WHITESPACE, span: Span(126..128) }
Begin { kind: EXPR, span: Span(128..133) }
Begin { kind: TERM, span: Span(128..129) }
Token { kind: INTEGER_LIT, span: Span(128..129) }
End { kind: TERM, span: Span(128..129) }
Token { kind: WHITESPACE, span: Span(129..130) }
Token { kind: SUB, span: Span(130..131) }
Token { kind: WHITESPACE, span: Span(131..132) }
Begin { kind: TERM, span: Span(132..133) }
Token { kind: INTEGER_LIT, span: Span(132..133) }
End { kind: TERM, span: Span(132..133) }
End { kind: EXPR, span: Span(128..133) }
End { kind: BOOLEAN_TERM, span: Span(91..133) }
End { kind: BOOLEAN_EXPR, span: Span(91..133) }
End { kind: CONDITION_BLK, span: Span(78..133) }
Token { kind: WHITESPACE, span: Span(133..136) }
Token { kind: COMMENT, span: Span(136..146) }
Token { kind: NEWLINE, span: Span(146..147) }
Token { kind: R_BRACE, span: Span(147..148) }
End { kind: RULE_DECL, span: Span(52..148) }
Token { kind: NEWLINE, span: Span(148..149) }
Token { kind: NEWLINE, span: Span(149..150) }
Begin { kind: RULE_DECL, span: Span(150..317) }
Token { kind: RULE_KW, span: Span(150..154) }
Token { kind: WHITESPACE, span: Span(154..155) }
Token { kind: IDENT, span: Span(155..159) }
Token { kind: WHITESPACE, span: Span(159..160) }
Token { kind: L_BRACE, span: Span(160..161) }
Token { kind: NEWLINE, span: Span(161..162) }
Token { kind: WHITESPACE, span: Span(162..164) }
Begin { kind: PATTERNS_BLK, span: Span(164..297) }
Token { kind: STRINGS_KW, span: Span(164..171) }
Token { kind: COLON, span: Span(171..172) }
Token { kind: NEWLINE, span: Span(172..173) }
Token { kind: WHITESPACE, span: Span(173..177) }
Begin { kind: PATTERN_DEF, span: Span(177..297) }
Token { kind: PATTERN_IDENT, span: Span(177..178) }
Token { kind: WHITESPACE, span: Span(178..179) }
Token { kind: EQUAL, span: Span(179..180) }
Token { kind: WHITESPACE, span: Span(180..181) }
Begin { kind: HEX_PATTERN, span: Span(181..297) }
Token { kind: L_BRACE, span: Span(181..182) }
Token { kind: NEWLINE, span: Span(182..183) }
Token { kind: WHITESPACE, span: Span(183..189) }
Token { kind: COMMENT, span: Span(189..199) }
Token { kind: NEWLINE, span: Span(199..200) }
Token { kind: WHITESPACE, span: Span(200..206) }
Begin { kind: HEX_SUB_PATTERN, span: Span(206..291) }
Token { kind: HEX_BYTE, span: Span(206..208) }
Token { kind: WHITESPACE, span: Span(208..209) }
Token { kind: HEX_BYTE, span: Span(209..211) }
Token { kind: NEWLINE, span: Span(211..212) }
Token { kind: WHITESPACE, span: Span(212..218) }
Token { kind: COMMENT, span: Span(218..231) }
Token { kind: NEWLINE, span: Span(231..232) }
Token { kind: WHITESPACE, span: Span(232..238) }
Token { kind: HEX_BYTE, span: Span(238..240) }
Token { kind: WHITESPACE, span: Span(240..241) }
Token { kind: HEX_BYTE, span: Span(241..243) }
Token { kind: NEWLINE, span: Span(243..244) }
Token { kind: WHITESPACE, span: Span(244..250) }
Token { kind: COMMENT, span: Span(250..279) }
Token { kind: NEWLINE, span: Span(279..280) }
Token { kind: WHITESPACE, span: Span(280..286) }
Token { kind: HEX_BYTE, span: Span(286..288) }
Token { kind: WHITESPACE, span: Span(288..289) }
Token { kind: HEX_BYTE, span: Span(289..291) }
End { kind: HEX_SUB_PATTERN, span: Span(206..291) }
Token { kind: NEWLINE, span: Span(291..292) }
Token { kind: WHITESPACE, span: Span(292..296) }
Token { kind: R_BRACE, span: Span(296..297) }
End { kind: HEX_PATTERN, span: Span(181..297) }
End { kind: PATTERN_DEF, span: Span(177..297) }
End { kind: PATTERNS_BLK, span: Span(164..297) }
Token { kind: NEWLINE, span: Span(297..298) }
Token { kind: NEWLINE, span: Span(298..299) }
Token { kind: WHITESPACE, span: Span(299..300) }
Begin { kind: CONDITION_BLK, span: Span(300..315) }
