yara-x-parser 1.6.0

A parsing library for YARA rules.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362

Begin { kind: SOURCE_FILE, span: Span(0..382) }
Begin { kind: RULE_DECL, span: Span(0..41) }
Token { kind: RULE_KW, span: Span(0..4) }
Token { kind: WHITESPACE, span: Span(4..5) }
Token { kind: IDENT, span: Span(5..11) }
Token { kind: WHITESPACE, span: Span(11..12) }
Token { kind: L_BRACE, span: Span(12..13) }
Token { kind: NEWLINE, span: Span(13..14) }
Token { kind: WHITESPACE, span: Span(14..15) }
Begin { kind: CONDITION_BLK, span: Span(15..39) }
Token { kind: CONDITION_KW, span: Span(15..24) }
Token { kind: COLON, span: Span(24..25) }
Token { kind: NEWLINE, span: Span(25..26) }
Token { kind: WHITESPACE, span: Span(26..28) }
Begin { kind: BOOLEAN_EXPR, span: Span(28..39) }
Begin { kind: BOOLEAN_TERM, span: Span(28..39) }
Begin { kind: OF_EXPR, span: Span(28..39) }
Begin { kind: QUANTIFIER, span: Span(28..31) }
Token { kind: ALL_KW, span: Span(28..31) }
End { kind: QUANTIFIER, span: Span(28..31) }
Token { kind: WHITESPACE, span: Span(31..32) }
Token { kind: OF_KW, span: Span(32..34) }
Token { kind: WHITESPACE, span: Span(34..35) }
Token { kind: THEM_KW, span: Span(35..39) }
End { kind: OF_EXPR, span: Span(28..39) }
End { kind: BOOLEAN_TERM, span: Span(28..39) }
End { kind: BOOLEAN_EXPR, span: Span(28..39) }
End { kind: CONDITION_BLK, span: Span(15..39) }
Token { kind: NEWLINE, span: Span(39..40) }
Token { kind: R_BRACE, span: Span(40..41) }
End { kind: RULE_DECL, span: Span(0..41) }
Token { kind: NEWLINE, span: Span(41..42) }
Token { kind: NEWLINE, span: Span(42..43) }
Begin { kind: RULE_DECL, span: Span(43..89) }
Token { kind: RULE_KW, span: Span(43..47) }
Token { kind: WHITESPACE, span: Span(47..48) }
Token { kind: IDENT, span: Span(48..54) }
Token { kind: WHITESPACE, span: Span(54..55) }
Token { kind: L_BRACE, span: Span(55..56) }
Token { kind: NEWLINE, span: Span(56..57) }
Token { kind: WHITESPACE, span: Span(57..58) }
Begin { kind: CONDITION_BLK, span: Span(58..87) }
Token { kind: CONDITION_KW, span: Span(58..67) }
Token { kind: COLON, span: Span(67..68) }
Token { kind: NEWLINE, span: Span(68..69) }
Token { kind: WHITESPACE, span: Span(69..71) }
Begin { kind: BOOLEAN_EXPR, span: Span(71..87) }
Begin { kind: BOOLEAN_TERM, span: Span(71..87) }
Begin { kind: OF_EXPR, span: Span(71..87) }
Begin { kind: QUANTIFIER, span: Span(71..74) }
Token { kind: ANY_KW, span: Span(71..74) }
End { kind: QUANTIFIER, span: Span(71..74) }
Token { kind: WHITESPACE, span: Span(74..75) }
Token { kind: OF_KW, span: Span(75..77) }
Token { kind: WHITESPACE, span: Span(77..78) }
Token { kind: THEM_KW, span: Span(78..82) }
Token { kind: WHITESPACE, span: Span(82..83) }
Token { kind: AT_KW, span: Span(83..85) }
Token { kind: WHITESPACE, span: Span(85..86) }
Begin { kind: EXPR, span: Span(86..87) }
Begin { kind: TERM, span: Span(86..87) }
Begin { kind: PRIMARY_EXPR, span: Span(86..87) }
Token { kind: INTEGER_LIT, span: Span(86..87) }
End { kind: PRIMARY_EXPR, span: Span(86..87) }
End { kind: TERM, span: Span(86..87) }
End { kind: EXPR, span: Span(86..87) }
End { kind: OF_EXPR, span: Span(71..87) }
End { kind: BOOLEAN_TERM, span: Span(71..87) }
End { kind: BOOLEAN_EXPR, span: Span(71..87) }
End { kind: CONDITION_BLK, span: Span(58..87) }
Token { kind: NEWLINE, span: Span(87..88) }
Token { kind: R_BRACE, span: Span(88..89) }
End { kind: RULE_DECL, span: Span(43..89) }
