yara-x-parser 1.9.0

A parsing library for YARA rules.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208

Begin { kind: SOURCE_FILE, span: Span(0..285) }
Begin { kind: RULE_DECL, span: Span(0..34) }
Token { kind: RULE_KW, span: Span(0..4) }
Token { kind: WHITESPACE, span: Span(4..5) }
Token { kind: IDENT, span: Span(5..11) }
Token { kind: WHITESPACE, span: Span(11..12) }
Token { kind: L_BRACE, span: Span(12..13) }
Token { kind: NEWLINE, span: Span(13..14) }
Token { kind: WHITESPACE, span: Span(14..15) }
Begin { kind: CONDITION_BLK, span: Span(15..32) }
Token { kind: CONDITION_KW, span: Span(15..24) }
Token { kind: COLON, span: Span(24..25) }
Token { kind: NEWLINE, span: Span(25..26) }
Token { kind: WHITESPACE, span: Span(26..28) }
Begin { kind: BOOLEAN_EXPR, span: Span(28..32) }
Begin { kind: BOOLEAN_TERM, span: Span(28..32) }
Token { kind: TRUE_KW, span: Span(28..32) }
End { kind: BOOLEAN_TERM, span: Span(28..32) }
End { kind: BOOLEAN_EXPR, span: Span(28..32) }
End { kind: CONDITION_BLK, span: Span(15..32) }
Token { kind: NEWLINE, span: Span(32..33) }
Token { kind: R_BRACE, span: Span(33..34) }
End { kind: RULE_DECL, span: Span(0..34) }
Token { kind: NEWLINE, span: Span(34..35) }
Token { kind: NEWLINE, span: Span(35..36) }
Begin { kind: RULE_DECL, span: Span(36..72) }
Token { kind: RULE_KW, span: Span(36..40) }
Token { kind: WHITESPACE, span: Span(40..41) }
Token { kind: IDENT, span: Span(41..47) }
Token { kind: WHITESPACE, span: Span(47..48) }
Token { kind: L_BRACE, span: Span(48..49) }
Token { kind: NEWLINE, span: Span(49..50) }
Token { kind: WHITESPACE, span: Span(50..51) }
Begin { kind: CONDITION_BLK, span: Span(51..70) }
Token { kind: CONDITION_KW, span: Span(51..60) }
Token { kind: COLON, span: Span(60..61) }
Token { kind: NEWLINE, span: Span(61..62) }
Token { kind: WHITESPACE, span: Span(62..64) }
Begin { kind: BOOLEAN_EXPR, span: Span(64..70) }
Begin { kind: BOOLEAN_TERM, span: Span(64..70) }
Token { kind: L_PAREN, span: Span(64..65) }
Begin { kind: BOOLEAN_EXPR, span: Span(65..69) }
Begin { kind: BOOLEAN_TERM, span: Span(65..69) }
Token { kind: TRUE_KW, span: Span(65..69) }
End { kind: BOOLEAN_TERM, span: Span(65..69) }
End { kind: BOOLEAN_EXPR, span: Span(65..69) }
Token { kind: R_PAREN, span: Span(69..70) }
End { kind: BOOLEAN_TERM, span: Span(64..70) }
End { kind: BOOLEAN_EXPR, span: Span(64..70) }
End { kind: CONDITION_BLK, span: Span(51..70) }
Token { kind: NEWLINE, span: Span(70..71) }
Token { kind: R_BRACE, span: Span(71..72) }
End { kind: RULE_DECL, span: Span(36..72) }
Token { kind: NEWLINE, span: Span(72..73) }
Token { kind: NEWLINE, span: Span(73..74) }
Begin { kind: RULE_DECL, span: Span(74..122) }
Token { kind: RULE_KW, span: Span(74..78) }
Token { kind: WHITESPACE, span: Span(78..79) }
Token { kind: IDENT, span: Span(79..85) }
Token { kind: WHITESPACE, span: Span(85..86) }
Token { kind: L_BRACE, span: Span(86..87) }
Token { kind: NEWLINE, span: Span(87..88) }
Token { kind: WHITESPACE, span: Span(88..89) }
Begin { kind: CONDITION_BLK, span: Span(89..120) }
Token { kind: CONDITION_KW, span: Span(89..98) }
Token { kind: COLON, span: Span(98..99) }
Token { kind: NEWLINE, span: Span(99..100) }
Token { kind: WHITESPACE, span: Span(100..102) }
Begin { kind: BOOLEAN_EXPR, span: Span(102..120) }
Begin { kind: BOOLEAN_TERM, span: Span(102..110) }
