yara-x-parser 1.7.0

A parsing library for YARA rules.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

 rule test_1
 └─ condition
    └─ <quantifier> of <items>
       ├─ <quantifier>
       │  └─ all
       └─ <items: pattern_set>
          └─ them

 rule test_2
 └─ condition
    └─ <quantifier> of <items> at <expr>
       ├─ <quantifier>
       │  └─ any
       ├─ <items: pattern_set>
       │  └─ them
       └─ <expr>
          └─ 0

 rule test_3
 └─ condition
    └─ <quantifier> of <items> in (<start>..<end>)
       ├─ <quantifier>
       │  └─ none
       ├─ <items: pattern_set>
       │  └─ them
       ├─ <start>
       │  └─ 0
       └─ <end>
          └─ 10

 rule test_4
 └─ condition
    └─ <quantifier> of <items>
       ├─ <quantifier>
       │  └─ 10
       └─ <items: pattern_set>
          └─ them

 rule test_5
 └─ condition
    └─ <quantifier> of <items>
       ├─ <quantifier>
       │  └─ percentage
       │     └─ 10
       └─ <items: pattern_set>
          └─ them

 rule test_6
 └─ condition
    └─ <quantifier> of <items>
       ├─ <quantifier>
       │  └─ 2
       └─ <items: boolean_expr_set>
          ├─ true
          ├─ false
          ├─ ident
          └─ eq
             ├─ 2
             └─ 2

 rule test_7
 ├─ strings
 │  ├─ $a = "foo" 
 │  └─ $b = "bar" 
 └─ condition
    └─ <quantifier> of <items>
       ├─ <quantifier>
       │  └─ 2
       └─ <items: pattern_set>
          └─ $a
             $b