yara-x-parser 1.5.0

A parsing library for YARA rules.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201

Begin { kind: SOURCE_FILE, span: Span(0..197) }
Begin { kind: RULE_DECL, span: Span(0..51) }
Token { kind: RULE_KW, span: Span(0..4) }
Token { kind: WHITESPACE, span: Span(4..5) }
Token { kind: IDENT, span: Span(5..11) }
Token { kind: WHITESPACE, span: Span(11..12) }
Token { kind: L_BRACE, span: Span(12..13) }
Token { kind: NEWLINE, span: Span(13..14) }
Token { kind: WHITESPACE, span: Span(14..15) }
Begin { kind: CONDITION_BLK, span: Span(15..49) }
Token { kind: CONDITION_KW, span: Span(15..24) }
Token { kind: COLON, span: Span(24..25) }
Token { kind: NEWLINE, span: Span(25..26) }
Token { kind: WHITESPACE, span: Span(26..29) }
Begin { kind: BOOLEAN_EXPR, span: Span(29..49) }
Begin { kind: BOOLEAN_TERM, span: Span(29..49) }
Begin { kind: EXPR, span: Span(29..40) }
Begin { kind: TERM, span: Span(29..40) }
Begin { kind: PRIMARY_EXPR, span: Span(29..40) }
Token { kind: IDENT, span: Span(29..32) }
Token { kind: DOT, span: Span(32..33) }
Token { kind: IDENT, span: Span(33..36) }
Token { kind: DOT, span: Span(36..37) }
Token { kind: IDENT, span: Span(37..40) }
End { kind: PRIMARY_EXPR, span: Span(29..40) }
End { kind: TERM, span: Span(29..40) }
End { kind: EXPR, span: Span(29..40) }
Token { kind: WHITESPACE, span: Span(40..41) }
Token { kind: EQ, span: Span(41..43) }
Token { kind: WHITESPACE, span: Span(43..44) }
Begin { kind: EXPR, span: Span(44..49) }
Begin { kind: TERM, span: Span(44..49) }
Begin { kind: FUNC_CALL, span: Span(44..49) }
Token { kind: IDENT, span: Span(44..47) }
Token { kind: L_PAREN, span: Span(47..48) }
Token { kind: R_PAREN, span: Span(48..49) }
End { kind: FUNC_CALL, span: Span(44..49) }
End { kind: TERM, span: Span(44..49) }
End { kind: EXPR, span: Span(44..49) }
End { kind: BOOLEAN_TERM, span: Span(29..49) }
End { kind: BOOLEAN_EXPR, span: Span(29..49) }
End { kind: CONDITION_BLK, span: Span(15..49) }
Token { kind: NEWLINE, span: Span(49..50) }
Token { kind: R_BRACE, span: Span(50..51) }
End { kind: RULE_DECL, span: Span(0..51) }
Token { kind: NEWLINE, span: Span(51..52) }
Token { kind: NEWLINE, span: Span(52..53) }
Begin { kind: RULE_DECL, span: Span(53..135) }
Token { kind: RULE_KW, span: Span(53..57) }
Token { kind: WHITESPACE, span: Span(57..58) }
Token { kind: IDENT, span: Span(58..64) }
Token { kind: WHITESPACE, span: Span(64..65) }
Token { kind: L_BRACE, span: Span(65..66) }
Token { kind: NEWLINE, span: Span(66..67) }
Token { kind: WHITESPACE, span: Span(67..68) }
Begin { kind: CONDITION_BLK, span: Span(68..133) }
Token { kind: CONDITION_KW, span: Span(68..77) }
Token { kind: COLON, span: Span(77..78) }
Token { kind: NEWLINE, span: Span(78..79) }
Token { kind: WHITESPACE, span: Span(79..82) }
Begin { kind: BOOLEAN_EXPR, span: Span(82..133) }
Begin { kind: BOOLEAN_TERM, span: Span(82..133) }
Begin { kind: EXPR, span: Span(82..115) }
Begin { kind: TERM, span: Span(82..115) }
Begin { kind: PRIMARY_EXPR, span: Span(82..89) }
Token { kind: IDENT, span: Span(82..85) }
Token { kind: DOT, span: Span(85..86) }