Token { kind: NOT_KW, span: Span(102..105) }
Token { kind: WHITESPACE, span: Span(105..106) }
Begin { kind: BOOLEAN_TERM, span: Span(106..110) }
Token { kind: TRUE_KW, span: Span(106..110) }
End { kind: BOOLEAN_TERM, span: Span(106..110) }
End { kind: BOOLEAN_TERM, span: Span(102..110) }
Token { kind: WHITESPACE, span: Span(110..111) }
Token { kind: AND_KW, span: Span(111..114) }
Token { kind: WHITESPACE, span: Span(114..115) }
Begin { kind: BOOLEAN_TERM, span: Span(115..120) }
Token { kind: FALSE_KW, span: Span(115..120) }
End { kind: BOOLEAN_TERM, span: Span(115..120) }
End { kind: BOOLEAN_EXPR, span: Span(102..120) }
End { kind: CONDITION_BLK, span: Span(89..120) }
Token { kind: NEWLINE, span: Span(120..121) }
Token { kind: R_BRACE, span: Span(121..122) }
End { kind: RULE_DECL, span: Span(74..122) }
Token { kind: NEWLINE, span: Span(122..123) }
Token { kind: NEWLINE, span: Span(123..124) }
Begin { kind: RULE_DECL, span: Span(124..175) }
Token { kind: RULE_KW, span: Span(124..128) }
Token { kind: WHITESPACE, span: Span(128..129) }
Token { kind: IDENT, span: Span(129..135) }
Token { kind: WHITESPACE, span: Span(135..136) }
Token { kind: L_BRACE, span: Span(136..137) }
Token { kind: NEWLINE, span: Span(137..138) }
Token { kind: WHITESPACE, span: Span(138..139) }
Begin { kind: CONDITION_BLK, span: Span(139..173) }
Token { kind: CONDITION_KW, span: Span(139..148) }
Token { kind: COLON, span: Span(148..149) }
Token { kind: NEWLINE, span: Span(149..150) }
Token { kind: WHITESPACE, span: Span(150..152) }
Begin { kind: BOOLEAN_EXPR, span: Span(152..173) }
Begin { kind: BOOLEAN_TERM, span: Span(152..156) }
Token { kind: TRUE_KW, span: Span(152..156) }
End { kind: BOOLEAN_TERM, span: Span(152..156) }
Token { kind: WHITESPACE, span: Span(156..157) }
Token { kind: OR_KW, span: Span(157..159) }
Token { kind: WHITESPACE, span: Span(159..160) }
Begin { kind: BOOLEAN_TERM, span: Span(160..164) }
Token { kind: TRUE_KW, span: Span(160..164) }
End { kind: BOOLEAN_TERM, span: Span(160..164) }
Token { kind: WHITESPACE, span: Span(164..165) }
Token { kind: OR_KW, span: Span(165..167) }
Token { kind: WHITESPACE, span: Span(167..168) }
Begin { kind: BOOLEAN_TERM, span: Span(168..173) }
Token { kind: FALSE_KW, span: Span(168..173) }
End { kind: BOOLEAN_TERM, span: Span(168..173) }
End { kind: BOOLEAN_EXPR, span: Span(152..173) }
End { kind: CONDITION_BLK, span: Span(139..173) }
Token { kind: NEWLINE, span: Span(173..174) }
Token { kind: R_BRACE, span: Span(174..175) }
End { kind: RULE_DECL, span: Span(124..175) }
Token { kind: NEWLINE, span: Span(175..176) }
Token { kind: NEWLINE, span: Span(176..177) }
Begin { kind: RULE_DECL, span: Span(177..230) }
Token { kind: RULE_KW, span: Span(177..181) }
Token { kind: WHITESPACE, span: Span(181..182) }
Token { kind: IDENT, span: Span(182..188) }
Token { kind: WHITESPACE, span: Span(188..189) }
Token { kind: L_BRACE, span: Span(189..190) }
Token { kind: NEWLINE, span: Span(190..191) }
Token { kind: WHITESPACE, span: Span(191..192) }
Begin { kind: CONDITION_BLK, span: Span(192..228) }
Token { kind: CONDITION_KW, span: Span(192..201) }
Token { kind: COLON, span: Span(201..202) }
Token { kind: NEWLINE, span: Span(202..203) }
Token { kind: WHITESPACE, span: Span(203..205) }
Begin { kind: BOOLEAN_EXPR, span: Span(205..228) }
