yara-x 1.15.0

A pure Rust implementation of YARA.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

import "math"

rule test_1 {
	condition:
		for any i in (0..filesize) : ( int32(i) == 0 )
}

rule test_2 {
	condition:
		for any i in (0..filesize-1) : ( int32(i) == 0 )
}

rule test_3 {
	condition:
		for any i in (0..math.max(filesize, 0)) : ( int32(i) == 0 )
}

rule test_4 {
	strings:
		$a = "foo"
	condition:
		for any i in (0..#a) : ( uint32(i) != 0 )
}


// No warning
rule test_5 {
	condition:
		for any i in (filesize-10..filesize) : ( int32(i) == 0 )
}

rule test_6 {
	condition:
		for any i in (0..math.min(filesize, 1000)) : ( int32(i) == 0 )
}