yara-x 1.17.0

A pure Rust implementation of YARA.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77

RULE test_1
  6: EQ -- hash: 0xbc578eceb5139ff6
    4: CONST integer(1)
    5: CONST integer(1)

RULE test_2
  10: EQ -- hash: 0xa60cf135438e6090
    8: SUB -- hash: 0xdc58c9f57c354387
      4: ADD -- hash: 0x73cffc9d7ea6b7e5
        2: FIELD_ACCESS -- hash: 0x4a147f30f75a8a38
          0: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
          1: SYMBOL Field { index: 13, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
        3: CONST integer(1)
      7: FIELD_ACCESS -- hash: 0x4a147f30f75a8a38
        5: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
        6: SYMBOL Field { index: 13, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
    9: CONST integer(1)

RULE test_3
  6: GT -- hash: 0x61dcf8602bb009ae
    4: DIV -- hash: 0x8a6d566de890e50c
      2: CONST integer(2)
      3: CONST integer(1)
    5: CONST integer(1)

RULE test_4
  6: LE -- hash: 0x6046db8bec76f9db
    4: CONST integer(2)
    5: CONST integer(2)

RULE test_5
  6: EQ -- hash: 0xce980a3b0dd2d7cf
    4: CONST integer(8)
    5: CONST integer(8)

RULE test_6
  9: EQ -- hash: 0x94adc1565ee528a6
    2: CONST integer(3)
    8: CONST integer(1)

RULE test_7
  8: AND -- hash: 0x5ff91274637c63b1
    4: EQ -- hash: 0x2e8ba46ec7871b51
      2: FIELD_ACCESS -- hash: 0xcfb0ade44793171f
        0: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
        1: SYMBOL Field { index: 1, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
      3: CONST integer(0)

RULE test_8
  5: ADD -- hash: 0x1d972cb4137a7747
    2: FIELD_ACCESS -- hash: 0xcfb0ade44793171f
      0: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
      1: SYMBOL Field { index: 1, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
    3: CONST integer(1)
    4: CONST integer(2)

RULE test_9
  18: AND -- hash: 0x87ea037bd606baac
    2: CONTAINS -- hash: 0xbabdc2c62427fdc
      0: CONST string("foobar")
      1: CONST string("bar")
    5: ICONTAINS -- hash: 0xc2864620e881ca78
      3: CONST string("foobar")
      4: CONST string("BAR")
    8: STARTS_WITH -- hash: 0x58ec6fc7a36541b2
      6: CONST string("foobar")
      7: CONST string("foo")
    11: ISTARTS_WITH -- hash: 0x3965d2a92aab2a87
      9: CONST string("foobar")
      10: CONST string("FOO")
    14: ENDS_WITH -- hash: 0xe536fb2e32265590
      12: CONST string("foobar")
      13: CONST string("bar")
    17: IENDS_WITH -- hash: 0x9c116522b865a02d
      15: CONST string("foobar")
      16: CONST string("BAR")