yara-x 1.17.0

A pure Rust implementation of YARA.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

RULE test_1
  14: FOR_IN -- hash: 0x52bf5e8df23693d7
        n: Var { frame_id: 1, ty: integer, index: 0 }
        i: Var { frame_id: 1, ty: integer, index: 1 }
        max_count: Var { frame_id: 1, ty: integer, index: 2 }
        count: Var { frame_id: 1, ty: integer, index: 3 }
        item: Var { frame_id: 1, ty: unknown, index: 4 }
    0: CONST integer(0)
    1: CONST integer(1)
    16: WITH -- hash: 0x41fbd3788d9217a0
      15: MUL -- hash: 0xbde422737d04274c
        6: ADD -- hash: 0x11ca3959d9be382c
          4: SYMBOL Var { var: Var { frame_id: 1, ty: integer, index: 5 }, type_value: integer(unknown) }
          5: SYMBOL Var { var: Var { frame_id: 1, ty: integer, index: 5 }, type_value: integer(unknown) }
        7: CONST integer(2)
      13: FOR_IN -- hash: 0xff1c8ed74a0073b8
            n: Var { frame_id: 2, ty: integer, index: 8 }
            i: Var { frame_id: 2, ty: integer, index: 9 }
            max_count: Var { frame_id: 2, ty: integer, index: 10 }
            count: Var { frame_id: 2, ty: integer, index: 11 }
            item: Var { frame_id: 2, ty: unknown, index: 12 }
        2: CONST integer(0)
        3: CONST integer(1)
        12: EQ -- hash: 0x1900d160247f7f84
          8: SYMBOL Var { var: Var { frame_id: 0, ty: integer, index: 7 }, type_value: integer(unknown) }
          11: MINUS -- hash: 0xccd68ad07cbe4681
            10: MINUS -- hash: 0x10decb3bfac38be4
              9: SYMBOL Var { var: Var { frame_id: 2, ty: integer, index: 13 }, type_value: integer(unknown) }

RULE test_2
  10: FOR_IN -- hash: 0x5fa30afbd11d7a2a
        n: Var { frame_id: 1, ty: integer, index: 0 }
        i: Var { frame_id: 1, ty: integer, index: 1 }
        max_count: Var { frame_id: 1, ty: integer, index: 2 }
        count: Var { frame_id: 1, ty: integer, index: 3 }
        item: Var { frame_id: 1, ty: unknown, index: 4 }
    0: CONST integer(0)
    1: CONST integer(1)
    9: FOR_IN -- hash: 0x4cf5fa0e0fbbad81
          n: Var { frame_id: 2, ty: integer, index: 7 }
          i: Var { frame_id: 2, ty: integer, index: 8 }
          max_count: Var { frame_id: 2, ty: integer, index: 9 }
          count: Var { frame_id: 2, ty: integer, index: 10 }
          item: Var { frame_id: 2, ty: unknown, index: 11 }
      2: CONST integer(0)
      3: CONST integer(1)
      8: EQ -- hash: 0x6980500c7aa070d0
        6: ADD -- hash: 0x11ca3959d9be382c
          4: SYMBOL Var { var: Var { frame_id: 1, ty: integer, index: 5 }, type_value: integer(unknown) }
          5: SYMBOL Var { var: Var { frame_id: 1, ty: integer, index: 5 }, type_value: integer(unknown) }
        7: CONST integer(0)