yara-x 1.17.0

A pure Rust implementation of YARA.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110

RULE test_1
  35: AND -- hash: 0xfb4afd329fb07dc3
    8: EQ -- hash: 0x496c97e53b61f654
      6: FIELD_ACCESS -- hash: 0x6af92ddf1af8a3f2
        4: LOOKUP -- hash: 0xb7e6fdca077aa568
          2: FIELD_ACCESS -- hash: 0xb93ff31706b0e381
            0: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
            1: SYMBOL Field { index: 49, is_root: false, type_value: array, acl: None, deprecation_notice: None }
          3: CONST integer(0)
        5: SYMBOL Field { index: 0, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
      7: CONST integer(0)
    17: EQ -- hash: 0xdfb78d0d299b6d6d
      15: FIELD_ACCESS -- hash: 0xc0df94afb482a623
        13: LOOKUP -- hash: 0x60a088711b3f7b54
          11: FIELD_ACCESS -- hash: 0xb93ff31706b0e381
            9: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
            10: SYMBOL Field { index: 49, is_root: false, type_value: array, acl: None, deprecation_notice: None }
          12: CONST integer(1)
        14: SYMBOL Field { index: 2, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
      16: CONST integer(1)
    34: EQ -- hash: 0xf94a49164359b744
      32: ADD -- hash: 0x637f01b98f7ef769
        24: FIELD_ACCESS -- hash: 0x57244722efe1684a
          22: LOOKUP -- hash: 0x60a088711b3f7b54
            20: FIELD_ACCESS -- hash: 0xb93ff31706b0e381
              18: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
              19: SYMBOL Field { index: 49, is_root: false, type_value: array, acl: None, deprecation_notice: None }
            21: CONST integer(1)
          23: SYMBOL Field { index: 0, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
        31: FIELD_ACCESS -- hash: 0x75bd3b7618d34510
          29: LOOKUP -- hash: 0x60a088711b3f7b54
            27: FIELD_ACCESS -- hash: 0xb93ff31706b0e381
              25: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
              26: SYMBOL Field { index: 49, is_root: false, type_value: array, acl: None, deprecation_notice: None }
            28: CONST integer(1)
          30: SYMBOL Field { index: 3, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
      33: CONST integer(1)

RULE test_2
  35: AND -- hash: 0x467259e49dca9732
    16: EQ -- hash: 0xf94a49164359b744
      14: ADD -- hash: 0x637f01b98f7ef769
        6: FIELD_ACCESS -- hash: 0x57244722efe1684a
          4: LOOKUP -- hash: 0x60a088711b3f7b54
            2: FIELD_ACCESS -- hash: 0xb93ff31706b0e381
              0: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
              1: SYMBOL Field { index: 49, is_root: false, type_value: array, acl: None, deprecation_notice: None }
            3: CONST integer(1)
          5: SYMBOL Field { index: 0, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
        13: FIELD_ACCESS -- hash: 0x75bd3b7618d34510
          11: LOOKUP -- hash: 0x60a088711b3f7b54
            9: FIELD_ACCESS -- hash: 0xb93ff31706b0e381
              7: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
              8: SYMBOL Field { index: 49, is_root: false, type_value: array, acl: None, deprecation_notice: None }
            10: CONST integer(1)
          12: SYMBOL Field { index: 3, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
      15: CONST integer(1)
    25: EQ -- hash: 0x496c97e53b61f654
      23: FIELD_ACCESS -- hash: 0x6af92ddf1af8a3f2
        21: LOOKUP -- hash: 0xb7e6fdca077aa568
          19: FIELD_ACCESS -- hash: 0xb93ff31706b0e381
            17: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
            18: SYMBOL Field { index: 49, is_root: false, type_value: array, acl: None, deprecation_notice: None }
          20: CONST integer(0)
        22: SYMBOL Field { index: 0, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
      24: CONST integer(0)
    34: EQ -- hash: 0xdfb78d0d299b6d6d
      32: FIELD_ACCESS -- hash: 0xc0df94afb482a623
        30: LOOKUP -- hash: 0x60a088711b3f7b54
          28: FIELD_ACCESS -- hash: 0xb93ff31706b0e381
            26: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
            27: SYMBOL Field { index: 49, is_root: false, type_value: array, acl: None, deprecation_notice: None }
          29: CONST integer(1)
        31: SYMBOL Field { index: 2, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
      33: CONST integer(1)

RULE test_3
  31: WITH -- hash: 0xd12c99d2b9385c31
    2: FIELD_ACCESS -- hash: 0xb93ff31706b0e381
      0: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None }
      1: SYMBOL Field { index: 49, is_root: false, type_value: array, acl: None, deprecation_notice: None }
    30: AND -- hash: 0x12dc7234de2063ae
      15: EQ -- hash: 0xe2720d2e43d2dad5
        13: ADD -- hash: 0x48118390d9d2fbc
          7: FIELD_ACCESS -- hash: 0xabb583028cf4d3ae
            5: LOOKUP -- hash: 0x15e3054cfa75da5a
              3: SYMBOL Var { var: Var { frame_id: 1, ty: array, index: 0 }, type_value: array }
              4: CONST integer(1)
            6: SYMBOL Field { index: 0, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
          12: FIELD_ACCESS -- hash: 0xca4e7755b9e6b074
            10: LOOKUP -- hash: 0x15e3054cfa75da5a
              8: SYMBOL Var { var: Var { frame_id: 1, ty: array, index: 0 }, type_value: array }
              9: CONST integer(1)
            11: SYMBOL Field { index: 3, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
        14: CONST integer(1)
      22: EQ -- hash: 0xf7a23951bfcab6f
        20: FIELD_ACCESS -- hash: 0xbf8a69beb80c0f56
          18: LOOKUP -- hash: 0x6d297aa5e6b1046e
            16: SYMBOL Var { var: Var { frame_id: 1, ty: array, index: 0 }, type_value: array }
            17: CONST integer(0)
          19: SYMBOL Field { index: 0, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
        21: CONST integer(0)
      29: EQ -- hash: 0xa5c518bd0a362288
        27: FIELD_ACCESS -- hash: 0x1570d08f55961188
          25: LOOKUP -- hash: 0x15e3054cfa75da5a
            23: SYMBOL Var { var: Var { frame_id: 1, ty: array, index: 0 }, type_value: array }
            24: CONST integer(1)
          26: SYMBOL Field { index: 2, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None }
        28: CONST integer(1)