Token { kind: IDENT, span: Span(86..89) }
End { kind: PRIMARY_EXPR, span: Span(82..89) }
Token { kind: DOT, span: Span(89..90) }
Begin { kind: FUNC_CALL, span: Span(90..115) }
Token { kind: IDENT, span: Span(90..93) }
Token { kind: L_PAREN, span: Span(93..94) }
Begin { kind: BOOLEAN_EXPR, span: Span(94..99) }
Begin { kind: BOOLEAN_TERM, span: Span(94..99) }
Begin { kind: EXPR, span: Span(94..99) }
Begin { kind: TERM, span: Span(94..99) }
Begin { kind: PRIMARY_EXPR, span: Span(94..99) }
Token { kind: STRING_LIT, span: Span(94..99) }
End { kind: PRIMARY_EXPR, span: Span(94..99) }
End { kind: TERM, span: Span(94..99) }
End { kind: EXPR, span: Span(94..99) }
End { kind: BOOLEAN_TERM, span: Span(94..99) }
End { kind: BOOLEAN_EXPR, span: Span(94..99) }
Token { kind: COMMA, span: Span(99..100) }
Token { kind: WHITESPACE, span: Span(100..101) }
Begin { kind: BOOLEAN_EXPR, span: Span(101..102) }
Begin { kind: BOOLEAN_TERM, span: Span(101..102) }
Begin { kind: EXPR, span: Span(101..102) }
Begin { kind: TERM, span: Span(101..102) }
Begin { kind: PRIMARY_EXPR, span: Span(101..102) }
Token { kind: INTEGER_LIT, span: Span(101..102) }
End { kind: PRIMARY_EXPR, span: Span(101..102) }
End { kind: TERM, span: Span(101..102) }
End { kind: EXPR, span: Span(101..102) }
End { kind: BOOLEAN_TERM, span: Span(101..102) }
End { kind: BOOLEAN_EXPR, span: Span(101..102) }
Token { kind: COMMA, span: Span(102..103) }
Token { kind: WHITESPACE, span: Span(103..104) }
Begin { kind: BOOLEAN_EXPR, span: Span(104..108) }
Begin { kind: BOOLEAN_TERM, span: Span(104..108) }
Begin { kind: EXPR, span: Span(104..108) }
Begin { kind: TERM, span: Span(104..108) }
Begin { kind: PRIMARY_EXPR, span: Span(104..108) }
Token { kind: FLOAT_LIT, span: Span(104..108) }
End { kind: PRIMARY_EXPR, span: Span(104..108) }
End { kind: TERM, span: Span(104..108) }
End { kind: EXPR, span: Span(104..108) }
End { kind: BOOLEAN_TERM, span: Span(104..108) }
End { kind: BOOLEAN_EXPR, span: Span(104..108) }
Token { kind: COMMA, span: Span(108..109) }
Token { kind: WHITESPACE, span: Span(109..110) }
Begin { kind: BOOLEAN_EXPR, span: Span(110..114) }
Begin { kind: BOOLEAN_TERM, span: Span(110..114) }
Token { kind: TRUE_KW, span: Span(110..114) }
End { kind: BOOLEAN_TERM, span: Span(110..114) }
End { kind: BOOLEAN_EXPR, span: Span(110..114) }
Token { kind: R_PAREN, span: Span(114..115) }
End { kind: FUNC_CALL, span: Span(90..115) }
End { kind: TERM, span: Span(82..115) }
End { kind: EXPR, span: Span(82..115) }
Token { kind: WHITESPACE, span: Span(115..116) }
Token { kind: EQ, span: Span(116..118) }
Token { kind: WHITESPACE, span: Span(118..119) }
Begin { kind: EXPR, span: Span(119..133) }
Begin { kind: TERM, span: Span(119..133) }
Begin { kind: PRIMARY_EXPR, span: Span(119..130) }
Token { kind: IDENT, span: Span(119..122) }
Token { kind: DOT, span: Span(122..123) }
Token { kind: IDENT, span: Span(123..126) }
Token { kind: DOT, span: Span(126..127) }
Token { kind: IDENT, span: Span(127..130) }
End { kind: PRIMARY_EXPR, span: Span(119..130) }
Token { kind: L_BRACKET, span: Span(130..131) }
