yara-x 1.15.0

A pure Rust implementation of YARA.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110

RULE test_1
  35: AND -- hash: 0xbcd64d309e20ba14 -- parent: None 
    8: EQ -- hash: 0x286081a5404b9efc -- parent: 35 
      6: FIELD_ACCESS -- hash: 0x6e1d853ba34b7fe2 -- parent: 8 
        4: LOOKUP -- hash: 0x716c67a247de6940 -- parent: 6 
          2: FIELD_ACCESS -- hash: 0x54b6d37d2b917356 -- parent: 4 
            0: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None } -- parent: 2 
            1: SYMBOL Field { index: 49, is_root: false, type_value: array, acl: None, deprecation_notice: None } -- parent: 2 
          3: CONST integer(0) -- parent: 4 
        5: SYMBOL Field { index: 0, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None } -- parent: 6 
      7: CONST integer(0) -- parent: 8 
    17: EQ -- hash: 0xbeab76cd32851615 -- parent: 35 
      15: FIELD_ACCESS -- hash: 0xc403ec0c3cd58213 -- parent: 17 
        13: LOOKUP -- hash: 0x1a25f2495ba33f2c -- parent: 15 
          11: FIELD_ACCESS -- hash: 0x54b6d37d2b917356 -- parent: 13 
            9: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None } -- parent: 11 
            10: SYMBOL Field { index: 49, is_root: false, type_value: array, acl: None, deprecation_notice: None } -- parent: 11 
          12: CONST integer(1) -- parent: 13 
        14: SYMBOL Field { index: 2, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None } -- parent: 15 
      16: CONST integer(1) -- parent: 17 
    34: EQ -- hash: 0xfe0bc6da31a3fab2 -- parent: 35 
      32: ADD -- hash: 0x83a5e6847eb7227e -- parent: 34 
        24: FIELD_ACCESS -- hash: 0x5a489e7f7434443a -- parent: 32 
          22: LOOKUP -- hash: 0x1a25f2495ba33f2c -- parent: 24 
            20: FIELD_ACCESS -- hash: 0x54b6d37d2b917356 -- parent: 22 
              18: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None } -- parent: 20 
              19: SYMBOL Field { index: 49, is_root: false, type_value: array, acl: None, deprecation_notice: None } -- parent: 20 
            21: CONST integer(1) -- parent: 22 
          23: SYMBOL Field { index: 0, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None } -- parent: 24 
        31: FIELD_ACCESS -- hash: 0x78e192d2a1262100 -- parent: 32 
          29: LOOKUP -- hash: 0x1a25f2495ba33f2c -- parent: 31 
            27: FIELD_ACCESS -- hash: 0x54b6d37d2b917356 -- parent: 29 
              25: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None } -- parent: 27 
              26: SYMBOL Field { index: 49, is_root: false, type_value: array, acl: None, deprecation_notice: None } -- parent: 27 
            28: CONST integer(1) -- parent: 29 
          30: SYMBOL Field { index: 3, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None } -- parent: 31 
      33: CONST integer(1) -- parent: 34 

