yara-x 1.17.0

A pure Rust implementation of YARA.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68

RULE test
  52: WITH -- hash: 0x6d7701fe081d983f
    2: FIELD_ACCESS -- hash: 0x9536d86a9309eb4b
      0: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
      1: SYMBOL Field { index: 12, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
    51: AND -- hash: 0x9bd969653383cc22
      22: FOR_IN -- hash: 0x2c6eaee06da3665a
            n: Var { frame_id: 2, ty: integer, index: 1 }
            i: Var { frame_id: 2, ty: integer, index: 2 }
            max_count: Var { frame_id: 2, ty: integer, index: 3 }
            count: Var { frame_id: 2, ty: integer, index: 4 }
            item: Var { frame_id: 2, ty: unknown, index: 5 }
        3: CONST integer(0)
        4: CONST integer(1)
        21: AND -- hash: 0x82951fe9ebf8c896
          7: EQ -- hash: 0x1e7413311b1944fa
            5: SYMBOL Var { var: Var { frame_id: 2, ty: integer, index: 6 }, type_value: integer(unknown) }
            6: SYMBOL Var { var: Var { frame_id: 1, ty: integer, index: 0 }, type_value: integer(unknown) }
          13: EQ -- hash: 0x55a86ac488e1462e
            11: FN_CALL test_proto2.add@a:i,b:i@i -- hash: 0x5c8149efefc0401a
              9: CONST integer(1)
              10: CONST integer(2)
            12: CONST integer(3)
          20: EQ -- hash: 0x84cf5cf12dbe27a0
            18: ADD -- hash: 0xf519dc2b10fbedfc
              16: FIELD_ACCESS -- hash: 0x2b7b8addca68ad72
                14: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
                15: SYMBOL Field { index: 10, is_root: false, type_value: float(unknown), acl: None, deprecation_notice: None }
              17: CONST integer(1)
            19: CONST float(1.0)
      39: FOR_IN -- hash: 0xce4208fea0a2e539
            n: Var { frame_id: 3, ty: integer, index: 1 }
            i: Var { frame_id: 3, ty: integer, index: 2 }
            max_count: Var { frame_id: 3, ty: integer, index: 3 }
            count: Var { frame_id: 3, ty: integer, index: 4 }
            item: Var { frame_id: 3, ty: unknown, index: 5 }
        23: CONST integer(0)
        24: CONST integer(1)
        38: OR -- hash: 0x634779ad4e349e70
          30: NE -- hash: 0x5d2d23e537a8a59
            28: FN_CALL test_proto2.add@a:i,b:i@i -- hash: 0x5c8149efefc0401a
              26: CONST integer(1)
              27: CONST integer(2)
            29: CONST integer(0)
          37: EQ -- hash: 0x84cf5cf12dbe27a0
            35: ADD -- hash: 0xf519dc2b10fbedfc
              33: FIELD_ACCESS -- hash: 0x2b7b8addca68ad72
                31: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
                32: SYMBOL Field { index: 10, is_root: false, type_value: float(unknown), acl: None, deprecation_notice: None }
              34: CONST integer(1)
            36: CONST float(1.0)
      50: FOR_IN -- hash: 0x313e311089e8c59
            n: Var { frame_id: 4, ty: integer, index: 1 }
            i: Var { frame_id: 4, ty: integer, index: 2 }
            max_count: Var { frame_id: 4, ty: integer, index: 3 }
            count: Var { frame_id: 4, ty: integer, index: 4 }
            item: Var { frame_id: 4, ty: unknown, index: 5 }
        40: CONST integer(0)
        41: CONST integer(1)
        49: NOT -- hash: 0xb2812a5ab7cd6b73
          48: EQ -- hash: 0x84cf5cf12c2f67a0
            46: ADD -- hash: 0xf519dc2b10fbedfc
              44: FIELD_ACCESS -- hash: 0x2b7b8addca68ad72
                42: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
                43: SYMBOL Field { index: 10, is_root: false, type_value: float(unknown), acl: None, deprecation_notice: None }
              45: CONST integer(1)
            47: CONST float(2.0)