Token { kind: NEWLINE, span: Span(89..90) }
Token { kind: NEWLINE, span: Span(90..91) }
Begin { kind: RULE_DECL, span: Span(91..144) }
Token { kind: RULE_KW, span: Span(91..95) }
Token { kind: WHITESPACE, span: Span(95..96) }
Token { kind: IDENT, span: Span(96..102) }
Token { kind: WHITESPACE, span: Span(102..103) }
Token { kind: L_BRACE, span: Span(103..104) }
Token { kind: NEWLINE, span: Span(104..105) }
Token { kind: WHITESPACE, span: Span(105..106) }
Begin { kind: CONDITION_BLK, span: Span(106..142) }
Token { kind: CONDITION_KW, span: Span(106..115) }
Token { kind: COLON, span: Span(115..116) }
Token { kind: NEWLINE, span: Span(116..117) }
Token { kind: WHITESPACE, span: Span(117..119) }
Begin { kind: BOOLEAN_EXPR, span: Span(119..142) }
Begin { kind: BOOLEAN_TERM, span: Span(119..142) }
Begin { kind: OF_EXPR, span: Span(119..142) }
Begin { kind: QUANTIFIER, span: Span(119..123) }
Token { kind: NONE_KW, span: Span(119..123) }
End { kind: QUANTIFIER, span: Span(119..123) }
Token { kind: WHITESPACE, span: Span(123..124) }
Token { kind: OF_KW, span: Span(124..126) }
Token { kind: WHITESPACE, span: Span(126..127) }
Token { kind: THEM_KW, span: Span(127..131) }
Token { kind: WHITESPACE, span: Span(131..132) }
Token { kind: IN_KW, span: Span(132..134) }
Token { kind: WHITESPACE, span: Span(134..135) }
Begin { kind: RANGE, span: Span(135..142) }
Token { kind: L_PAREN, span: Span(135..136) }
Begin { kind: EXPR, span: Span(136..137) }
Begin { kind: TERM, span: Span(136..137) }
Begin { kind: PRIMARY_EXPR, span: Span(136..137) }
Token { kind: INTEGER_LIT, span: Span(136..137) }
End { kind: PRIMARY_EXPR, span: Span(136..137) }
End { kind: TERM, span: Span(136..137) }
End { kind: EXPR, span: Span(136..137) }
Token { kind: DOT, span: Span(137..138) }
Token { kind: DOT, span: Span(138..139) }
Begin { kind: EXPR, span: Span(139..141) }
Begin { kind: TERM, span: Span(139..141) }
Begin { kind: PRIMARY_EXPR, span: Span(139..141) }
Token { kind: INTEGER_LIT, span: Span(139..141) }
End { kind: PRIMARY_EXPR, span: Span(139..141) }
End { kind: TERM, span: Span(139..141) }
End { kind: EXPR, span: Span(139..141) }
Token { kind: R_PAREN, span: Span(141..142) }
End { kind: RANGE, span: Span(135..142) }
End { kind: OF_EXPR, span: Span(119..142) }
End { kind: BOOLEAN_TERM, span: Span(119..142) }
End { kind: BOOLEAN_EXPR, span: Span(119..142) }
End { kind: CONDITION_BLK, span: Span(106..142) }
Token { kind: NEWLINE, span: Span(142..143) }
Token { kind: R_BRACE, span: Span(143..144) }
End { kind: RULE_DECL, span: Span(91..144) }
Token { kind: NEWLINE, span: Span(144..145) }
Token { kind: NEWLINE, span: Span(145..146) }
Begin { kind: RULE_DECL, span: Span(146..186) }
Token { kind: RULE_KW, span: Span(146..150) }
Token { kind: WHITESPACE, span: Span(150..151) }
Token { kind: IDENT, span: Span(151..157) }
Token { kind: WHITESPACE, span: Span(157..158) }
Token { kind: L_BRACE, span: Span(158..159) }
Token { kind: NEWLINE, span: Span(159..160) }
Token { kind: WHITESPACE, span: Span(160..161) }
Begin { kind: CONDITION_BLK, span: Span(161..184) }
Token { kind: CONDITION_KW, span: Span(161..170) }
Token { kind: COLON, span: Span(170..171) }
Token { kind: NEWLINE, span: Span(171..172) }
Token { kind: WHITESPACE, span: Span(172..174) }
Begin { kind: BOOLEAN_EXPR, span: Span(174..184) }
Begin { kind: BOOLEAN_TERM, span: Span(174..184) }
Begin { kind: OF_EXPR, span: Span(174..184) }