Token { kind: CONDITION_KW, span: Span(300..309) }
Token { kind: COLON, span: Span(309..310) }
Token { kind: NEWLINE, span: Span(310..311) }
Token { kind: WHITESPACE, span: Span(311..313) }
Begin { kind: BOOLEAN_EXPR, span: Span(313..315) }
Begin { kind: BOOLEAN_TERM, span: Span(313..315) }
Token { kind: PATTERN_IDENT, span: Span(313..315) }
End { kind: BOOLEAN_TERM, span: Span(313..315) }
End { kind: BOOLEAN_EXPR, span: Span(313..315) }
End { kind: CONDITION_BLK, span: Span(300..315) }
Token { kind: NEWLINE, span: Span(315..316) }
Token { kind: R_BRACE, span: Span(316..317) }
End { kind: RULE_DECL, span: Span(150..317) }
Token { kind: NEWLINE, span: Span(317..318) }
Token { kind: NEWLINE, span: Span(318..319) }
Begin { kind: RULE_DECL, span: Span(319..433) }
Token { kind: RULE_KW, span: Span(319..323) }
Token { kind: WHITESPACE, span: Span(323..324) }
Token { kind: IDENT, span: Span(324..328) }
Token { kind: WHITESPACE, span: Span(328..329) }
Token { kind: L_BRACE, span: Span(329..330) }
Token { kind: NEWLINE, span: Span(330..331) }
Token { kind: WHITESPACE, span: Span(331..333) }
Begin { kind: PATTERNS_BLK, span: Span(333..404) }
Token { kind: STRINGS_KW, span: Span(333..340) }
Token { kind: COLON, span: Span(340..341) }
Token { kind: NEWLINE, span: Span(341..342) }
Token { kind: WHITESPACE, span: Span(342..346) }
Begin { kind: PATTERN_DEF, span: Span(346..404) }
Token { kind: PATTERN_IDENT, span: Span(346..348) }
Token { kind: WHITESPACE, span: Span(348..349) }
Token { kind: EQUAL, span: Span(349..350) }
Token { kind: WHITESPACE, span: Span(350..351) }
Begin { kind: HEX_PATTERN, span: Span(351..404) }
Token { kind: L_BRACE, span: Span(351..352) }
Token { kind: NEWLINE, span: Span(352..353) }
Token { kind: WHITESPACE, span: Span(353..359) }
Begin { kind: HEX_SUB_PATTERN, span: Span(359..398) }
Token { kind: HEX_BYTE, span: Span(359..361) }
Token { kind: WHITESPACE, span: Span(361..362) }
Token { kind: HEX_BYTE, span: Span(362..364) }
Token { kind: WHITESPACE, span: Span(364..365) }
Token { kind: HEX_BYTE, span: Span(365..367) }
Token { kind: WHITESPACE, span: Span(367..368) }
Token { kind: COMMENT, span: Span(368..383) }
Token { kind: NEWLINE, span: Span(383..384) }
Token { kind: WHITESPACE, span: Span(384..390) }
Token { kind: HEX_BYTE, span: Span(390..392) }
Token { kind: WHITESPACE, span: Span(392..393) }
Token { kind: HEX_BYTE, span: Span(393..395) }
Token { kind: WHITESPACE, span: Span(395..396) }
Token { kind: HEX_BYTE, span: Span(396..398) }
End { kind: HEX_SUB_PATTERN, span: Span(359..398) }
Token { kind: NEWLINE, span: Span(398..399) }
Token { kind: WHITESPACE, span: Span(399..403) }
Token { kind: R_BRACE, span: Span(403..404) }
End { kind: HEX_PATTERN, span: Span(351..404) }
End { kind: PATTERN_DEF, span: Span(346..404) }
End { kind: PATTERNS_BLK, span: Span(333..404) }
Token { kind: NEWLINE, span: Span(404..405) }
Token { kind: WHITESPACE, span: Span(405..406) }
Begin { kind: CONDITION_BLK, span: Span(406..431) }
Token { kind: CONDITION_KW, span: Span(406..415) }
Token { kind: COLON, span: Span(415..416) }
Token { kind: NEWLINE, span: Span(416..417) }
Token { kind: WHITESPACE, span: Span(417..420) }
Begin { kind: BOOLEAN_EXPR, span: Span(420..431) }
Begin { kind: BOOLEAN_TERM, span: Span(420..431) }
Begin { kind: OF_EXPR, span: Span(420..431) }
Begin { kind: QUANTIFIER, span: Span(420..423) }
Token { kind: ALL_KW, span: Span(420..423) }
End { kind: QUANTIFIER, span: Span(420..423) }
Token { kind: WHITESPACE, span: Span(423..424) }
Token { kind: OF_KW, span: Span(424..426) }
Token { kind: WHITESPACE, span: Span(426..427) }
Token { kind: THEM_KW, span: Span(427..431) }
End { kind: OF_EXPR, span: Span(420..431) }
