yara-x-parser 1.6.0

A parsing library for YARA rules.
Documentation
Begin { kind: SOURCE_FILE, span: Span(0..489) }
Begin { kind: RULE_DECL, span: Span(0..65) }
Token { kind: RULE_KW, span: Span(0..4) }
Token { kind: WHITESPACE, span: Span(4..5) }
Token { kind: IDENT, span: Span(5..11) }
Token { kind: WHITESPACE, span: Span(11..12) }
Token { kind: L_BRACE, span: Span(12..13) }
Token { kind: NEWLINE, span: Span(13..14) }
Token { kind: WHITESPACE, span: Span(14..17) }
Begin { kind: PATTERNS_BLK, span: Span(17..41) }
Token { kind: STRINGS_KW, span: Span(17..24) }
Token { kind: COLON, span: Span(24..25) }
Token { kind: NEWLINE, span: Span(25..26) }
Token { kind: WHITESPACE, span: Span(26..31) }
Begin { kind: PATTERN_DEF, span: Span(31..41) }
Token { kind: PATTERN_IDENT, span: Span(31..33) }
Token { kind: WHITESPACE, span: Span(33..34) }
Token { kind: EQUAL, span: Span(34..35) }
Token { kind: WHITESPACE, span: Span(35..36) }
Token { kind: STRING_LIT, span: Span(36..41) }
End { kind: PATTERN_DEF, span: Span(31..41) }
End { kind: PATTERNS_BLK, span: Span(17..41) }
Token { kind: NEWLINE, span: Span(41..42) }
Token { kind: WHITESPACE, span: Span(42..45) }
Begin { kind: CONDITION_BLK, span: Span(45..63) }
Token { kind: CONDITION_KW, span: Span(45..54) }
Token { kind: COLON, span: Span(54..55) }
Token { kind: NEWLINE, span: Span(55..56) }
Token { kind: WHITESPACE, span: Span(56..61) }
Begin { kind: BOOLEAN_EXPR, span: Span(61..63) }
Begin { kind: BOOLEAN_TERM, span: Span(61..63) }
Token { kind: PATTERN_IDENT, span: Span(61..63) }
End { kind: BOOLEAN_TERM, span: Span(61..63) }
End { kind: BOOLEAN_EXPR, span: Span(61..63) }
End { kind: CONDITION_BLK, span: Span(45..63) }
Token { kind: NEWLINE, span: Span(63..64) }
Token { kind: R_BRACE, span: Span(64..65) }
End { kind: RULE_DECL, span: Span(0..65) }
Token { kind: NEWLINE, span: Span(65..66) }
Token { kind: NEWLINE, span: Span(66..67) }
Begin { kind: RULE_DECL, span: Span(67..143) }
Token { kind: RULE_KW, span: Span(67..71) }
Token { kind: WHITESPACE, span: Span(71..72) }
Token { kind: IDENT, span: Span(72..78) }
Token { kind: WHITESPACE, span: Span(78..79) }
Token { kind: L_BRACE, span: Span(79..80) }
Token { kind: NEWLINE, span: Span(80..81) }
Token { kind: WHITESPACE, span: Span(81..84) }
Begin { kind: PATTERNS_BLK, span: Span(84..108) }
Token { kind: STRINGS_KW, span: Span(84..91) }
Token { kind: COLON, span: Span(91..92) }
Token { kind: NEWLINE, span: Span(92..93) }
Token { kind: WHITESPACE, span: Span(93..98) }
Begin { kind: PATTERN_DEF, span: Span(98..108) }
Token { kind: PATTERN_IDENT, span: Span(98..100) }
Token { kind: WHITESPACE, span: Span(100..101) }
Token { kind: EQUAL, span: Span(101..102) }
Token { kind: WHITESPACE, span: Span(102..103) }
Token { kind: STRING_LIT, span: Span(103..108) }
End { kind: PATTERN_DEF, span: Span(98..108) }
End { kind: PATTERNS_BLK, span: Span(84..108) }
Token { kind: NEWLINE, span: Span(108..109) }
Token { kind: WHITESPACE, span: Span(109..112) }
Begin { kind: CONDITION_BLK, span: Span(112..141) }
Token { kind: CONDITION_KW, span: Span(112..121) }
Token { kind: COLON, span: Span(121..122) }
