yara-x 1.15.0

A pure Rust implementation of YARA.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

import "test_proto2"

rule test_1 {
  condition:
    test_proto2.array_struct[0].nested_int32_zero == 0 and
    test_proto2.array_struct[1].nested_int32_one == 1 and
    test_proto2.array_struct[1].nested_int32_zero + test_proto2.array_struct[1].nested_int64_one == 1
}

rule test_2 {
  condition:
    test_proto2.array_struct[1].nested_int32_zero + test_proto2.array_struct[1].nested_int64_one == 1 and
    test_proto2.array_struct[0].nested_int32_zero == 0 and
    test_proto2.array_struct[1].nested_int32_one == 1
}

rule test_3 {
  condition:
    with a = test_proto2.array_struct : (
    	a[1].nested_int32_zero + a[1].nested_int64_one == 1 and
    	a[0].nested_int32_zero == 0 and
    	a[1].nested_int32_one == 1
    )
}