yara-x 1.15.0

A pure Rust implementation of YARA.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

RULE test_1
  15: WITH -- hash: 0x26996efd3ba8f777 -- parent: None 
    14: FIELD_ACCESS -- hash: 0x54b6d37d2b917356 -- parent: 15 
      2: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None } -- parent: 14 
      3: SYMBOL Field { index: 49, is_root: false, type_value: array, acl: None, deprecation_notice: None } -- parent: 14 
    13: FOR_IN -- hash: 0xd8cf702c9fb77c65 -- parent: 15 
      0: CONST integer(0) -- parent: 13 
      1: CONST integer(1) -- parent: 13 
      12: EQ -- hash: 0xd80669f7f1fbbe8 -- parent: 13 
        10: FIELD_ACCESS -- hash: 0x269db08d3f80f808 -- parent: 12 
          6: LOOKUP -- hash: 0xbc92506a3c451e95 -- parent: 10 
            4: SYMBOL Var { var: Var { frame_id: 0, ty: array, index: 0 }, type_value: array } -- parent: 6 
            5: SYMBOL Var { var: Var { frame_id: 1, ty: integer, index: 6 }, type_value: integer(unknown) } -- parent: 6 
          9: LOOKUP -- hash: 0x1bd1e557c8168259 -- parent: 10 
            7: SYMBOL Field { index: 6, is_root: false, type_value: array, acl: None, deprecation_notice: None } -- parent: 9 
            8: CONST integer(0) -- parent: 9 
        11: CONST integer(0) -- parent: 12 

RULE test_2
  7: DEFINED -- hash: 0xcf8d327a66b02ccd -- parent: None 
    9: WITH -- hash: 0xaeb8e5d7e9b9a04f -- parent: 7 
      8: FN_CALL test_proto2.undef_i64@@iu -- hash: 0xc0206489d8f27bee -- parent: 9 
      11: WITH -- hash: 0x3696d4a61d1b6729 -- parent: 9 
        10: EQ -- hash: 0xca17973246e0efca -- parent: 11 
          3: SYMBOL Var { var: Var { frame_id: 0, ty: integer, index: 0 }, type_value: integer(unknown) } -- parent: 10 
          4: CONST integer(0) -- parent: 10 
        6: FOR_IN -- hash: 0x5aa37f3747d0aa75 -- parent: 11 
          0: CONST integer(0) -- parent: 6 
          1: CONST integer(10) -- parent: 6 
          5: SYMBOL Var { var: Var { frame_id: 0, ty: boolean, index: 1 }, type_value: boolean(unknown) } -- parent: 6 

RULE test_3
  18: OR -- hash: 0xc03b2943bc74ac56 -- parent: None 
    5: CONTAINS -- hash: 0x9b34a06a5c144733 -- parent: 18 
      3: FIELD_ACCESS -- hash: 0xa68ef47d7e9f1bf3 -- parent: 5 
        0: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None } -- parent: 3 
        1: SYMBOL Field { index: 44, is_root: false, type_value: struct, acl: None, deprecation_notice: None } -- parent: 3 
        2: SYMBOL Field { index: 5, is_root: false, type_value: string(unknown), acl: None, deprecation_notice: None } -- parent: 3 
      4: CONST string("foo") -- parent: 5 
    11: CONTAINS -- hash: 0x9b34a06a5c144733 -- parent: 18 
      9: FIELD_ACCESS -- hash: 0xa68ef47d7e9f1bf3 -- parent: 11 
        6: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None } -- parent: 9 
        7: SYMBOL Field { index: 44, is_root: false, type_value: struct, acl: None, deprecation_notice: None } -- parent: 9 
        8: SYMBOL Field { index: 5, is_root: false, type_value: string(unknown), acl: None, deprecation_notice: None } -- parent: 9 
      10: CONST string("foo") -- parent: 11 
    17: CONTAINS -- hash: 0xbab99c5006e37037 -- parent: 18 
      15: FIELD_ACCESS -- hash: 0xa68ef47d7e9f1bf3 -- parent: 17 
        12: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None } -- parent: 15 
        13: SYMBOL Field { index: 44, is_root: false, type_value: struct, acl: None, deprecation_notice: None } -- parent: 15 
        14: SYMBOL Field { index: 5, is_root: false, type_value: string(unknown), acl: None, deprecation_notice: None } -- parent: 15 
      16: CONST string("bar") -- parent: 17