yara-x 1.16.0

A pure Rust implementation of YARA.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77

RULE test_1
  6: EQ -- hash: 0xbc578eceb5139ff6
    4: CONST integer(1)
    5: CONST integer(1)

RULE test_2
  10: EQ -- hash: 0xfb622d3fda4c9468
    8: SUB -- hash: 0x38aff83d94a3aa25
      4: ADD -- hash: 0xaa45310763b4b319
        2: FIELD_ACCESS -- hash: 0xe58b5f97183b1a0c
          0: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
          1: SYMBOL Field { index: 13, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
        3: CONST integer(1)
      7: FIELD_ACCESS -- hash: 0xe58b5f97183b1a0c
        5: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
        6: SYMBOL Field { index: 13, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
    9: CONST integer(1)

RULE test_3
  6: GT -- hash: 0x61dcf8602bb009ae
    4: DIV -- hash: 0x8a6d566de890e50c
      2: CONST integer(2)
      3: CONST integer(1)
    5: CONST integer(1)

RULE test_4
  6: LE -- hash: 0x6046db8bec76f9db
    4: CONST integer(2)
    5: CONST integer(2)

RULE test_5
  6: EQ -- hash: 0xce980a3b0dd2d7cf
    4: CONST integer(8)
    5: CONST integer(8)

RULE test_6
  9: EQ -- hash: 0x94adc1565ee528a6
    2: CONST integer(3)
    8: CONST integer(1)

RULE test_7
  8: AND -- hash: 0x966e46de448a5ee5
    4: EQ -- hash: 0x6500d8d8a8951685
      2: FIELD_ACCESS -- hash: 0x6b278e4a6873a6f4
        0: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
        1: SYMBOL Field { index: 1, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
      3: CONST integer(0)

RULE test_8
  5: ADD -- hash: 0x52c16f85b5684320
    2: FIELD_ACCESS -- hash: 0x6b278e4a6873a6f4
      0: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
      1: SYMBOL Field { index: 1, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
    3: CONST integer(1)
    4: CONST integer(2)

RULE test_9
  18: AND -- hash: 0x87ea037bd606baac
    2: CONTAINS -- hash: 0xbabdc2c62427fdc
      0: CONST string("foobar")
      1: CONST string("bar")
    5: ICONTAINS -- hash: 0xc2864620e881ca78
      3: CONST string("foobar")
      4: CONST string("BAR")
    8: STARTS_WITH -- hash: 0x58ec6fc7a36541b2
      6: CONST string("foobar")
      7: CONST string("foo")
    11: ISTARTS_WITH -- hash: 0x3965d2a92aab2a87
      9: CONST string("foobar")
      10: CONST string("FOO")
    14: ENDS_WITH -- hash: 0xe536fb2e32265590
      12: CONST string("foobar")
      13: CONST string("bar")
    17: IENDS_WITH -- hash: 0x9c116522b865a02d
      15: CONST string("foobar")
      16: CONST string("BAR")