Struct yara::Yara

pub struct Yara { /* fields omitted */ }

Yara initialization token.

Act as an initialization token to keep the library initialized. Not mandatory, but can reduce initialization overhead when creating and destroying Yara objects: The library is initialized each time a new object is created, unless it is already initialized. When the last Yara object is destroyed, the library is de-initialized.

{  // Initialize the library...
    let compiler = Compiler::new()?;
    // ...
} // De-initialize the library...

{  // Initialize the again library...
    let rules = Rules::load_from_file("compiled_rules.yr")?;
    // ...
} // De-initialize the library...

let _yara = Yara::new()?;
// Go on, the library will be initialized until the end of the scope.

This is also true for multithreading: before version 3.8.0 of Yara, thread allocates memory on the thread local storage for regexp. This memory is de-allocated when a scan, unless there is a living Yara object on the current thread.

Therefore, you might want to keep a Yara object alive on the threads you use to scan, to reduce allocation overhead.

let rules = Rules::load_from_file("compiled_rules.yr")?;

crossbeam::scope(|scope| {
    scope.spawn(|_| {
        // Allocate thread-local memory for scan...
        rules.scan_file("file1.bin", 10);
        // Free thread-local memory for scan...

        // Allocate thread-local memory for scan...
        rules.scan_file("file2.bin", 10);
        // Free thread-local memory for scan...

        // Memory will be freed when leaving the scope.
        let _yara = Yara::new();
        // Allocate thread-local memory for scan...
        rules.scan_file("file3.bin", 10);
        rules.scan_file("file4.bin", 10);
    });
});

Implementation notes

libyara asks to call yr_initialize before use the library. Because yara keeps a count of how many times yr_initialize is used, it doesn't matter if this struct is constructed multiple times.

Implementations

impl Yara

pub fn new() -> Result<Yara, YaraError>

Create and initialize the library.

pub fn create() -> Result<Yara, YaraError>

👎 Deprecated:

Use new

Create and initialize the library.

pub fn new_compiler(&self) -> Result<Compiler, YaraError>

👎 Deprecated:

Use Compiler::new

Create a new compiler.

pub fn load_rules(&self, filename: &str) -> Result<Rules, YaraError>

👎 Deprecated:

Use Rules::load_from_file

Load rules from a pre-compiled rules file.