End { kind: BOOLEAN_TERM, span: Span(420..431) }
End { kind: BOOLEAN_EXPR, span: Span(420..431) }
End { kind: CONDITION_BLK, span: Span(406..431) }
Token { kind: NEWLINE, span: Span(431..432) }
Token { kind: R_BRACE, span: Span(432..433) }
End { kind: RULE_DECL, span: Span(319..433) }
Token { kind: NEWLINE, span: Span(433..434) }
Token { kind: NEWLINE, span: Span(434..435) }
Token { kind: NEWLINE, span: Span(435..436) }
Begin { kind: RULE_DECL, span: Span(436..572) }
Token { kind: RULE_KW, span: Span(436..440) }
Token { kind: WHITESPACE, span: Span(440..441) }
Token { kind: IDENT, span: Span(441..445) }
Token { kind: WHITESPACE, span: Span(445..446) }
Token { kind: L_BRACE, span: Span(446..447) }
Token { kind: NEWLINE, span: Span(447..448) }
Token { kind: WHITESPACE, span: Span(448..452) }
Begin { kind: PATTERNS_BLK, span: Span(452..537) }
Token { kind: STRINGS_KW, span: Span(452..459) }
Token { kind: COLON, span: Span(459..460) }
Token { kind: NEWLINE, span: Span(460..461) }
Token { kind: WHITESPACE, span: Span(461..469) }
Begin { kind: PATTERN_DEF, span: Span(469..499) }
Token { kind: PATTERN_IDENT, span: Span(469..471) }
Token { kind: WHITESPACE, span: Span(471..472) }
Token { kind: EQUAL, span: Span(472..473) }
Token { kind: WHITESPACE, span: Span(473..474) }
Token { kind: STRING_LIT, span: Span(474..479) }
Token { kind: WHITESPACE, span: Span(479..481) }
Token { kind: COMMENT, span: Span(481..494) }
Begin { kind: PATTERN_MODS, span: Span(494..499) }
Begin { kind: PATTERN_MOD, span: Span(494..499) }
Token { kind: ASCII_KW, span: Span(494..499) }
End { kind: PATTERN_MOD, span: Span(494..499) }
End { kind: PATTERN_MODS, span: Span(494..499) }
End { kind: PATTERN_DEF, span: Span(469..499) }
Token { kind: NEWLINE, span: Span(499..500) }
Token { kind: WHITESPACE, span: Span(500..508) }
Begin { kind: PATTERN_DEF, span: Span(508..537) }
Token { kind: PATTERN_IDENT, span: Span(508..510) }
Token { kind: WHITESPACE, span: Span(510..511) }
Token { kind: EQUAL, span: Span(511..512) }
Token { kind: WHITESPACE, span: Span(512..513) }
Token { kind: STRING_LIT, span: Span(513..518) }
Token { kind: WHITESPACE, span: Span(518..520) }
Token { kind: COMMENT, span: Span(520..533) }
Begin { kind: PATTERN_MODS, span: Span(533..537) }
Begin { kind: PATTERN_MOD, span: Span(533..537) }
Token { kind: WIDE_KW, span: Span(533..537) }
End { kind: PATTERN_MOD, span: Span(533..537) }
End { kind: PATTERN_MODS, span: Span(533..537) }
End { kind: PATTERN_DEF, span: Span(508..537) }
End { kind: PATTERNS_BLK, span: Span(452..537) }
Token { kind: NEWLINE, span: Span(537..538) }
Token { kind: WHITESPACE, span: Span(538..542) }
Begin { kind: CONDITION_BLK, span: Span(542..570) }
Token { kind: CONDITION_KW, span: Span(542..551) }
Token { kind: COLON, span: Span(551..552) }
Token { kind: NEWLINE, span: Span(552..553) }
Token { kind: WHITESPACE, span: Span(553..561) }
Begin { kind: BOOLEAN_EXPR, span: Span(561..570) }
Begin { kind: BOOLEAN_TERM, span: Span(561..563) }
Token { kind: PATTERN_IDENT, span: Span(561..563) }
End { kind: BOOLEAN_TERM, span: Span(561..563) }
Token { kind: WHITESPACE, span: Span(563..564) }
Token { kind: AND_KW, span: Span(564..567) }
Token { kind: WHITESPACE, span: Span(567..568) }
Begin { kind: BOOLEAN_TERM, span: Span(568..570) }
Token { kind: PATTERN_IDENT, span: Span(568..570) }
End { kind: BOOLEAN_TERM, span: Span(568..570) }
End { kind: BOOLEAN_EXPR, span: Span(561..570) }
End { kind: CONDITION_BLK, span: Span(542..570) }
Token { kind: NEWLINE, span: Span(570..571) }
Token { kind: R_BRACE, span: Span(571..572) }
End { kind: RULE_DECL, span: Span(436..572) }
End { kind: SOURCE_FILE, span: Span(0..572) }