yara-x 1.15.0

A pure Rust implementation of YARA.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

RULE test
  52: WITH -- hash: 0x3d25b3d4794433e2 -- parent: None 
    2: FIELD_ACCESS -- hash: 0x30adb8d0b7ea7b20 -- parent: 52 
      0: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None } -- parent: 2 
      1: SYMBOL Field { index: 12, is_root: false, type_value: integer(unknown), acl: None, deprecation_notice: None } -- parent: 2 
    51: AND -- hash: 0xb3895dc66180b6ac -- parent: 52 
      22: FOR_IN -- hash: 0xb5766871f0d8434f -- parent: 51 
        3: CONST integer(0) -- parent: 22 
        4: CONST integer(1) -- parent: 22 
        21: AND -- hash: 0x46f1e0ca50258bf4 -- parent: 22 
          7: EQ -- hash: 0xa866a1c3637edc78 -- parent: 21 
            5: SYMBOL Var { var: Var { frame_id: 2, ty: integer, index: 6 }, type_value: integer(unknown) } -- parent: 7 
            6: SYMBOL Var { var: Var { frame_id: 1, ty: integer, index: 0 }, type_value: integer(unknown) } -- parent: 7 
          13: EQ -- hash: 0x452e9b6d563a2e0e -- parent: 21 
            11: FN_CALL test_proto2.add@a:i,b:i@i -- hash: 0x261e822f79c74aad -- parent: 13 
              9: CONST integer(1) -- parent: 11 
              10: CONST integer(2) -- parent: 11 
            12: CONST integer(3) -- parent: 13 
          20: EQ -- hash: 0xb9f99fc2d3abf379 -- parent: 21 
            18: ADD -- hash: 0x2b8f1094f609e931 -- parent: 20 
              16: FIELD_ACCESS -- hash: 0xc6f26b43ef493d46 -- parent: 18 
                14: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None } -- parent: 16 
                15: SYMBOL Field { index: 10, is_root: false, type_value: float(unknown), acl: None, deprecation_notice: None } -- parent: 16 
              17: CONST integer(1) -- parent: 18 
            19: CONST float(1.0) -- parent: 20 
      39: FOR_IN -- hash: 0x780dcdbeadf30f98 -- parent: 51 
        23: CONST integer(0) -- parent: 39 
        24: CONST integer(1) -- parent: 39 
        38: OR -- hash: 0x49a206ca8caeb222 -- parent: 39 
          30: NE -- hash: 0xf55902e71cd37238 -- parent: 38 
            28: FN_CALL test_proto2.add@a:i,b:i@i -- hash: 0x261e822f79c74aad -- parent: 30 
              26: CONST integer(1) -- parent: 28 
              27: CONST integer(2) -- parent: 28 
            29: CONST integer(0) -- parent: 30 
          37: EQ -- hash: 0xb9f99fc2d3abf379 -- parent: 38 
            35: ADD -- hash: 0x2b8f1094f609e931 -- parent: 37 
              33: FIELD_ACCESS -- hash: 0xc6f26b43ef493d46 -- parent: 35 
                31: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None } -- parent: 33 
                32: SYMBOL Field { index: 10, is_root: false, type_value: float(unknown), acl: None, deprecation_notice: None } -- parent: 33 
              34: CONST integer(1) -- parent: 35 
            36: CONST float(1.0) -- parent: 37 
      50: FOR_IN -- hash: 0xfe0707a87971b452 -- parent: 51 
        40: CONST integer(0) -- parent: 50 
        41: CONST integer(1) -- parent: 50 
        49: NOT -- hash: 0xe7ab6d2c59bb374c -- parent: 50 
          48: EQ -- hash: 0xb9f99fc2d21d3379 -- parent: 49 
            46: ADD -- hash: 0x2b8f1094f609e931 -- parent: 48 
              44: FIELD_ACCESS -- hash: 0xc6f26b43ef493d46 -- parent: 46 
                42: SYMBOL Field { index: 0, is_root: true, type_value: struct, acl: None, deprecation_notice: None } -- parent: 44 
                43: SYMBOL Field { index: 10, is_root: false, type_value: float(unknown), acl: None, deprecation_notice: None } -- parent: 44 
              45: CONST integer(1) -- parent: 46 
            47: CONST float(2.0) -- parent: 48