yara-x 1.15.0

A pure Rust implementation of YARA.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

/*! YARA module that parses .NET files.

This allows creating YARA rules based on .NET metadata.
 */

use crate::modules::prelude::*;
use crate::modules::protos::dotnet::*;

pub mod parser;

#[module_main]
fn main(
    data: &[u8],
    _meta: Option<&[u8]>,
) -> Result<Dotnet, ModuleError> {
    match parser::Dotnet::parse(data) {
        Ok(dotnet) => Ok(dotnet.into()),
        Err(_) => {
            let mut dotnet = Dotnet::new();
            dotnet.is_dotnet = Some(false);
            Ok(dotnet)
        }
    }
}