yara-x 1.17.0

A pure Rust implementation of YARA.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

/*! YARA module that parses .NET files.

This allows creating YARA rules based on .NET metadata.
 */
use crate::mods::prelude::*;
use crate::modules::protos::dotnet::*;

pub mod parser;

fn main(data: &[u8], _meta: Option<&[u8]>) -> Result<Dotnet, ModuleError> {
    match parser::Dotnet::parse(data) {
        Ok(dotnet) => Ok(dotnet.into()),
        Err(_) => {
            let mut dotnet = Dotnet::new();
            dotnet.is_dotnet = Some(false);
            Ok(dotnet)
        }
    }
}

register_module!("dotnet", Dotnet, main);