Token { kind: NEWLINE, span: Span(122..123) }
Token { kind: WHITESPACE, span: Span(123..128) }
Begin { kind: BOOLEAN_EXPR, span: Span(128..141) }
Begin { kind: BOOLEAN_TERM, span: Span(128..141) }
Token { kind: PATTERN_IDENT, span: Span(128..130) }
Token { kind: WHITESPACE, span: Span(130..131) }
Token { kind: IN_KW, span: Span(131..133) }
Token { kind: WHITESPACE, span: Span(133..134) }
Begin { kind: RANGE, span: Span(134..141) }
Token { kind: L_PAREN, span: Span(134..135) }
Begin { kind: EXPR, span: Span(135..136) }
Begin { kind: TERM, span: Span(135..136) }
Begin { kind: PRIMARY_EXPR, span: Span(135..136) }
Token { kind: INTEGER_LIT, span: Span(135..136) }
End { kind: PRIMARY_EXPR, span: Span(135..136) }
End { kind: TERM, span: Span(135..136) }
End { kind: EXPR, span: Span(135..136) }
Token { kind: DOT, span: Span(136..137) }
Token { kind: DOT, span: Span(137..138) }
Begin { kind: EXPR, span: Span(138..140) }
Begin { kind: TERM, span: Span(138..140) }
Begin { kind: PRIMARY_EXPR, span: Span(138..140) }
Token { kind: INTEGER_LIT, span: Span(138..140) }
End { kind: PRIMARY_EXPR, span: Span(138..140) }
End { kind: TERM, span: Span(138..140) }
End { kind: EXPR, span: Span(138..140) }
Token { kind: R_PAREN, span: Span(140..141) }
End { kind: RANGE, span: Span(134..141) }
End { kind: BOOLEAN_TERM, span: Span(128..141) }
End { kind: BOOLEAN_EXPR, span: Span(128..141) }
End { kind: CONDITION_BLK, span: Span(112..141) }
Token { kind: NEWLINE, span: Span(141..142) }
Token { kind: R_BRACE, span: Span(142..143) }
End { kind: RULE_DECL, span: Span(67..143) }
Token { kind: NEWLINE, span: Span(143..144) }
Token { kind: NEWLINE, span: Span(144..145) }
Token { kind: NEWLINE, span: Span(145..146) }
Begin { kind: RULE_DECL, span: Span(146..223) }
Token { kind: RULE_KW, span: Span(146..150) }
Token { kind: WHITESPACE, span: Span(150..151) }
Token { kind: IDENT, span: Span(151..157) }
Token { kind: WHITESPACE, span: Span(157..158) }
Token { kind: L_BRACE, span: Span(158..159) }
Token { kind: NEWLINE, span: Span(159..160) }
Token { kind: WHITESPACE, span: Span(160..163) }
Begin { kind: PATTERNS_BLK, span: Span(163..187) }
Token { kind: STRINGS_KW, span: Span(163..170) }
Token { kind: COLON, span: Span(170..171) }
Token { kind: NEWLINE, span: Span(171..172) }
Token { kind: WHITESPACE, span: Span(172..177) }
Begin { kind: PATTERN_DEF, span: Span(177..187) }
Token { kind: PATTERN_IDENT, span: Span(177..179) }
Token { kind: WHITESPACE, span: Span(179..180) }
Token { kind: EQUAL, span: Span(180..181) }
Token { kind: WHITESPACE, span: Span(181..182) }
Token { kind: STRING_LIT, span: Span(182..187) }
End { kind: PATTERN_DEF, span: Span(177..187) }
End { kind: PATTERNS_BLK, span: Span(163..187) }
Token { kind: NEWLINE, span: Span(187..188) }
Token { kind: WHITESPACE, span: Span(188..191) }
Begin { kind: CONDITION_BLK, span: Span(191..221) }
Token { kind: CONDITION_KW, span: Span(191..200) }
Token { kind: COLON, span: Span(200..201) }
Token { kind: NEWLINE, span: Span(201..202) }
Token { kind: WHITESPACE, span: Span(202..207) }
Begin { kind: BOOLEAN_EXPR, span: Span(207..221) }
Begin { kind: BOOLEAN_TERM, span: Span(207..221) }