Begin { kind: QUANTIFIER, span: Span(174..176) }
Begin { kind: EXPR, span: Span(174..176) }
Begin { kind: TERM, span: Span(174..176) }
Begin { kind: PRIMARY_EXPR, span: Span(174..176) }
Token { kind: INTEGER_LIT, span: Span(174..176) }
End { kind: PRIMARY_EXPR, span: Span(174..176) }
End { kind: TERM, span: Span(174..176) }
End { kind: EXPR, span: Span(174..176) }
End { kind: QUANTIFIER, span: Span(174..176) }
Token { kind: WHITESPACE, span: Span(176..177) }
Token { kind: OF_KW, span: Span(177..179) }
Token { kind: WHITESPACE, span: Span(179..180) }
Token { kind: THEM_KW, span: Span(180..184) }
End { kind: OF_EXPR, span: Span(174..184) }
End { kind: BOOLEAN_TERM, span: Span(174..184) }
End { kind: BOOLEAN_EXPR, span: Span(174..184) }
End { kind: CONDITION_BLK, span: Span(161..184) }
Token { kind: NEWLINE, span: Span(184..185) }
Token { kind: R_BRACE, span: Span(185..186) }
End { kind: RULE_DECL, span: Span(146..186) }
Token { kind: NEWLINE, span: Span(186..187) }
Token { kind: NEWLINE, span: Span(187..188) }
Begin { kind: RULE_DECL, span: Span(188..229) }
Token { kind: RULE_KW, span: Span(188..192) }
Token { kind: WHITESPACE, span: Span(192..193) }
Token { kind: IDENT, span: Span(193..199) }
Token { kind: WHITESPACE, span: Span(199..200) }
Token { kind: L_BRACE, span: Span(200..201) }
Token { kind: NEWLINE, span: Span(201..202) }
Token { kind: WHITESPACE, span: Span(202..203) }
Begin { kind: CONDITION_BLK, span: Span(203..227) }
Token { kind: CONDITION_KW, span: Span(203..212) }
Token { kind: COLON, span: Span(212..213) }
Token { kind: NEWLINE, span: Span(213..214) }
Token { kind: WHITESPACE, span: Span(214..216) }
Begin { kind: BOOLEAN_EXPR, span: Span(216..227) }
Begin { kind: BOOLEAN_TERM, span: Span(216..227) }
Begin { kind: OF_EXPR, span: Span(216..227) }
Begin { kind: QUANTIFIER, span: Span(216..219) }
Begin { kind: PRIMARY_EXPR, span: Span(216..218) }
Token { kind: INTEGER_LIT, span: Span(216..218) }
End { kind: PRIMARY_EXPR, span: Span(216..218) }
Token { kind: PERCENT, span: Span(218..219) }
End { kind: QUANTIFIER, span: Span(216..219) }
Token { kind: WHITESPACE, span: Span(219..220) }
Token { kind: OF_KW, span: Span(220..222) }
Token { kind: WHITESPACE, span: Span(222..223) }
Token { kind: THEM_KW, span: Span(223..227) }
End { kind: OF_EXPR, span: Span(216..227) }
End { kind: BOOLEAN_TERM, span: Span(216..227) }
End { kind: BOOLEAN_EXPR, span: Span(216..227) }
End { kind: CONDITION_BLK, span: Span(203..227) }
Token { kind: NEWLINE, span: Span(227..228) }
Token { kind: R_BRACE, span: Span(228..229) }
End { kind: RULE_DECL, span: Span(188..229) }
Token { kind: NEWLINE, span: Span(229..230) }
Token { kind: NEWLINE, span: Span(230..231) }
Begin { kind: RULE_DECL, span: Span(231..294) }
Token { kind: RULE_KW, span: Span(231..235) }
Token { kind: WHITESPACE, span: Span(235..236) }
Token { kind: IDENT, span: Span(236..242) }
Token { kind: WHITESPACE, span: Span(242..243) }
Token { kind: L_BRACE, span: Span(243..244) }
Token { kind: NEWLINE, span: Span(244..245) }
Token { kind: WHITESPACE, span: Span(245..246) }
Begin { kind: CONDITION_BLK, span: Span(246..292) }
Token { kind: CONDITION_KW, span: Span(246..255) }
Token { kind: COLON, span: Span(255..256) }
Token { kind: NEWLINE, span: Span(256..257) }
Token { kind: WHITESPACE, span: Span(257..259) }
Begin { kind: BOOLEAN_EXPR, span: Span(259..292) }
Begin { kind: BOOLEAN_TERM, span: Span(259..292) }