Begin { kind: BOOLEAN_TERM, span: Span(205..219) }
Token { kind: L_PAREN, span: Span(205..206) }
Begin { kind: BOOLEAN_EXPR, span: Span(206..218) }
Begin { kind: BOOLEAN_TERM, span: Span(206..210) }
Token { kind: TRUE_KW, span: Span(206..210) }
End { kind: BOOLEAN_TERM, span: Span(206..210) }
Token { kind: WHITESPACE, span: Span(210..211) }
Token { kind: OR_KW, span: Span(211..213) }
Token { kind: WHITESPACE, span: Span(213..214) }
Begin { kind: BOOLEAN_TERM, span: Span(214..218) }
Token { kind: TRUE_KW, span: Span(214..218) }
End { kind: BOOLEAN_TERM, span: Span(214..218) }
End { kind: BOOLEAN_EXPR, span: Span(206..218) }
Token { kind: R_PAREN, span: Span(218..219) }
End { kind: BOOLEAN_TERM, span: Span(205..219) }
Token { kind: WHITESPACE, span: Span(219..220) }
Token { kind: OR_KW, span: Span(220..222) }
Token { kind: WHITESPACE, span: Span(222..223) }
Begin { kind: BOOLEAN_TERM, span: Span(223..228) }
Token { kind: FALSE_KW, span: Span(223..228) }
End { kind: BOOLEAN_TERM, span: Span(223..228) }
End { kind: BOOLEAN_EXPR, span: Span(205..228) }
End { kind: CONDITION_BLK, span: Span(192..228) }
Token { kind: NEWLINE, span: Span(228..229) }
Token { kind: R_BRACE, span: Span(229..230) }
End { kind: RULE_DECL, span: Span(177..230) }
Token { kind: NEWLINE, span: Span(230..231) }
Token { kind: NEWLINE, span: Span(231..232) }
Begin { kind: RULE_DECL, span: Span(232..285) }
Token { kind: RULE_KW, span: Span(232..236) }
Token { kind: WHITESPACE, span: Span(236..237) }
Token { kind: IDENT, span: Span(237..243) }
Token { kind: WHITESPACE, span: Span(243..244) }
Token { kind: L_BRACE, span: Span(244..245) }
Token { kind: NEWLINE, span: Span(245..246) }
Token { kind: WHITESPACE, span: Span(246..247) }
Begin { kind: CONDITION_BLK, span: Span(247..283) }
Token { kind: CONDITION_KW, span: Span(247..256) }
Token { kind: COLON, span: Span(256..257) }
Token { kind: NEWLINE, span: Span(257..258) }
Token { kind: WHITESPACE, span: Span(258..260) }
Begin { kind: BOOLEAN_EXPR, span: Span(260..283) }
Begin { kind: BOOLEAN_TERM, span: Span(260..264) }
Token { kind: TRUE_KW, span: Span(260..264) }
End { kind: BOOLEAN_TERM, span: Span(260..264) }
Token { kind: WHITESPACE, span: Span(264..265) }
Token { kind: OR_KW, span: Span(265..267) }
Token { kind: WHITESPACE, span: Span(267..268) }
Begin { kind: BOOLEAN_TERM, span: Span(268..283) }
Token { kind: L_PAREN, span: Span(268..269) }
Begin { kind: BOOLEAN_EXPR, span: Span(269..282) }
Begin { kind: BOOLEAN_TERM, span: Span(269..273) }
Token { kind: TRUE_KW, span: Span(269..273) }
End { kind: BOOLEAN_TERM, span: Span(269..273) }
Token { kind: WHITESPACE, span: Span(273..274) }
Token { kind: OR_KW, span: Span(274..276) }
Token { kind: WHITESPACE, span: Span(276..277) }
Begin { kind: BOOLEAN_TERM, span: Span(277..282) }
Token { kind: FALSE_KW, span: Span(277..282) }
End { kind: BOOLEAN_TERM, span: Span(277..282) }
End { kind: BOOLEAN_EXPR, span: Span(269..282) }
Token { kind: R_PAREN, span: Span(282..283) }
End { kind: BOOLEAN_TERM, span: Span(268..283) }
End { kind: BOOLEAN_EXPR, span: Span(260..283) }
End { kind: CONDITION_BLK, span: Span(247..283) }
Token { kind: NEWLINE, span: Span(283..284) }
Token { kind: R_BRACE, span: Span(284..285) }
End { kind: RULE_DECL, span: Span(232..285) }
End { kind: SOURCE_FILE, span: Span(0..285) }