Token { kind: PATTERN_IDENT, span: Span(207..209) }
Token { kind: WHITESPACE, span: Span(209..210) }
Token { kind: AT_KW, span: Span(210..212) }
Token { kind: WHITESPACE, span: Span(212..213) }
Begin { kind: EXPR, span: Span(213..221) }
Begin { kind: TERM, span: Span(213..221) }
Begin { kind: PRIMARY_EXPR, span: Span(213..221) }
Token { kind: FILESIZE_KW, span: Span(213..221) }
End { kind: PRIMARY_EXPR, span: Span(213..221) }
End { kind: TERM, span: Span(213..221) }
End { kind: EXPR, span: Span(213..221) }
End { kind: BOOLEAN_TERM, span: Span(207..221) }
End { kind: BOOLEAN_EXPR, span: Span(207..221) }
End { kind: CONDITION_BLK, span: Span(191..221) }
Token { kind: NEWLINE, span: Span(221..222) }
Token { kind: R_BRACE, span: Span(222..223) }
End { kind: RULE_DECL, span: Span(146..223) }
Token { kind: NEWLINE, span: Span(223..224) }
Token { kind: NEWLINE, span: Span(224..225) }
Begin { kind: RULE_DECL, span: Span(225..301) }
Token { kind: RULE_KW, span: Span(225..229) }
Token { kind: WHITESPACE, span: Span(229..230) }
Token { kind: IDENT, span: Span(230..236) }
Token { kind: WHITESPACE, span: Span(236..237) }
Token { kind: L_BRACE, span: Span(237..238) }
Token { kind: NEWLINE, span: Span(238..239) }
Token { kind: WHITESPACE, span: Span(239..242) }
Begin { kind: PATTERNS_BLK, span: Span(242..266) }
Token { kind: STRINGS_KW, span: Span(242..249) }
Token { kind: COLON, span: Span(249..250) }
Token { kind: NEWLINE, span: Span(250..251) }
Token { kind: WHITESPACE, span: Span(251..256) }
Begin { kind: PATTERN_DEF, span: Span(256..266) }
Token { kind: PATTERN_IDENT, span: Span(256..258) }
Token { kind: WHITESPACE, span: Span(258..259) }
Token { kind: EQUAL, span: Span(259..260) }
Token { kind: WHITESPACE, span: Span(260..261) }
Token { kind: STRING_LIT, span: Span(261..266) }
End { kind: PATTERN_DEF, span: Span(256..266) }
End { kind: PATTERNS_BLK, span: Span(242..266) }
Token { kind: NEWLINE, span: Span(266..267) }
Token { kind: WHITESPACE, span: Span(267..270) }
Begin { kind: CONDITION_BLK, span: Span(270..299) }
Token { kind: CONDITION_KW, span: Span(270..279) }
Token { kind: COLON, span: Span(279..280) }
Token { kind: NEWLINE, span: Span(280..281) }
Token { kind: WHITESPACE, span: Span(281..286) }
Begin { kind: BOOLEAN_EXPR, span: Span(286..299) }
Begin { kind: BOOLEAN_TERM, span: Span(286..299) }
Begin { kind: EXPR, span: Span(286..299) }
Begin { kind: TERM, span: Span(286..299) }
Begin { kind: PRIMARY_EXPR, span: Span(286..299) }
Token { kind: PATTERN_COUNT, span: Span(286..288) }
Token { kind: WHITESPACE, span: Span(288..289) }
Token { kind: IN_KW, span: Span(289..291) }
Token { kind: WHITESPACE, span: Span(291..292) }
Begin { kind: RANGE, span: Span(292..299) }
Token { kind: L_PAREN, span: Span(292..293) }
Begin { kind: EXPR, span: Span(293..294) }
Begin { kind: TERM, span: Span(293..294) }
Begin { kind: PRIMARY_EXPR, span: Span(293..294) }
Token { kind: INTEGER_LIT, span: Span(293..294) }
End { kind: PRIMARY_EXPR, span: Span(293..294) }
End { kind: TERM, span: Span(293..294) }
End { kind: EXPR, span: Span(293..294) }
Token { kind: DOT, span: Span(294..295) }
