Macro lazy_rule 

macro_rules! lazy_rule {
    ($name:ident = |$state:ident| $find:expr, $describe:literal, $importance:literal $(, $($rest:tt)+)?) => { ... };
    ($name:ident = $re:literal, $describe:literal, $importance:literal $(, $($rest:tt)+)?) => { ... };
    (@build_assert None) => { ... };
    (@build_assert ($offset:expr, $expected:expr, $re:literal)) => { ... };
    (@build_assert ($offset:expr, $expected:expr, |$state:ident| $func:expr)) => { ... };
    (@build_assert_tuple ($before_assert:tt, $after_assert:tt, $is_and:expr)) => { ... };
    (@build_assert_tuple ($before_assert:tt, $after_assert:tt)) => { ... };
    (@build_assert_tuple ($before_assert:tt, )) => { ... };
    (@build_assert_tuple (, $after_assert:tt)) => { ... };
    (@parse_args $name:ident, $filter:expr, $describe:literal, $importance:literal, $min_entropy:expr, $asserts:expr, $check:expr $(,)?) => { ... };
    (@parse_args $name:ident, $filter:expr, $describe:literal, $importance:literal, $min_entropy:expr, ($($asserts:tt)+), |$slice:pat_param,$input:pat_param| $check:expr $(,)?) => { ... };
    (@parse_args $name:ident, $filter:expr, $describe:literal, $importance:literal, ($($asserts:tt)+), |$slice:pat_param,$input:pat_param| $check:expr $(,)?) => { ... };
    (@parse_args $name:ident, $filter:expr, $describe:literal, $importance:literal, $min_entropy:expr, ($($asserts:tt)+) $(,)?) => { ... };
    (@parse_args $name:ident, $filter:expr, $describe:literal, $importance:literal, $min_entropy:expr, |$slice:pat_param,$input:pat_param| $check:expr $(,)?) => { ... };
    (@parse_args $name:ident, $filter:expr, $describe:literal, $importance:literal, |$slice:pat_param,$input:pat_param| $check:expr $(,)?) => { ... };
    (@parse_args $name:ident, $filter:expr, $describe:literal, $importance:literal, ($($asserts:tt)+) $(,)?) => { ... };
    (@parse_args $name:ident, $filter:expr, $describe:literal, $importance:literal, $min_entropy:expr $(,)?) => { ... };
    (@parse_args $name:ident, $filter:expr, $describe:literal, $importance:literal $(,)?) => { ... };
}

核心规则定义宏。

用于快速构建 RawRule 并自动注册到 inventory 中。 支持多种参数组合，提供从基础匹配到复杂断言校验的极简 DSL 语法。

参数排列顺序（可选参数依次向后追加）

1. $name (标识符) = $regex / |$state| { ... } : 规则名称与基础匹配逻辑
2. $describe (字符串字面量): 规则描述
3. $importance (数字): 严重程度 (0-100)
4. $min_entropy (浮点数，可选): 最低熵值要求
5. $asserts (元组，可选): 上下文断言定义 (before_assert, after_assert, is_and_optional)
6. $check (闭包，可选): 自定义校验代码 |slice, input| { bool }

断言元组语法

• 断言格式: (offset, expected, regex_or_closure)
• 空断言: None

示例

use string_analyze::lazy_rule;
use string_analyze::entropy::entropy;
lazy_rule!(
    RE_FLAG = r#"(?i)\b[a-z0-9_.-]{0,20}(?:flag|ctf)[a-z0-9\s-]{0,4}\{[^\{\}\n=\t()]{4,256}\}"#,
    "发现标准 flag",
    100
);
lazy_rule!(
    HIGH_ENTROPY = |s| if s.input.len() <= 512 && entropy(s.input.as_bytes()) >= 5.1 { s.ranges.push((0,s.input.len())); true } else { false } ,
    "发现 高熵数据",
    30
);
lazy_rule!(
    RE_BRAINFUCK = r#"(?:[<>+\-.\[\],]{20,})"#,
    "发现疑似 Brainfuck 代码",
    40,
    |slice, _input| {
        let op_types = ['>', '<', '+', '-', '.', ',', '[', ']']
            .iter()
            .filter(|&&op| slice.contains(op))
            .count();
        op_types >= 2
    }
);
lazy_rule!(
    RE_PATH_UNIX = r#"(?:~|(?:\.\./|\./)|/)[a-zA-Z0-9._-]+(?:/[a-zA-Z0-9._-]+)+"#,
    "发现 Unix 路径",
    1,
    ((8, false, r"(?i)(?:[a-z]:?|https?:/?/?)$"), ) // (前断言, 后断言)
);