yara-x 1.17.0

A pure Rust implementation of YARA.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101

RULE test_1
  6: EQ -- hash: 0xc7498012998dc23
    4: SUB -- hash: 0x5de9f21a44838878
      2: ADD -- hash: 0xd2fa3e8c5b9fd0fb
        0: CONST integer(1)
        1: CONST integer(1)
      3: CONST integer(1)
    5: CONST integer(1)

RULE test_2
  10: EQ -- hash: 0xfb622d3fda4c9468
    8: SUB -- hash: 0x38aff83d94a3aa25
      4: ADD -- hash: 0xaa45310763b4b319
        2: FIELD_ACCESS -- hash: 0xe58b5f97183b1a0c
          0: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
          1: SYMBOL Field { index: 13, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
        3: CONST integer(1)
      7: FIELD_ACCESS -- hash: 0xe58b5f97183b1a0c
        5: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
        6: SYMBOL Field { index: 13, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
    9: CONST integer(1)

RULE test_3
  6: GT -- hash: 0x6f05ae7a8b19576e
    4: DIV -- hash: 0x33f6acf40bfce746
      2: MUL -- hash: 0x3391d9c94bf86b8
        0: CONST integer(1)
        1: CONST integer(2)
      3: CONST integer(1)
    5: CONST integer(1)

RULE test_4
  6: LE -- hash: 0x94cc57b0e87ee022
    4: SHR -- hash: 0xfcaac0eae066696c
      2: SHL -- hash: 0x560670a37a22b641
        0: CONST integer(1)
        1: CONST integer(2)
      3: CONST integer(1)
    5: CONST integer(2)

RULE test_5
  6: EQ -- hash: 0xeb353eeba0e329e3
    4: SUB -- hash: 0x3e023f7bf097d869
      0: CONST integer(4)
      3: MUL -- hash: 0x3eb7d1d11a0539b0
        1: CONST integer(-2)
        2: CONST integer(2)
    5: CONST integer(8)

RULE test_6
  9: EQ -- hash: 0x4a78a326637b7d9d
    2: BITWISE_XOR -- hash: 0x64bffdddf74ef466
      0: CONST integer(2)
      1: CONST integer(1)
    8: BITWISE_OR -- hash: 0x1dc12c2d28b77480
      6: BITWISE_AND -- hash: 0x9c63b389ed56b277
        4: BITWISE_NOT -- hash: 0x551649e0ddd39ce
          3: CONST integer(1)
        5: CONST integer(1)
      7: CONST integer(1)

RULE test_7
  8: AND -- hash: 0x6c4794a019f8a3c6
    4: EQ -- hash: 0x6500d8d8a8951685
      2: FIELD_ACCESS -- hash: 0x6b278e4a6873a6f4
        0: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
        1: SYMBOL Field { index: 1, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
      3: CONST integer(0)
    5: CONST boolean(true)
    7: NOT -- hash: 0x3feac9369f2eda0e
      6: CONST boolean(false)

RULE test_8
  5: ADD -- hash: 0x52c16f85b5684320
    2: FIELD_ACCESS -- hash: 0x6b278e4a6873a6f4
      0: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
      1: SYMBOL Field { index: 1, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
    3: CONST integer(1)
    4: CONST integer(2)

RULE test_9
  18: AND -- hash: 0x87ea037bd606baac
    2: CONTAINS -- hash: 0xbabdc2c62427fdc
      0: CONST string("foobar")
      1: CONST string("bar")
    5: ICONTAINS -- hash: 0xc2864620e881ca78
      3: CONST string("foobar")
      4: CONST string("BAR")
    8: STARTS_WITH -- hash: 0x58ec6fc7a36541b2
      6: CONST string("foobar")
      7: CONST string("foo")
    11: ISTARTS_WITH -- hash: 0x3965d2a92aab2a87
      9: CONST string("foobar")
      10: CONST string("FOO")
    14: ENDS_WITH -- hash: 0xe536fb2e32265590
      12: CONST string("foobar")
      13: CONST string("bar")
    17: IENDS_WITH -- hash: 0x9c116522b865a02d
      15: CONST string("foobar")
      16: CONST string("BAR")