Begin { kind: EXPR, span: Span(131..132) }
Begin { kind: TERM, span: Span(131..132) }
Begin { kind: PRIMARY_EXPR, span: Span(131..132) }
Token { kind: INTEGER_LIT, span: Span(131..132) }
End { kind: PRIMARY_EXPR, span: Span(131..132) }
End { kind: TERM, span: Span(131..132) }
End { kind: EXPR, span: Span(131..132) }
Token { kind: R_BRACKET, span: Span(132..133) }
End { kind: TERM, span: Span(119..133) }
End { kind: EXPR, span: Span(119..133) }
End { kind: BOOLEAN_TERM, span: Span(82..133) }
End { kind: BOOLEAN_EXPR, span: Span(82..133) }
End { kind: CONDITION_BLK, span: Span(68..133) }
Token { kind: NEWLINE, span: Span(133..134) }
Token { kind: R_BRACE, span: Span(134..135) }
End { kind: RULE_DECL, span: Span(53..135) }
Token { kind: NEWLINE, span: Span(135..136) }
Token { kind: NEWLINE, span: Span(136..137) }
Token { kind: NEWLINE, span: Span(137..138) }
Begin { kind: RULE_DECL, span: Span(138..195) }
Token { kind: RULE_KW, span: Span(138..142) }
Token { kind: WHITESPACE, span: Span(142..143) }
Token { kind: IDENT, span: Span(143..149) }
Token { kind: WHITESPACE, span: Span(149..150) }
Token { kind: L_BRACE, span: Span(150..151) }
Token { kind: NEWLINE, span: Span(151..152) }
Token { kind: WHITESPACE, span: Span(152..153) }
Begin { kind: CONDITION_BLK, span: Span(153..193) }
Token { kind: CONDITION_KW, span: Span(153..162) }
Token { kind: COLON, span: Span(162..163) }
Token { kind: NEWLINE, span: Span(163..164) }
Token { kind: WHITESPACE, span: Span(164..167) }
Begin { kind: BOOLEAN_EXPR, span: Span(167..193) }
Begin { kind: BOOLEAN_TERM, span: Span(167..193) }
Token { kind: DEFINED_KW, span: Span(167..174) }
Token { kind: WHITESPACE, span: Span(174..175) }
Begin { kind: BOOLEAN_TERM, span: Span(175..193) }
Begin { kind: EXPR, span: Span(175..193) }
Begin { kind: TERM, span: Span(175..193) }
Begin { kind: PRIMARY_EXPR, span: Span(175..186) }
Token { kind: IDENT, span: Span(175..178) }
Token { kind: DOT, span: Span(178..179) }
Token { kind: IDENT, span: Span(179..182) }
Token { kind: DOT, span: Span(182..183) }
Token { kind: IDENT, span: Span(183..186) }
End { kind: PRIMARY_EXPR, span: Span(175..186) }
Token { kind: L_BRACKET, span: Span(186..187) }
Begin { kind: EXPR, span: Span(187..192) }
Begin { kind: TERM, span: Span(187..192) }
Begin { kind: PRIMARY_EXPR, span: Span(187..192) }
Token { kind: STRING_LIT, span: Span(187..192) }
End { kind: PRIMARY_EXPR, span: Span(187..192) }
End { kind: TERM, span: Span(187..192) }
End { kind: EXPR, span: Span(187..192) }
Token { kind: R_BRACKET, span: Span(192..193) }
End { kind: TERM, span: Span(175..193) }
End { kind: EXPR, span: Span(175..193) }
End { kind: BOOLEAN_TERM, span: Span(175..193) }
End { kind: BOOLEAN_TERM, span: Span(167..193) }
End { kind: BOOLEAN_EXPR, span: Span(167..193) }
End { kind: CONDITION_BLK, span: Span(153..193) }
Token { kind: NEWLINE, span: Span(193..194) }
Token { kind: R_BRACE, span: Span(194..195) }
End { kind: RULE_DECL, span: Span(138..195) }
Token { kind: NEWLINE, span: Span(195..196) }
Token { kind: NEWLINE, span: Span(196..197) }
End { kind: SOURCE_FILE, span: Span(0..197) }