Begin { kind: OF_EXPR, span: Span(259..292) }
Begin { kind: QUANTIFIER, span: Span(259..260) }
Begin { kind: EXPR, span: Span(259..260) }
Begin { kind: TERM, span: Span(259..260) }
Begin { kind: PRIMARY_EXPR, span: Span(259..260) }
Token { kind: INTEGER_LIT, span: Span(259..260) }
End { kind: PRIMARY_EXPR, span: Span(259..260) }
End { kind: TERM, span: Span(259..260) }
End { kind: EXPR, span: Span(259..260) }
End { kind: QUANTIFIER, span: Span(259..260) }
Token { kind: WHITESPACE, span: Span(260..261) }
Token { kind: OF_KW, span: Span(261..263) }
Token { kind: WHITESPACE, span: Span(263..264) }
Begin { kind: BOOLEAN_EXPR_TUPLE, span: Span(264..292) }
Token { kind: L_PAREN, span: Span(264..265) }
Begin { kind: BOOLEAN_EXPR, span: Span(265..269) }
Begin { kind: BOOLEAN_TERM, span: Span(265..269) }
Token { kind: TRUE_KW, span: Span(265..269) }
End { kind: BOOLEAN_TERM, span: Span(265..269) }
End { kind: BOOLEAN_EXPR, span: Span(265..269) }
Token { kind: COMMA, span: Span(269..270) }
Token { kind: WHITESPACE, span: Span(270..271) }
Begin { kind: BOOLEAN_EXPR, span: Span(271..276) }
Begin { kind: BOOLEAN_TERM, span: Span(271..276) }
Token { kind: FALSE_KW, span: Span(271..276) }
End { kind: BOOLEAN_TERM, span: Span(271..276) }
End { kind: BOOLEAN_EXPR, span: Span(271..276) }
Token { kind: COMMA, span: Span(276..277) }
Token { kind: WHITESPACE, span: Span(277..278) }
Begin { kind: BOOLEAN_EXPR, span: Span(278..283) }
Begin { kind: BOOLEAN_TERM, span: Span(278..283) }
Begin { kind: EXPR, span: Span(278..283) }
Begin { kind: TERM, span: Span(278..283) }
Begin { kind: PRIMARY_EXPR, span: Span(278..283) }
Token { kind: IDENT, span: Span(278..283) }
End { kind: PRIMARY_EXPR, span: Span(278..283) }
End { kind: TERM, span: Span(278..283) }
End { kind: EXPR, span: Span(278..283) }
End { kind: BOOLEAN_TERM, span: Span(278..283) }
End { kind: BOOLEAN_EXPR, span: Span(278..283) }
Token { kind: COMMA, span: Span(283..284) }
Token { kind: WHITESPACE, span: Span(284..285) }
Begin { kind: BOOLEAN_EXPR, span: Span(285..291) }
Begin { kind: BOOLEAN_TERM, span: Span(285..291) }
Begin { kind: EXPR, span: Span(285..286) }
Begin { kind: TERM, span: Span(285..286) }
Begin { kind: PRIMARY_EXPR, span: Span(285..286) }
Token { kind: INTEGER_LIT, span: Span(285..286) }
End { kind: PRIMARY_EXPR, span: Span(285..286) }
End { kind: TERM, span: Span(285..286) }
End { kind: EXPR, span: Span(285..286) }
Token { kind: WHITESPACE, span: Span(286..287) }
Token { kind: EQ, span: Span(287..289) }
Token { kind: WHITESPACE, span: Span(289..290) }
Begin { kind: EXPR, span: Span(290..291) }
Begin { kind: TERM, span: Span(290..291) }
Begin { kind: PRIMARY_EXPR, span: Span(290..291) }
Token { kind: INTEGER_LIT, span: Span(290..291) }
End { kind: PRIMARY_EXPR, span: Span(290..291) }
End { kind: TERM, span: Span(290..291) }
End { kind: EXPR, span: Span(290..291) }
End { kind: BOOLEAN_TERM, span: Span(285..291) }
End { kind: BOOLEAN_EXPR, span: Span(285..291) }
Token { kind: R_PAREN, span: Span(291..292) }
End { kind: BOOLEAN_EXPR_TUPLE, span: Span(264..292) }
End { kind: OF_EXPR, span: Span(259..292) }
End { kind: BOOLEAN_TERM, span: Span(259..292) }
End { kind: BOOLEAN_EXPR, span: Span(259..292) }
End { kind: CONDITION_BLK, span: Span(246..292) }
Token { kind: NEWLINE, span: Span(292..293) }
Token { kind: R_BRACE, span: Span(293..294) }
End { kind: RULE_DECL, span: Span(231..294) }
Token { kind: NEWLINE, span: Span(294..295) }