Token { kind: DOT, span: Span(295..296) }
Begin { kind: EXPR, span: Span(296..298) }
Begin { kind: TERM, span: Span(296..298) }
Begin { kind: PRIMARY_EXPR, span: Span(296..298) }
Token { kind: INTEGER_LIT, span: Span(296..298) }
End { kind: PRIMARY_EXPR, span: Span(296..298) }
End { kind: TERM, span: Span(296..298) }
End { kind: EXPR, span: Span(296..298) }
Token { kind: R_PAREN, span: Span(298..299) }
End { kind: RANGE, span: Span(292..299) }
End { kind: PRIMARY_EXPR, span: Span(286..299) }
End { kind: TERM, span: Span(286..299) }
End { kind: EXPR, span: Span(286..299) }
End { kind: BOOLEAN_TERM, span: Span(286..299) }
End { kind: BOOLEAN_EXPR, span: Span(286..299) }
End { kind: CONDITION_BLK, span: Span(270..299) }
Token { kind: NEWLINE, span: Span(299..300) }
Token { kind: R_BRACE, span: Span(300..301) }
End { kind: RULE_DECL, span: Span(225..301) }
Token { kind: NEWLINE, span: Span(301..302) }
Token { kind: NEWLINE, span: Span(302..303) }
Begin { kind: RULE_DECL, span: Span(303..391) }
Token { kind: RULE_KW, span: Span(303..307) }
Token { kind: WHITESPACE, span: Span(307..308) }
Token { kind: IDENT, span: Span(308..314) }
Token { kind: WHITESPACE, span: Span(314..315) }
Token { kind: L_BRACE, span: Span(315..316) }
Token { kind: NEWLINE, span: Span(316..317) }
Token { kind: WHITESPACE, span: Span(317..320) }
Begin { kind: PATTERNS_BLK, span: Span(320..344) }
Token { kind: STRINGS_KW, span: Span(320..327) }
Token { kind: COLON, span: Span(327..328) }
Token { kind: NEWLINE, span: Span(328..329) }
Token { kind: WHITESPACE, span: Span(329..334) }
Begin { kind: PATTERN_DEF, span: Span(334..344) }
Token { kind: PATTERN_IDENT, span: Span(334..336) }
Token { kind: WHITESPACE, span: Span(336..337) }
Token { kind: EQUAL, span: Span(337..338) }
Token { kind: WHITESPACE, span: Span(338..339) }
Token { kind: STRING_LIT, span: Span(339..344) }
End { kind: PATTERN_DEF, span: Span(334..344) }
End { kind: PATTERNS_BLK, span: Span(320..344) }
Token { kind: NEWLINE, span: Span(344..345) }
Token { kind: WHITESPACE, span: Span(345..348) }
Begin { kind: CONDITION_BLK, span: Span(348..388) }
Token { kind: CONDITION_KW, span: Span(348..357) }
Token { kind: COLON, span: Span(357..358) }
Token { kind: NEWLINE, span: Span(358..359) }
Token { kind: WHITESPACE, span: Span(359..364) }
Begin { kind: BOOLEAN_EXPR, span: Span(364..388) }
Begin { kind: BOOLEAN_TERM, span: Span(364..372) }
Begin { kind: EXPR, span: Span(364..366) }
Begin { kind: TERM, span: Span(364..366) }
Begin { kind: PRIMARY_EXPR, span: Span(364..366) }
Token { kind: PATTERN_OFFSET, span: Span(364..366) }
End { kind: PRIMARY_EXPR, span: Span(364..366) }
End { kind: TERM, span: Span(364..366) }
End { kind: EXPR, span: Span(364..366) }
Token { kind: WHITESPACE, span: Span(366..367) }
Token { kind: EQ, span: Span(367..369) }
Token { kind: WHITESPACE, span: Span(369..370) }
Begin { kind: EXPR, span: Span(370..372) }
Begin { kind: TERM, span: Span(370..372) }
Begin { kind: PRIMARY_EXPR, span: Span(370..372) }
Token { kind: INTEGER_LIT, span: Span(370..372) }
End { kind: PRIMARY_EXPR, span: Span(370..372) }
End { kind: TERM, span: Span(370..372) }
