yara-x 1.15.0

A pure Rust implementation of YARA.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

import "test_proto2"

rule test_1 {
  condition:
    for any i in (0..1) : (
      test_proto2.array_struct[i].nested_array_int64[0] == 0
    )
}

rule test_2 {
  condition:
    defined (for any x in (0..10) : (test_proto2.undef_i64() == 0))
}

rule test_3 {
   condition:
     test_proto2.nested.nested_string contains "foo" or
     // Intentionally duplicated.
     test_proto2.nested.nested_string contains "foo" or
     test_proto2.nested.nested_string contains "bar"
}