yara-x 1.15.0

A pure Rust implementation of YARA.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

import "test_proto2"

rule test_1 {
	condition:
		1 + 1 - 1 == 1
}

rule test_2 {
	condition:
		test_proto2.int64_one + 1 - test_proto2.int64_one == 1
}

rule test_3 {
	condition:
		1 * 2 \ 1 > 1
}

rule test_4 {
	condition:
		(1 << 2) >> 1 <= 2
}

rule test_5 {
	condition:
		4 --2 * 2 == 8
}

rule test_6 {
  condition:
    2 ^ 1 == ~1 & 1 | 1
}

rule test_7 {
	condition:
		test_proto2.int64_zero == 0 and true and not false
}

rule test_8 {
	condition:
		test_proto2.int64_zero + 1 + 2
}

rule test_9 {
  condition:
     "foobar" contains "bar" and
     "foobar" icontains "BAR" and
     "foobar" startswith "foo" and
     "foobar" istartswith "FOO" and
     "foobar" endswith "bar" and
     "foobar" iendswith "BAR"
}