End { kind: EXPR, span: Span(370..372) }
End { kind: BOOLEAN_TERM, span: Span(364..372) }
Token { kind: WHITESPACE, span: Span(372..373) }
Token { kind: AND_KW, span: Span(373..376) }
Token { kind: WHITESPACE, span: Span(376..377) }
Begin { kind: BOOLEAN_TERM, span: Span(377..388) }
Begin { kind: EXPR, span: Span(377..382) }
Begin { kind: TERM, span: Span(377..382) }
Begin { kind: PRIMARY_EXPR, span: Span(377..382) }
Token { kind: PATTERN_OFFSET, span: Span(377..379) }
Token { kind: L_BRACKET, span: Span(379..380) }
Begin { kind: EXPR, span: Span(380..381) }
Begin { kind: TERM, span: Span(380..381) }
Begin { kind: PRIMARY_EXPR, span: Span(380..381) }
Token { kind: INTEGER_LIT, span: Span(380..381) }
End { kind: PRIMARY_EXPR, span: Span(380..381) }
End { kind: TERM, span: Span(380..381) }
End { kind: EXPR, span: Span(380..381) }
Token { kind: R_BRACKET, span: Span(381..382) }
End { kind: PRIMARY_EXPR, span: Span(377..382) }
End { kind: TERM, span: Span(377..382) }
End { kind: EXPR, span: Span(377..382) }
Token { kind: WHITESPACE, span: Span(382..383) }
Token { kind: EQ, span: Span(383..385) }
Token { kind: WHITESPACE, span: Span(385..386) }
Begin { kind: EXPR, span: Span(386..388) }
Begin { kind: TERM, span: Span(386..388) }
Begin { kind: PRIMARY_EXPR, span: Span(386..388) }
Token { kind: INTEGER_LIT, span: Span(386..388) }
End { kind: PRIMARY_EXPR, span: Span(386..388) }
End { kind: TERM, span: Span(386..388) }
End { kind: EXPR, span: Span(386..388) }
End { kind: BOOLEAN_TERM, span: Span(377..388) }
End { kind: BOOLEAN_EXPR, span: Span(364..388) }
End { kind: CONDITION_BLK, span: Span(348..388) }
Token { kind: NEWLINE, span: Span(388..389) }
Token { kind: WHITESPACE, span: Span(389..390) }
Token { kind: R_BRACE, span: Span(390..391) }
End { kind: RULE_DECL, span: Span(303..391) }
Token { kind: NEWLINE, span: Span(391..392) }
Token { kind: NEWLINE, span: Span(392..393) }
Token { kind: WHITESPACE, span: Span(393..394) }
Begin { kind: RULE_DECL, span: Span(394..489) }
Token { kind: RULE_KW, span: Span(394..398) }
Token { kind: WHITESPACE, span: Span(398..399) }
Token { kind: IDENT, span: Span(399..405) }
Token { kind: WHITESPACE, span: Span(405..406) }
Token { kind: L_BRACE, span: Span(406..407) }
Token { kind: NEWLINE, span: Span(407..408) }
Token { kind: WHITESPACE, span: Span(408..412) }
Begin { kind: PATTERNS_BLK, span: Span(412..437) }
Token { kind: STRINGS_KW, span: Span(412..419) }
Token { kind: COLON, span: Span(419..420) }
Token { kind: NEWLINE, span: Span(420..421) }
Token { kind: WHITESPACE, span: Span(421..427) }
Begin { kind: PATTERN_DEF, span: Span(427..437) }
Token { kind: PATTERN_IDENT, span: Span(427..429) }
Token { kind: WHITESPACE, span: Span(429..430) }
Token { kind: EQUAL, span: Span(430..431) }
Token { kind: WHITESPACE, span: Span(431..432) }
Token { kind: STRING_LIT, span: Span(432..437) }
End { kind: PATTERN_DEF, span: Span(427..437) }
End { kind: PATTERNS_BLK, span: Span(412..437) }
Token { kind: NEWLINE, span: Span(437..438) }
Token { kind: WHITESPACE, span: Span(438..442) }
Begin { kind: CONDITION_BLK, span: Span(442..485) }
Token { kind: CONDITION_KW, span: Span(442..451) }
