yara-x-parser 1.5.0

A parsing library for YARA rules.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163

Begin { kind: SOURCE_FILE, span: Span(0..190) }
Begin { kind: RULE_DECL, span: Span(0..104) }
Token { kind: RULE_KW, span: Span(0..4) }
Token { kind: WHITESPACE, span: Span(4..5) }
Token { kind: IDENT, span: Span(5..11) }
Token { kind: WHITESPACE, span: Span(11..12) }
Token { kind: L_BRACE, span: Span(12..13) }
Token { kind: NEWLINE, span: Span(13..14) }
Token { kind: WHITESPACE, span: Span(14..15) }
Begin { kind: PATTERNS_BLK, span: Span(15..81) }
Token { kind: STRINGS_KW, span: Span(15..22) }
Token { kind: COLON, span: Span(22..23) }
Token { kind: NEWLINE, span: Span(23..24) }
Token { kind: WHITESPACE, span: Span(24..27) }
Begin { kind: PATTERN_DEF, span: Span(27..81) }
Token { kind: PATTERN_IDENT, span: Span(27..29) }
Token { kind: WHITESPACE, span: Span(29..30) }
Token { kind: EQUAL, span: Span(30..31) }
Token { kind: WHITESPACE, span: Span(31..32) }
Begin { kind: HEX_PATTERN, span: Span(32..81) }
Token { kind: L_BRACE, span: Span(32..33) }
Token { kind: WHITESPACE, span: Span(33..34) }
Begin { kind: HEX_SUB_PATTERN, span: Span(34..79) }
Token { kind: HEX_BYTE, span: Span(34..36) }
Token { kind: WHITESPACE, span: Span(36..37) }
Begin { kind: HEX_JUMP, span: Span(37..40) }
Token { kind: L_BRACKET, span: Span(37..38) }
Token { kind: INTEGER_LIT, span: Span(38..39) }
Token { kind: R_BRACKET, span: Span(39..40) }
End { kind: HEX_JUMP, span: Span(37..40) }
Token { kind: WHITESPACE, span: Span(40..41) }
Token { kind: HEX_BYTE, span: Span(41..43) }
Token { kind: WHITESPACE, span: Span(43..44) }
Begin { kind: HEX_JUMP, span: Span(44..49) }
Token { kind: L_BRACKET, span: Span(44..45) }
Token { kind: INTEGER_LIT, span: Span(45..46) }
Token { kind: HYPHEN, span: Span(46..47) }
Token { kind: INTEGER_LIT, span: Span(47..48) }
Token { kind: R_BRACKET, span: Span(48..49) }
End { kind: HEX_JUMP, span: Span(44..49) }
Token { kind: WHITESPACE, span: Span(49..50) }
Token { kind: HEX_BYTE, span: Span(50..52) }
Token { kind: WHITESPACE, span: Span(52..53) }
Begin { kind: HEX_JUMP, span: Span(53..59) }
Token { kind: L_BRACKET, span: Span(53..54) }
Token { kind: HYPHEN, span: Span(54..55) }
Token { kind: INTEGER_LIT, span: Span(55..58) }
Token { kind: R_BRACKET, span: Span(58..59) }
End { kind: HEX_JUMP, span: Span(53..59) }
Token { kind: WHITESPACE, span: Span(59..60) }
Token { kind: HEX_BYTE, span: Span(60..62) }
Token { kind: WHITESPACE, span: Span(62..63) }
Begin { kind: HEX_JUMP, span: Span(63..69) }
Token { kind: L_BRACKET, span: Span(63..64) }
Token { kind: INTEGER_LIT, span: Span(64..67) }
Token { kind: HYPHEN, span: Span(67..68) }
Token { kind: R_BRACKET, span: Span(68..69) }
End { kind: HEX_JUMP, span: Span(63..69) }
Token { kind: WHITESPACE, span: Span(69..70) }
Token { kind: HEX_BYTE, span: Span(70..72) }
Token { kind: WHITESPACE, span: Span(72..73) }
Begin { kind: HEX_JUMP, span: Span(73..76) }
Token { kind: L_BRACKET, span: Span(73..74) }
Token { kind: HYPHEN, span: Span(74..75) }
Token { kind: R_BRACKET, span: Span(75..76) }
End { kind: HEX_JUMP, span: Span(73..76) }
Token { kind: WHITESPACE, span: Span(76..77) }
Token { kind: HEX_BYTE, span: Span(77..79) }
End { kind: HEX_SUB_PATTERN, span: Span(34..79) }
Token { kind: WHITESPACE, span: Span(79..80) }
Token { kind: R_BRACE, span: Span(80..81) }
End { kind: HEX_PATTERN, span: Span(32..81) }
End { kind: PATTERN_DEF, span: Span(27..81) }
End { kind: PATTERNS_BLK, span: Span(15..81) }
Token { kind: NEWLINE, span: Span(81..82) }
Token { kind: WHITESPACE, span: Span(82..84) }
Begin { kind: CONDITION_BLK, span: Span(84..102) }
Token { kind: CONDITION_KW, span: Span(84..93) }
Token { kind: COLON, span: Span(93..94) }
Token { kind: NEWLINE, span: Span(94..95) }
Token { kind: WHITESPACE, span: Span(95..98) }
Begin { kind: BOOLEAN_EXPR, span: Span(98..102) }
