Struct yara::Compiler

pub struct Compiler { /* fields omitted */ }

Yara rules compiler

Implementations

impl Compiler

pub fn new() -> Result<Self, YaraError>

Create a new compiler.

pub fn add_rules_file<P: AsRef<Path>>(&mut self, path: P) -> Result<(), Error>

Add rules definitions from a file.

Example

let mut compiler = Compiler::new()?;
compiler.add_rules_file("rules.txt")?;

pub fn add_rules_file_with_namespace<P: AsRef<Path>>(
    &mut self,
    path: P,
    namespace: &str
) -> Result<(), Error>

Add rule definitions from a file within a namespace.

Example

let mut compiler = Compiler::new().unwrap();
let rules = compiler.add_rules_file_with_namespace("CVE-2010-1297.yar", "flash")?;

pub fn add_rules_str(&mut self, rule: &str) -> Result<(), Error>

Add rule definitions from a string.

Example

let mut compiler = Compiler::new()?;
let rules = compiler.add_rules_str("rule is_empty {
  condition:
    filesize == 0
}")?;

pub fn add_rules_str_with_namespace(
    &mut self,
    rule: &str,
    namespace: &str
) -> Result<(), Error>

Add rule definition from a string within a namespace.

Example

let mut compiler = Compiler::new()?;
compiler.add_rules_str_with_namespace("rule is_empty {
  condition:
    filesize == 0
}", "misc")?;

pub fn compile_rules(self) -> Result<Rules, YaraError>

Compile the rules.

Consume the compiler.

Implementation notes

It is safe to destroy the compiler after, because the rules do not depends on the compiler. In addition, we must hide the compiler from the user because it can be used only once.

pub fn define_variable<V: CompilerVariableValue>(
    &mut self,
    identifier: &str,
    value: V
) -> Result<(), YaraError>

Add a variable to the compiler.

Valid types are bool, i64, f64, str and cstr.

Note: You must define all the external variables before adding rules to compile.

Example

let mut compiler = Compiler::new().unwrap();
// Add the variables
compiler.define_variable("file_name", "thing.txt")?;
compiler.define_variable("answer", 42)?;
compiler.define_variable("pi", 3.14)?;
compiler.define_variable("is_a_test", true)?;
// Use them in rules
compiler.add_rules_str(r#"
rule TestExternalVariables {
  condition:
    file_name == "thing.txt"
        and answer == 42
        and pi == 3.14
        and is_a_test
}
"#)?;

Trait Implementations

impl Drop for Compiler

pub fn drop(&mut self)

Executes the destructor for this type.