Token { kind: COLON, span: Span(451..452) }
Token { kind: NEWLINE, span: Span(452..453) }
Token { kind: WHITESPACE, span: Span(453..459) }
Begin { kind: BOOLEAN_EXPR, span: Span(459..485) }
Begin { kind: BOOLEAN_TERM, span: Span(459..467) }
Begin { kind: EXPR, span: Span(459..461) }
Begin { kind: TERM, span: Span(459..461) }
Begin { kind: PRIMARY_EXPR, span: Span(459..461) }
Token { kind: PATTERN_LENGTH, span: Span(459..461) }
End { kind: PRIMARY_EXPR, span: Span(459..461) }
End { kind: TERM, span: Span(459..461) }
End { kind: EXPR, span: Span(459..461) }
Token { kind: WHITESPACE, span: Span(461..462) }
Token { kind: EQ, span: Span(462..464) }
Token { kind: WHITESPACE, span: Span(464..465) }
Begin { kind: EXPR, span: Span(465..467) }
Begin { kind: TERM, span: Span(465..467) }
Begin { kind: PRIMARY_EXPR, span: Span(465..467) }
Token { kind: INTEGER_LIT, span: Span(465..467) }
End { kind: PRIMARY_EXPR, span: Span(465..467) }
End { kind: TERM, span: Span(465..467) }
End { kind: EXPR, span: Span(465..467) }
End { kind: BOOLEAN_TERM, span: Span(459..467) }
Token { kind: WHITESPACE, span: Span(467..468) }
Token { kind: AND_KW, span: Span(468..471) }
Token { kind: WHITESPACE, span: Span(471..472) }
Begin { kind: BOOLEAN_TERM, span: Span(472..485) }
Begin { kind: EXPR, span: Span(472..479) }
Begin { kind: TERM, span: Span(472..479) }
Begin { kind: PRIMARY_EXPR, span: Span(472..479) }
Token { kind: PATTERN_LENGTH, span: Span(472..474) }
Token { kind: L_BRACKET, span: Span(474..475) }
Begin { kind: EXPR, span: Span(475..478) }
Begin { kind: TERM, span: Span(475..476) }
Begin { kind: PRIMARY_EXPR, span: Span(475..476) }
Token { kind: INTEGER_LIT, span: Span(475..476) }
End { kind: PRIMARY_EXPR, span: Span(475..476) }
End { kind: TERM, span: Span(475..476) }
Token { kind: ADD, span: Span(476..477) }
Begin { kind: TERM, span: Span(477..478) }
Begin { kind: PRIMARY_EXPR, span: Span(477..478) }
Token { kind: INTEGER_LIT, span: Span(477..478) }
End { kind: PRIMARY_EXPR, span: Span(477..478) }
End { kind: TERM, span: Span(477..478) }
End { kind: EXPR, span: Span(475..478) }
Token { kind: R_BRACKET, span: Span(478..479) }
End { kind: PRIMARY_EXPR, span: Span(472..479) }
End { kind: TERM, span: Span(472..479) }
End { kind: EXPR, span: Span(472..479) }
Token { kind: WHITESPACE, span: Span(479..480) }
Token { kind: EQ, span: Span(480..482) }
Token { kind: WHITESPACE, span: Span(482..483) }
Begin { kind: EXPR, span: Span(483..485) }
Begin { kind: TERM, span: Span(483..485) }
Begin { kind: PRIMARY_EXPR, span: Span(483..485) }
Token { kind: INTEGER_LIT, span: Span(483..485) }
End { kind: PRIMARY_EXPR, span: Span(483..485) }
End { kind: TERM, span: Span(483..485) }
End { kind: EXPR, span: Span(483..485) }
End { kind: BOOLEAN_TERM, span: Span(472..485) }
End { kind: BOOLEAN_EXPR, span: Span(459..485) }
End { kind: CONDITION_BLK, span: Span(442..485) }
Token { kind: NEWLINE, span: Span(485..486) }
Token { kind: WHITESPACE, span: Span(486..488) }
Token { kind: R_BRACE, span: Span(488..489) }
End { kind: RULE_DECL, span: Span(394..489) }
End { kind: SOURCE_FILE, span: Span(0..489) }