RULE test_2
  35: AND -- hash: 0xa9652719fe3b73e -- parent: None 
    16: EQ -- hash: 0xfe0bc6da31a3fab2 -- parent: 35 
      14: ADD -- hash: 0x83a5e6847eb7227e -- parent: 16 
        6: FIELD_ACCESS -- hash: 0x5a489e7f7434443a -- parent: 14 
          4: LOOKUP -- hash: 0x1a25f2495ba33f2c -- parent: 6 
            2: FIELD_ACCESS -- hash: 0x54b6d37d2b917356 -- parent: 4 
              0: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None } -- parent: 2 
              1: SYMBOL Field { index: 49, is_root: false, type_value: array, acl: None, deprecation_notice: None } -- parent: 2 
            3: CONST integer(1) -- parent: 4 
          5: SYMBOL Field { index: 0, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None } -- parent: 6 
        13: FIELD_ACCESS -- hash: 0x78e192d2a1262100 -- parent: 14 
          11: LOOKUP -- hash: 0x1a25f2495ba33f2c -- parent: 13 
            9: FIELD_ACCESS -- hash: 0x54b6d37d2b917356 -- parent: 11 
              7: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None } -- parent: 9 
              8: SYMBOL Field { index: 49, is_root: false, type_value: array, acl: None, deprecation_notice: None } -- parent: 9 
            10: CONST integer(1) -- parent: 11 
          12: SYMBOL Field { index: 3, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None } -- parent: 13 
      15: CONST integer(1) -- parent: 16 
    25: EQ -- hash: 0x286081a5404b9efc -- parent: 35 
      23: FIELD_ACCESS -- hash: 0x6e1d853ba34b7fe2 -- parent: 25 
        21: LOOKUP -- hash: 0x716c67a247de6940 -- parent: 23 
          19: FIELD_ACCESS -- hash: 0x54b6d37d2b917356 -- parent: 21 
            17: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None } -- parent: 19 
            18: SYMBOL Field { index: 49, is_root: false, type_value: array, acl: None, deprecation_notice: None } -- parent: 19 
          20: CONST integer(0) -- parent: 21 
        22: SYMBOL Field { index: 0, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None } -- parent: 23 
      24: CONST integer(0) -- parent: 25 
    34: EQ -- hash: 0xbeab76cd32851615 -- parent: 35 
      32: FIELD_ACCESS -- hash: 0xc403ec0c3cd58213 -- parent: 34 
        30: LOOKUP -- hash: 0x1a25f2495ba33f2c -- parent: 32 
          28: FIELD_ACCESS -- hash: 0x54b6d37d2b917356 -- parent: 30 
            26: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None } -- parent: 28 
            27: SYMBOL Field { index: 49, is_root: false, type_value: array, acl: None, deprecation_notice: None } -- parent: 28 
          29: CONST integer(1) -- parent: 30 
        31: SYMBOL Field { index: 2, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None } -- parent: 32 
      33: CONST integer(1) -- parent: 34 

RULE test_3
  31: WITH -- hash: 0x1caad377fac14cec -- parent: None 
    2: FIELD_ACCESS -- hash: 0x54b6d37d2b917356 -- parent: 31 
      0: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None } -- parent: 2 
      1: SYMBOL Field { index: 49, is_root: false, type_value: array, acl: None, deprecation_notice: None } -- parent: 2 
    30: AND -- hash: 0x32468198de5bf3ca -- parent: 31 
      15: EQ -- hash: 0xb7083bd21650136 -- parent: 30 
        13: ADD -- hash: 0xb37bf5c5eec49e0b -- parent: 15 
          7: FIELD_ACCESS -- hash: 0xb2a8072a9f308424 -- parent: 13 
            5: LOOKUP -- hash: 0x483e02ee8116c648 -- parent: 7 
              3: SYMBOL Var { var: Var { frame_id: 1, ty: array, index: 0 }, type_value: array } -- parent: 5 
              4: CONST integer(1) -- parent: 5 
            6: SYMBOL Field { index: 0, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None } -- parent: 7 
          12: FIELD_ACCESS -- hash: 0xd140fb7dc82260ea -- parent: 13 
            10: LOOKUP -- hash: 0x483e02ee8116c648 -- parent: 12 
              8: SYMBOL Var { var: Var { frame_id: 1, ty: array, index: 0 }, type_value: array } -- parent: 10 
              9: CONST integer(1) -- parent: 10 
            11: SYMBOL Field { index: 3, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None } -- parent: 12 
        14: CONST integer(1) -- parent: 15 
      22: EQ -- hash: 0xa7daf0142925fa40 -- parent: 30 
        20: FIELD_ACCESS -- hash: 0xc67cede6ca47bfcc -- parent: 22 
          18: LOOKUP -- hash: 0x9f8478476d51f05c -- parent: 20 
            16: SYMBOL Var { var: Var { frame_id: 1, ty: array, index: 0 }, type_value: array } -- parent: 18 
            17: CONST integer(0) -- parent: 18 
          19: SYMBOL Field { index: 0, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None } -- parent: 20 
        21: CONST integer(0) -- parent: 22 
      29: EQ -- hash: 0x3e25e53c1b5f715a -- parent: 30 
        27: FIELD_ACCESS -- hash: 0x1c6354b767d1c1fe -- parent: 29 
          25: LOOKUP -- hash: 0x483e02ee8116c648 -- parent: 27 
            23: SYMBOL Var { var: Var { frame_id: 1, ty: array, index: 0 }, type_value: array } -- parent: 25 
            24: CONST integer(1) -- parent: 25 
          26: SYMBOL Field { index: 2, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None } -- parent: 27 
        28: CONST integer(1) -- parent: 29