Token { kind: NEWLINE, span: Span(295..296) }
Begin { kind: RULE_DECL, span: Span(296..381) }
Token { kind: RULE_KW, span: Span(296..300) }
Token { kind: WHITESPACE, span: Span(300..301) }
Token { kind: IDENT, span: Span(301..307) }
Token { kind: WHITESPACE, span: Span(307..308) }
Token { kind: L_BRACE, span: Span(308..309) }
Token { kind: NEWLINE, span: Span(309..310) }
Token { kind: WHITESPACE, span: Span(310..312) }
Begin { kind: PATTERNS_BLK, span: Span(312..350) }
Token { kind: STRINGS_KW, span: Span(312..319) }
Token { kind: COLON, span: Span(319..320) }
Token { kind: NEWLINE, span: Span(320..321) }
Token { kind: WHITESPACE, span: Span(321..325) }
Begin { kind: PATTERN_DEF, span: Span(325..335) }
Token { kind: PATTERN_IDENT, span: Span(325..327) }
Token { kind: WHITESPACE, span: Span(327..328) }
Token { kind: EQUAL, span: Span(328..329) }
Token { kind: WHITESPACE, span: Span(329..330) }
Token { kind: STRING_LIT, span: Span(330..335) }
End { kind: PATTERN_DEF, span: Span(325..335) }
Token { kind: NEWLINE, span: Span(335..336) }
Token { kind: WHITESPACE, span: Span(336..340) }
Begin { kind: PATTERN_DEF, span: Span(340..350) }
Token { kind: PATTERN_IDENT, span: Span(340..342) }
Token { kind: WHITESPACE, span: Span(342..343) }
Token { kind: EQUAL, span: Span(343..344) }
Token { kind: WHITESPACE, span: Span(344..345) }
Token { kind: STRING_LIT, span: Span(345..350) }
End { kind: PATTERN_DEF, span: Span(340..350) }
End { kind: PATTERNS_BLK, span: Span(312..350) }
Token { kind: NEWLINE, span: Span(350..351) }
Token { kind: WHITESPACE, span: Span(351..352) }
Begin { kind: CONDITION_BLK, span: Span(352..379) }
Token { kind: CONDITION_KW, span: Span(352..361) }
Token { kind: COLON, span: Span(361..362) }
Token { kind: NEWLINE, span: Span(362..363) }
Token { kind: WHITESPACE, span: Span(363..365) }
Begin { kind: BOOLEAN_EXPR, span: Span(365..379) }
Begin { kind: BOOLEAN_TERM, span: Span(365..379) }
Begin { kind: OF_EXPR, span: Span(365..379) }
Begin { kind: QUANTIFIER, span: Span(365..366) }
Begin { kind: EXPR, span: Span(365..366) }
Begin { kind: TERM, span: Span(365..366) }
Begin { kind: PRIMARY_EXPR, span: Span(365..366) }
Token { kind: INTEGER_LIT, span: Span(365..366) }
End { kind: PRIMARY_EXPR, span: Span(365..366) }
End { kind: TERM, span: Span(365..366) }
End { kind: EXPR, span: Span(365..366) }
End { kind: QUANTIFIER, span: Span(365..366) }
Token { kind: WHITESPACE, span: Span(366..367) }
Token { kind: OF_KW, span: Span(367..369) }
Token { kind: WHITESPACE, span: Span(369..370) }
Begin { kind: PATTERN_IDENT_TUPLE, span: Span(370..379) }
Token { kind: L_PAREN, span: Span(370..371) }
Token { kind: PATTERN_IDENT, span: Span(371..373) }
Token { kind: COMMA, span: Span(373..374) }
Token { kind: WHITESPACE, span: Span(374..375) }
Token { kind: PATTERN_IDENT, span: Span(375..377) }
Token { kind: ASTERISK, span: Span(377..378) }
Token { kind: R_PAREN, span: Span(378..379) }
End { kind: PATTERN_IDENT_TUPLE, span: Span(370..379) }
End { kind: OF_EXPR, span: Span(365..379) }
End { kind: BOOLEAN_TERM, span: Span(365..379) }
End { kind: BOOLEAN_EXPR, span: Span(365..379) }
End { kind: CONDITION_BLK, span: Span(352..379) }
Token { kind: NEWLINE, span: Span(379..380) }
Token { kind: R_BRACE, span: Span(380..381) }
End { kind: RULE_DECL, span: Span(296..381) }
Token { kind: NEWLINE, span: Span(381..382) }
End { kind: SOURCE_FILE, span: Span(0..382) }