Struct VmmYara 

pub struct VmmYara<'a> { /* private fields */ }

Yara Search API.

Search for yara signatures in physical or virtual memory.

Yara rules may be in either the form of:

• one (1) compiled yara rules file.
• multiple yara source rules files.
• multiple yara source rules strings.

The VmmYara must be used as mut. Also see VmmYaraResult.

The synchronous search workflow:

1. Acquire search object from vmm.search_yara() or vmmprocess.search_yara().
2. Start the search and retrieve result (blocking) by calling vmmyara.result().

The asynchronous search workflow:

1. Acquire search object from vmm.search_yara() or vmmprocess.search_yara().
2. Start the search in the background using vmmyara.start().
3. Optionally abort the search with vmmyara.abort().
4. Optionally poll status or result (if completed) using vmmyara.poll().
5. Optionally retrieve result (blocking) by calling vmmyara.result().
6. Yara Search goes out of scope and is cleaned up. Any on-going searches may take a short while to terminate gracefully.

Created By

• vmm.search_yara()
• vmmprocess.search_yara()

Examples

// Fetch yara search struct for entire process virtual address space.
// Max 256 search hits and avoid using the cache in this example.
let yara_rule = " rule mz_header { strings: $mz = \"MZ\" condition: $mz at 0 } ";
let yara_rules = vec![yara_rule];
let mut vmmyara = vmmprocess.search_yara(yara_rules, 0, 0, 256, FLAG_NOCACHE);
// Start search in async mode.
vmmyara.start();
// Search is now running - it's possible to do other actions here.
// It's possible to poll() to see current progress (or if finished).
// It's possible to abort() to stop search.
// It's possible to fetch result() which will block until search is finished.
let yara_result = vmmyara.result();

Implementations

impl VmmYara<'_>

pub fn start(&mut self)

Start a yara search in asynchronous background thread.

This is useful since the yara search may take some time and other work may be done while waiting for the result.

The search will start immediately and the progress (and result, if finished) may be polled by calling poll().

The result may be retrieved by a call to poll() or by a blocking call to result() which will return when the search is completed.

Examples

vmmyara.start();

pub fn abort(&mut self)

Abort an on-going yara search.

Examples

vmmyara.abort();

pub fn poll(&mut self) -> VmmYaraResult

Poll an on-going yara search for the status/result.

Also see VmmYara and VmmYaraResult.

Examples

let yara_status_and_result = vmmyara.poll();

pub fn result(&mut self) -> VmmYaraResult

Retrieve the yara search result.

The function is blocking and will wait for the search to complete before the results are returned.

Also see VmmYara and VmmYaraResult.

Examples

let yara_status_and_result = vmmyara.result();

Trait Implementations

impl<'a> Debug for VmmYara<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for VmmYara<'_>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Drop for VmmYara<'_>

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.