Skip to main content

evaluate_rules_with_config

Function evaluate_rules_with_config 

Source
pub fn evaluate_rules_with_config(
    rules: &[MagicRule],
    buffer: &[u8],
    config: &EvaluationConfig,
) -> Result<Vec<RuleMatch>, LibmagicError>
Expand description

Evaluate magic rules with a fresh context

This is a convenience function that creates a new evaluation context and evaluates the rules. Useful for simple evaluation scenarios.

§Arguments

  • rules - The list of magic rules to evaluate
  • buffer - The file buffer to evaluate against
  • config - Configuration for evaluation behavior

§Returns

Returns Ok(Vec<RuleMatch>) containing all matches found, or Err(LibmagicError) if evaluation fails.

§Examples

use libmagic_rs::evaluator::{evaluate_rules_with_config, RuleMatch};
use libmagic_rs::parser::ast::{MagicRule, OffsetSpec, TypeKind, Operator, Value};
use libmagic_rs::EvaluationConfig;

let rule = MagicRule {
    offset: OffsetSpec::Absolute(0),
    typ: TypeKind::Byte { signed: true },
    op: Operator::Equal,
    value: Value::Uint(0x7f),
    message: "ELF magic".to_string(),
    children: vec![],
    level: 0,
    strength_modifier: None,
};

let rules = vec![rule];
let buffer = &[0x7f, 0x45, 0x4c, 0x46];
let config = EvaluationConfig::default();

let matches = evaluate_rules_with_config(&rules, buffer, &config).unwrap();
assert_eq!(matches.len(), 1);
assert_eq!(matches[0].message, "ELF magic");

§Errors

  • LibmagicError::EvaluationError - If rule evaluation fails
  • LibmagicError::Timeout - If evaluation exceeds configured timeout