yara

Documentation

Index

• type Scanner
  • func NewScanner(psnap ps.Snapshotter, config config.Config) (Scanner, error)

Types

type Scanner

type Scanner interface {
	// ScanProc scans process memory.
	ScanProc(pid uint32, kevt *kevent.Kevent) error
	// ScanFile scans the specified file in the file system.
	ScanFile(filename string, kevt *kevent.Kevent) error
	// Close disposes any resources allocated by scanner.
	Close()
}

Scanner watches for certain kernel events such as process creation or image loading and triggers the scanning either of the target process or image file. If matches occur, an alert is emitted via specified alert sender.

func NewScanner

func NewScanner(psnap ps.Snapshotter, config config.Config) (Scanner, error)

NewScanner returns unsupported scanner error.