yara-x 1.19.0

A pure Rust implementation of YARA.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

syntax = "proto2";
import "yara.proto";

package olecf;

option (yara.module_options) = {
  name : "olecf"
  root_message: "olecf.Olecf"
  cargo_feature: "olecf-module"
};

message Olecf {
  // True if file is an OLE CF file.
  required bool is_olecf = 1;
  // Streams contained in the OLE CF file.
  repeated Stream streams = 2;
}

// Type of streams.
enum StreamType {
  UNKNOWN = 0;
  STORAGE = 1;
  STREAM = 2;
  ROOT = 5;
}

// Describes a stream in the OLE CF file.
message Stream {
  required string name = 1;
  required StreamType type = 2;
  required uint64 size = 3;
}