Begin { kind: BOOLEAN_TERM, span: Span(98..102) }
Token { kind: TRUE_KW, span: Span(98..102) }
End { kind: BOOLEAN_TERM, span: Span(98..102) }
End { kind: BOOLEAN_EXPR, span: Span(98..102) }
End { kind: CONDITION_BLK, span: Span(84..102) }
Token { kind: NEWLINE, span: Span(102..103) }
Token { kind: R_BRACE, span: Span(103..104) }
End { kind: RULE_DECL, span: Span(0..104) }
Token { kind: NEWLINE, span: Span(104..105) }
Token { kind: NEWLINE, span: Span(105..106) }
Begin { kind: RULE_DECL, span: Span(106..190) }
Token { kind: RULE_KW, span: Span(106..110) }
Token { kind: WHITESPACE, span: Span(110..111) }
Token { kind: IDENT, span: Span(111..117) }
Token { kind: WHITESPACE, span: Span(117..118) }
Token { kind: L_BRACE, span: Span(118..119) }
Token { kind: NEWLINE, span: Span(119..120) }
Token { kind: WHITESPACE, span: Span(120..121) }
Begin { kind: PATTERNS_BLK, span: Span(121..167) }
Token { kind: STRINGS_KW, span: Span(121..128) }
Token { kind: COLON, span: Span(128..129) }
Token { kind: NEWLINE, span: Span(129..130) }
Token { kind: WHITESPACE, span: Span(130..133) }
Begin { kind: PATTERN_DEF, span: Span(133..167) }
Token { kind: PATTERN_IDENT, span: Span(133..135) }
Token { kind: WHITESPACE, span: Span(135..136) }
Token { kind: EQUAL, span: Span(136..137) }
Token { kind: WHITESPACE, span: Span(137..138) }
Begin { kind: HEX_PATTERN, span: Span(138..167) }
Token { kind: L_BRACE, span: Span(138..139) }
Token { kind: WHITESPACE, span: Span(139..140) }
Begin { kind: HEX_SUB_PATTERN, span: Span(140..165) }
Token { kind: HEX_BYTE, span: Span(140..142) }
Token { kind: WHITESPACE, span: Span(142..143) }
Begin { kind: HEX_JUMP, span: Span(143..146) }
Token { kind: L_BRACKET, span: Span(143..144) }
Token { kind: INTEGER_LIT, span: Span(144..145) }
Token { kind: R_BRACKET, span: Span(145..146) }
End { kind: HEX_JUMP, span: Span(143..146) }
Token { kind: WHITESPACE, span: Span(146..147) }
Token { kind: HEX_BYTE, span: Span(147..149) }
Token { kind: WHITESPACE, span: Span(149..150) }
Begin { kind: HEX_JUMP, span: Span(150..155) }
Token { kind: L_BRACKET, span: Span(150..151) }
Token { kind: INTEGER_LIT, span: Span(151..152) }
Token { kind: HYPHEN, span: Span(152..153) }
Token { kind: INTEGER_LIT, span: Span(153..154) }
Token { kind: R_BRACKET, span: Span(154..155) }
End { kind: HEX_JUMP, span: Span(150..155) }
Token { kind: WHITESPACE, span: Span(155..156) }
Begin { kind: HEX_JUMP, span: Span(156..162) }
Token { kind: L_BRACKET, span: Span(156..157) }
Token { kind: INTEGER_LIT, span: Span(157..160) }
Token { kind: HYPHEN, span: Span(160..161) }
Token { kind: R_BRACKET, span: Span(161..162) }
End { kind: HEX_JUMP, span: Span(156..162) }
Token { kind: WHITESPACE, span: Span(162..163) }
Token { kind: HEX_BYTE, span: Span(163..165) }
End { kind: HEX_SUB_PATTERN, span: Span(140..165) }
Token { kind: WHITESPACE, span: Span(165..166) }
Token { kind: R_BRACE, span: Span(166..167) }
End { kind: HEX_PATTERN, span: Span(138..167) }
End { kind: PATTERN_DEF, span: Span(133..167) }
End { kind: PATTERNS_BLK, span: Span(121..167) }
Token { kind: NEWLINE, span: Span(167..168) }
Token { kind: WHITESPACE, span: Span(168..170) }
Begin { kind: CONDITION_BLK, span: Span(170..188) }
Token { kind: CONDITION_KW, span: Span(170..179) }
Token { kind: COLON, span: Span(179..180) }
Token { kind: NEWLINE, span: Span(180..181) }
Token { kind: WHITESPACE, span: Span(181..184) }
Begin { kind: BOOLEAN_EXPR, span: Span(184..188) }
Begin { kind: BOOLEAN_TERM, span: Span(184..188) }
Token { kind: TRUE_KW, span: Span(184..188) }
End { kind: BOOLEAN_TERM, span: Span(184..188) }
End { kind: BOOLEAN_EXPR, span: Span(184..188) }
End { kind: CONDITION_BLK, span: Span(170..188) }
Token { kind: NEWLINE, span: Span(188..189) }
Token { kind: R_BRACE, span: Span(189..190) }
End { kind: RULE_DECL, span: Span(106..190) }
End { kind: SOURCE_FILE, span: Span(0..190) }