yara-x 1.16.0

A pure Rust implementation of YARA.
Documentation
RULE test
  52: WITH -- hash: 0x9bec9656dce82b6d
    2: FIELD_ACCESS -- hash: 0x30adb8d0b7ea7b20
      0: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
      1: SYMBOL Field { index: 12, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
    51: AND -- hash: 0x2eaeb74b847a4d38
      54: WITH -- hash: 0x1146bb568254efab
        53: FN_CALL test_proto2.add@a:i,b:i@i -- hash: 0x261e822f79c74aad
          9: CONST integer(1)
          10: CONST integer(2)
        56: WITH -- hash: 0x58086382660011ee
          55: EQ -- hash: 0xb06f506b571835e5
            11: SYMBOL Var { var: Var { frame_id: 0, ty: integer, index: 1 }, type_value: integer(unknown) }
            12: CONST integer(3)
          58: WITH -- hash: 0xa1db54bedd6f6be6
            57: FIELD_ACCESS -- hash: 0xc6f26b43ef493d46
              14: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
              15: SYMBOL Field { index: 10, is_root: false, type_value: float(unknown), acl: None, deprecation_notice: None }
            60: WITH -- hash: 0x1ce3fc3e2ea805f6
              59: ADD -- hash: 0x1f8003fe2da19d98
                16: SYMBOL Var { var: Var { frame_id: 0, ty: float, index: 3 }, type_value: float(unknown) }
                17: CONST integer(1)
              62: WITH -- hash: 0x6b8d39516e40d5c4
                61: EQ -- hash: 0xe816c5b8c599086e
                  18: SYMBOL Var { var: Var { frame_id: 0, ty: float, index: 4 }, type_value: float(unknown) }
                  19: CONST float(1.0)
                22: FOR_IN -- hash: 0x7972839ab6e7e7fd
                      n: Var { frame_id: 2, ty: integer, index: 6 }
                      i: Var { frame_id: 2, ty: integer, index: 7 }
                      max_count: Var { frame_id: 2, ty: integer, index: 8 }
                      count: Var { frame_id: 2, ty: integer, index: 9 }
                      item: Var { frame_id: 2, ty: unknown, index: 10 }
                  3: CONST integer(0)
                  4: CONST integer(1)
                  21: AND -- hash: 0x1f1a3d4b94bd6cf0
                    7: EQ -- hash: 0xd0eb828214f0d7a6
                      5: SYMBOL Var { var: Var { frame_id: 2, ty: integer, index: 11 }, type_value: integer(unknown) }
                      6: SYMBOL Var { var: Var { frame_id: 1, ty: integer, index: 0 }, type_value: integer(unknown) }
                    13: SYMBOL Var { var: Var { frame_id: 0, ty: boolean, index: 2 }, type_value: boolean(unknown) }
                    20: SYMBOL Var { var: Var { frame_id: 0, ty: boolean, index: 5 }, type_value: boolean(unknown) }
      64: WITH -- hash: 0x2e00596c13d056e8
        63: FN_CALL test_proto2.add@a:i,b:i@i -- hash: 0x261e822f79c74aad
          26: CONST integer(1)
          27: CONST integer(2)
        66: WITH -- hash: 0xa0cb3969e5369c8a
          65: NE -- hash: 0x4025089ffe7b584c
            28: SYMBOL Var { var: Var { frame_id: 0, ty: integer, index: 1 }, type_value: integer(unknown) }
            29: CONST integer(0)
          68: WITH -- hash: 0xbe545e6656880f10
            67: FIELD_ACCESS -- hash: 0xc6f26b43ef493d46
              31: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
              32: SYMBOL Field { index: 10, is_root: false, type_value: float(unknown), acl: None, deprecation_notice: None }
            70: WITH -- hash: 0x7fbe51166763ccd6
              69: ADD -- hash: 0x1f8003fe2da19d98
                33: SYMBOL Var { var: Var { frame_id: 0, ty: float, index: 3 }, type_value: float(unknown) }
                34: CONST integer(1)
              72: WITH -- hash: 0x63ffb8d4a4cb6c5e
                71: EQ -- hash: 0xe816c5b8c599086e
                  35: SYMBOL Var { var: Var { frame_id: 0, ty: float, index: 4 }, type_value: float(unknown) }
                  36: CONST float(1.0)
                74: WITH -- hash: 0x17995e0bce4825aa
                  73: OR -- hash: 0xd0741b62865f08c0
                    30: SYMBOL Var { var: Var { frame_id: 0, ty: boolean, index: 2 }, type_value: boolean(unknown) }
                    37: SYMBOL Var { var: Var { frame_id: 0, ty: boolean, index: 5 }, type_value: boolean(unknown) }
                  39: FOR_IN -- hash: 0x2a20d32365a87a56
                        n: Var { frame_id: 3, ty: integer, index: 7 }
                        i: Var { frame_id: 3, ty: integer, index: 8 }
                        max_count: Var { frame_id: 3, ty: integer, index: 9 }
                        count: Var { frame_id: 3, ty: integer, index: 10 }
                        item: Var { frame_id: 3, ty: unknown, index: 11 }
                    23: CONST integer(0)
                    24: CONST integer(1)
                    38: SYMBOL Var { var: Var { frame_id: 0, ty: boolean, index: 6 }, type_value: boolean(unknown) }
      76: WITH -- hash: 0x3b6309a759bbc3d2
        75: FIELD_ACCESS -- hash: 0xc6f26b43ef493d46
          42: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
          43: SYMBOL Field { index: 10, is_root: false, type_value: float(unknown), acl: None, deprecation_notice: None }
        78: WITH -- hash: 0x59cd414d2af5d69f
          77: ADD -- hash: 0x4729d17687d014e8
            44: SYMBOL Var { var: Var { frame_id: 0, ty: float, index: 1 }, type_value: float(unknown) }
            45: CONST integer(1)
          80: WITH -- hash: 0xa380abf1d2c9b2cc
            79: EQ -- hash: 0xfc093311e38bfbf
              46: SYMBOL Var { var: Var { frame_id: 0, ty: float, index: 2 }, type_value: float(unknown) }
              47: CONST float(2.0)
            82: WITH -- hash: 0x821acdcbe1f11e6b
              81: NOT -- hash: 0xa950472dd0663d8b
                48: SYMBOL Var { var: Var { frame_id: 0, ty: boolean, index: 3 }, type_value: boolean(unknown) }
              50: FOR_IN -- hash: 0xd8adbdd53e1ece7e
                    n: Var { frame_id: 4, ty: integer, index: 5 }
                    i: Var { frame_id: 4, ty: integer, index: 6 }
                    max_count: Var { frame_id: 4, ty: integer, index: 7 }
                    count: Var { frame_id: 4, ty: integer, index: 8 }
                    item: Var { frame_id: 4, ty: unknown, index: 9 }
                40: CONST integer(0)
                41: CONST integer(1)
                49: SYMBOL Var { var: Var { frame_id: 0, ty: boolean, index: 4 }, type_value: boolean(unknown) }