exec

Documentation

Index

• Constants
• func ACNext(matches []*[]int, nodes []*ACNode, input []byte)
• func ACNextNocase(matches []*[]int, nodes []*ACNode, input []byte)
• func Eval(rule *CompiledRule, matches []*[]int, static []int64) (int64, error)
• func ToLower(b byte) byte
• type ACNode
  • func ACBuild(patterns []*Pattern) []*ACNode
• type CompiledRule
• type CompiledRules
  • func Compile(input string) (*CompiledRules, error)
  • func (c *CompiledRules) Debug()
  • func (c *CompiledRules) Scan(input []byte, s bool, timeout int) ([]*ScanOutput, error)
• type Op
  • func (o Op) String() string
• type Pattern
• type ScanOutput

Constants

const (
	LOADCOUNT = iota
	LOADOFFSET
	LOADSTATIC
	PUSH
	AND
	OR
	EQUAL
	NOTEQUAL
	GT
	GTE
	LT
	LTE
	ADD
	MINUS
	MINUSU
	BAND
	BOR
	BXOR
	SHIFTLEFT
	SHIFTRIGHT
	AT
	IN
	OF
	MOVR
	ADDR
	INCR
	DECR
	PUSHR
	LOOP
	CLEAR
)

const (
	RC = iota
	REG1
	REG2
	REG3
)

Functions

func ACNext

func ACNext(matches []*[]int, nodes []*ACNode, input []byte)

ACNext will perform a single byte transition of the automata, returning any indexes where a pattern is hit

func ACNextNocase

func ACNextNocase(matches []*[]int, nodes []*ACNode, input []byte)

func Eval

func Eval(rule *CompiledRule, matches []*[]int, static []int64) (int64, error)

func ToLower

func ToLower(b byte) byte

Types

type ACNode

type ACNode struct {
	// contains filtered or unexported fields
}

func ACBuild

func ACBuild(patterns []*Pattern) []*ACNode

type CompiledRule

type CompiledRule struct {
	// contains filtered or unexported fields
}

type CompiledRules

type CompiledRules struct {
	// contains filtered or unexported fields
}

func Compile

func Compile(input string) (*CompiledRules, error)

Compile an input Yara rule(s) and create both the pattern objects that will be matched on, add the patterns to the aho-corasick automatons, and create the instructions to evaluate each rule

func (*CompiledRules) Debug

func (c *CompiledRules) Debug()

func (*CompiledRules) Scan

func (c *CompiledRules) Scan(input []byte, s bool, timeout int) ([]*ScanOutput, error)

type Op

type Op struct {
	OpCode   int
	IntParam int64
}

func (Op) String

func (o Op) String() string

type Pattern

type Pattern struct {
	Name string
	// pattern to be used in the automta
	Pattern []byte
	// what rule this pattern is tied to.
	MatchIndex int
	// if Pattern is not the complete string, full match is the
	// complete string with 0x10000 as place holders for bytes with ??
	FullMatch []int
	IsPartial bool
	Re        *regexp.Regexp
}

type ScanOutput

type ScanOutput struct {
	Name string
	Tags []string
}