yara

Mar 15, 2020

Changes in this version

+ type Meta struct

+ Identifier string

+ Value interface{}

type Rule

+ func (r *Rule) IsGlobal() bool

+ func (r *Rule) IsPrivate() bool

+ func (r *Rule) MetaList() (metas []Meta)

+ func (r *Rule) MetaMap() (metas map[string][]interface{})

+ type Scanner struct

+ func NewScanner(r *Rules) (*Scanner, error)

+ func (s *Scanner) DefineVariable(identifier string, value interface{}) (err error)

+ func (s *Scanner) Destroy()

+ func (s *Scanner) ScanFile(filename string) (matches []MatchRule, err error)

+ func (s *Scanner) ScanFileDescriptor(fd uintptr) (matches []MatchRule, err error)

+ func (s *Scanner) ScanMem(buf []byte) (matches []MatchRule, err error)

+ func (s *Scanner) ScanProc(pid int) (matches []MatchRule, err error)

+ func (s *Scanner) SetCallback(cb ScanCallback) *Scanner

+ func (s *Scanner) SetFlags(flags ScanFlags) *Scanner

+ func (s *Scanner) SetTimeout(timeout time.Duration) *Scanner

Nov 7, 2018

Changes in this version

+ func Finalize() error

+ func GetConfiguration(name ConfigName) (interface{}, error)

+ func SetConfiguration(name ConfigName, src interface{}) error

+ type ConfigName uint32

+ const ConfigMaxMatchData

+ const ConfigMaxStringsPerRule

+ const ConfigStackSize

Feb 14, 2018

Changes in this version

+ type MatchRules []MatchRule

+ func (mr *MatchRules) RuleMatching(r *Rule) (abort bool, err error)

+ type Object struct

type Rules

+ func (r *Rules) ScanFileDescriptorWithCallback(fd uintptr, flags ScanFlags, timeout time.Duration, cb ScanCallback) (err error)

+ func (r *Rules) ScanFileWithCallback(filename string, flags ScanFlags, timeout time.Duration, cb ScanCallback) (err error)

+ func (r *Rules) ScanMemWithCallback(buf []byte, flags ScanFlags, timeout time.Duration, cb ScanCallback) (err error)

+ func (r *Rules) ScanProcWithCallback(pid int, flags ScanFlags, timeout time.Duration, cb ScanCallback) (err error)

+ type ScanCallback interface

+ type ScanCallbackFinished interface

+ ScanFinished func() (bool, error)

+ type ScanCallbackMatch interface

+ RuleMatching func(*Rule) (bool, error)

+ type ScanCallbackModuleImport interface

+ ImportModule func(string) ([]byte, bool, error)

+ type ScanCallbackModuleImportFinished interface

+ ModuleImported func(*Object) (bool, error)

+ type ScanCallbackNoMatch interface

+ RuleNotMatching func(*Rule) (bool, error)

Jan 28, 2018

Changes in this version

+ type Match struct

+ func (m *Match) Data() []byte

+ func (m *Match) Offset() int64

type Rule

+ func (r *Rule) Strings() (strs []String)

+ type String struct

+ func (s *String) Identifier() string

+ func (s *String) Matches() (matches []Match)

Nov 28, 2017

Changes in this version

type Compiler

+ func (c *Compiler) DisableIncludes()

+ func (c *Compiler) SetIncludeCallback(cb CompilerIncludeFunc)

+ type CompilerIncludeFunc func(name, filename, namespace string) []byte

+ type Rule struct

+ func (r *Rule) Disable()

+ func (r *Rule) Enable()

+ func (r *Rule) Identifier() string

+ func (r *Rule) Metas() (metas map[string]interface{})

+ func (r *Rule) Namespace() string

+ func (r *Rule) Tags() (tags []string)

type Rules

+ func (r *Rules) GetRules() (rv []Rule)

Aug 13, 2016

Changes in this version

+ const ScanFlagsFastMode

+ const ScanFlagsProcessMemory

+ type Compiler struct

+ Errors []CompilerMessage

+ Warnings []CompilerMessage

+ func NewCompiler() (*Compiler, error)

+ func (c *Compiler) AddFile(file *os.File, namespace string) (err error)

+ func (c *Compiler) AddString(rules string, namespace string) (err error)

+ func (c *Compiler) DefineVariable(name string, value interface{}) (err error)

+ func (c *Compiler) Destroy()

+ func (c *Compiler) GetRules() (*Rules, error)

+ type CompilerMessage struct

+ Filename string

+ Line int

+ Text string

+ type MatchRule struct

+ Meta map[string]interface{}

+ Namespace string

+ Rule string

+ Strings []MatchString

+ Tags []string

+ type MatchString struct

+ Data []byte

+ Name string

+ Offset uint64

+ type Rules struct

+ func Compile(rules string, variables map[string]interface{}) (r *Rules, err error)

+ func LoadRules(filename string) (*Rules, error)

+ func MustCompile(rules string, variables map[string]interface{}) (r *Rules)

+ func ReadRules(rd io.Reader) (*Rules, error)

+ func (r *Rules) DefineVariable(name string, value interface{}) (err error)

+ func (r *Rules) Destroy()

+ func (r *Rules) Save(filename string) (err error)

+ func (r *Rules) ScanFile(filename string, flags ScanFlags, timeout time.Duration) (matches []MatchRule, err error)

+ func (r *Rules) ScanFileDescriptor(fd uintptr, flags ScanFlags, timeout time.Duration) (matches []MatchRule, err error)

+ func (r *Rules) ScanMem(buf []byte, flags ScanFlags, timeout time.Duration) (matches []MatchRule, err error)

+ func (r *Rules) ScanProc(pid int, flags int, timeout time.Duration) (matches []MatchRule, err error)

+ func (r *Rules) Write(wr io.Writer) (err error)

+ type ScanFlags int