gora

Documentation

Index

• Variables
• type Compiled
  • func NewCompiled() *Compiled
  • func (c *Compiled) CompileDir(target ScanTarget, filenameNS bool, dir string) error
  • func (c *Compiled) CompileFileOrDir(target ScanTarget, filenameNS bool, path string) error
  • func (c *Compiled) CompileFiles(target ScanTarget, filenameNS bool, paths ...string) error
  • func (c *Compiled) CompileString(target ScanTarget, rule, namespace string) error
  • func (c *Compiled) CompileStrings(target ScanTarget, ruleNs []RuleNamespace) error
  • func (c *Compiled) CreateScanner() error
  • func (c *Compiled) DefineScannerVariables(sctx variables.ScanContext) error
  • func (c *Compiled) Destroy()
  • func (c *Compiled) Rules() *yara.Rules
  • func (c *Compiled) ScanFile(filename string) error
  • func (c *Compiled) ScanFileDescriptor(fd uintptr) error
  • func (c *Compiled) ScanProc(pid int) error
  • func (c *Compiled) Scanner() *yara.Scanner
  • func (c *Compiled) SetCallback(cb yara.ScanCallback) *Compiled
  • func (c *Compiled) Variables() *variables.Variables
• type RuleNamespace
• type ScanTarget

Variables

var ErrAlreadyCompiled = errors.New("already compiled")

Types

type Compiled

type Compiled struct {
	// contains filtered or unexported fields
}

Compiled holds the compiled rules and its associated external variables.

func NewCompiled

func NewCompiled() *Compiled

func (*Compiled) CompileDir

func (c *Compiled) CompileDir(target ScanTarget, filenameNS bool, dir string) error

CompileDir compiles the YARA rules in the given directory and sets namespace of each file by cleaning file name(s).

func (*Compiled) CompileFileOrDir

func (c *Compiled) CompileFileOrDir(target ScanTarget, filenameNS bool, path string) error

CompileRulesFileOrDir compiles the YARA rules in the given directory or single file, and sets namespace of each file by cleaning file name(s).

func (*Compiled) CompileFiles

func (c *Compiled) CompileFiles(target ScanTarget, filenameNS bool, paths ...string) error

CompileFiles compiles the YARA rules in the given file paths, sets namespace of each file by cleaning file name(s).

func (*Compiled) CompileString

func (c *Compiled) CompileString(target ScanTarget, rule, namespace string) error

CompileString compiles the YARA rules.

func (*Compiled) CompileStrings

func (c *Compiled) CompileStrings(target ScanTarget, ruleNs []RuleNamespace) error

CompileStrings compiles the YARA rules.

func (*Compiled) CreateScanner

func (c *Compiled) CreateScanner() error

func (*Compiled) DefineScannerVariables

func (c *Compiled) DefineScannerVariables(sctx variables.ScanContext) error

func (*Compiled) Destroy

func (c *Compiled) Destroy()

func (*Compiled) Rules

func (c *Compiled) Rules() *yara.Rules

func (*Compiled) ScanFile

func (c *Compiled) ScanFile(filename string) error

func (*Compiled) ScanFileDescriptor

func (c *Compiled) ScanFileDescriptor(fd uintptr) error

func (*Compiled) ScanProc

func (c *Compiled) ScanProc(pid int) error

func (*Compiled) Scanner

func (c *Compiled) Scanner() *yara.Scanner

func (*Compiled) SetCallback

func (c *Compiled) SetCallback(cb yara.ScanCallback) *Compiled

func (*Compiled) Variables

func (c *Compiled) Variables() *variables.Variables

type RuleNamespace

type RuleNamespace struct {
	Rule      string
	Namespace string
}

RuleNamespace represents a rule and its namespace.

type ScanTarget

type ScanTarget byte

ScanTarget represents a target for yara scan.

const (
	ScanFile ScanTarget = iota
	ScanProcess
)

Scan targets are file system and process memory.