yara-x 1.17.0

A pure Rust implementation of YARA.
Documentation
RULE test
  56: WITH -- hash: 0x6ce2515b14666db7
    55: FIELD_ACCESS -- hash: 0xb93ff31706b0e381
      13: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
      14: SYMBOL Field { index: 49, is_root: false, type_value: array, acl: None, deprecation_notice: None }
    60: WITH -- hash: 0xc0dbc481fbb439ce
      59: FIELD_ACCESS -- hash: 0xe05931a42eb94c5e
        25: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
        26: SYMBOL Field { index: 11, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
      66: WITH -- hash: 0x57d3ee6af7060425
        65: FIELD_ACCESS -- hash: 0xe05931a42eb94c5e
          39: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
          40: SYMBOL Field { index: 11, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
        54: FOR_IN -- hash: 0xc20ef45cd3ce8ade
              n: Var { frame_id: 1, ty: integer, index: 3 }
              i: Var { frame_id: 1, ty: integer, index: 4 }
              max_count: Var { frame_id: 1, ty: integer, index: 5 }
              count: Var { frame_id: 1, ty: integer, index: 6 }
              item: Var { frame_id: 1, ty: array, index: 7 }
          2: FIELD_ACCESS -- hash: 0xab4f8283c0e53bfa
            0: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
            1: SYMBOL Field { index: 56, is_root: false, type_value: array, acl: None, deprecation_notice: None }
          53: AND -- hash: 0x6e529af6e2ef3ad4
            12: FOR_OF -- hash: 0x2dd63934422c5a6a
                  n: Var { frame_id: 2, ty: integer, index: 10 }
                  i: Var { frame_id: 2, ty: integer, index: 11 }
                  max_count: Var { frame_id: 2, ty: integer, index: 12 }
                  count: Var { frame_id: 2, ty: integer, index: 13 }
                  item: Var { frame_id: 2, ty: integer, index: 14 }
              11: PATTERN_MATCH Var { var: Var { frame_id: 2, ty: integer, index: 14 }, type_value: integer(unknown) } IN -- hash: 0xdfd01094a9bb2a16
                5: FIELD_ACCESS -- hash: 0x12d1cab4b33a7120
                  3: SYMBOL Var { var: Var { frame_id: 1, ty: struct, index: 8 }, type_value: struct }
                  4: SYMBOL Field { index: 3, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
                10: ADD -- hash: 0xafe6cef1c79155dc
                  8: FIELD_ACCESS -- hash: 0x12d1cab4b33a7120
                    6: SYMBOL Var { var: Var { frame_id: 1, ty: struct, index: 8 }, type_value: struct }
                    7: SYMBOL Field { index: 3, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
                  9: CONST integer(512)
            58: WITH -- hash: 0xd604f50e65135da4
              57: FIELD_ACCESS -- hash: 0x12d1cab4b33a7120
                19: SYMBOL Var { var: Var { frame_id: 1, ty: struct, index: 8 }, type_value: struct }
                20: SYMBOL Field { index: 3, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
              64: WITH -- hash: 0xe0380f4b6ca7b7fb
                63: FIELD_ACCESS -- hash: 0x12d1cab4b33a7120
                  33: SYMBOL Var { var: Var { frame_id: 1, ty: struct, index: 8 }, type_value: struct }
                  34: SYMBOL Field { index: 3, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
                52: FOR_IN -- hash: 0xe17e0a7e154aa4c3
                      n: Var { frame_id: 3, ty: integer, index: 12 }
                      i: Var { frame_id: 3, ty: integer, index: 13 }
                      max_count: Var { frame_id: 3, ty: integer, index: 14 }
                      count: Var { frame_id: 3, ty: integer, index: 15 }
                      item: Var { frame_id: 3, ty: array, index: 16 }
                  15: SYMBOL Var { var: Var { frame_id: 0, ty: array, index: 0 }, type_value: array }
                  62: WITH -- hash: 0x4bc0dda75686a6e
                    61: ADD -- hash: 0x119636de791cfc7e
                      27: SYMBOL Var { var: Var { frame_id: 0, ty: integer, index: 1 }, type_value: integer(unknown) }
                      30: FIELD_ACCESS -- hash: 0x1540e1df573bad83
                        28: SYMBOL Var { var: Var { frame_id: 3, ty: struct, index: 17 }, type_value: struct }
                        29: SYMBOL Field { index: 5, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
                    68: WITH -- hash: 0xc75581eeb74c42d9
                      67: BITWISE_AND -- hash: 0xf5276d60faa76a34
                        45: ADD -- hash: 0x47f8fe9eef15f1eb
                          41: SYMBOL Var { var: Var { frame_id: 0, ty: integer, index: 2 }, type_value: integer(unknown) }
                          44: FIELD_ACCESS -- hash: 0x1540e1df573bad83
                            42: SYMBOL Var { var: Var { frame_id: 3, ty: struct, index: 17 }, type_value: struct }
                            43: SYMBOL Field { index: 5, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
                        47: CONST integer(-4096)
                      51: FOR_IN -- hash: 0x8ba19c29d61ba8c7
                            n: Var { frame_id: 4, ty: integer, index: 21 }
                            i: Var { frame_id: 4, ty: integer, index: 22 }
                            max_count: Var { frame_id: 4, ty: integer, index: 23 }
                            count: Var { frame_id: 4, ty: integer, index: 24 }
                            item: Var { frame_id: 4, ty: unknown, index: 25 }
                        16: CONST integer(100)
                        17: CONST integer(0)
                        18: CONST integer(4096)
                        50: AND -- hash: 0xdcb7f38210df8cab
                          32: GE -- hash: 0x8ad0c9646eead213
                            24: FN_CALL uint32@offset:i@i:R0:4294967295u -- hash: 0xfbcc1372c30b0fd1
                              23: ADD -- hash: 0x1b21a42a89d09db6
                                21: SYMBOL Var { var: Var { frame_id: 0, ty: integer, index: 10 }, type_value: integer(unknown) }
                                22: SYMBOL Var { var: Var { frame_id: 4, ty: integer, index: 26 }, type_value: integer(unknown) }
                            31: SYMBOL Var { var: Var { frame_id: 0, ty: integer, index: 19 }, type_value: integer(unknown) }
                          49: LT -- hash: 0xa56267adab3b97af
                            38: FN_CALL uint32@offset:i@i:R0:4294967295u -- hash: 0xd0b37398e4eea874
                              37: ADD -- hash: 0xf0090450afb43658
                                35: SYMBOL Var { var: Var { frame_id: 0, ty: integer, index: 11 }, type_value: integer(unknown) }
                                36: SYMBOL Var { var: Var { frame_id: 4, ty: integer, index: 26 }, type_value: integer(unknown) }
                            48: SYMBOL Var { var: Var { frame_id: 0, ty: integer, index: 20 }, type_value: integer(unknown) }