diff --git a/README.md b/README.md index 583d729..d80532c 100644 --- a/README.md +++ b/README.md @@ -24,11 +24,14 @@ const RULES: &str = r#" fn main() { let compiler = Compiler::new().unwrap(); - compiler.add_rules_str(RULES) + let compiler = compiler + .add_rules_str(RULES) .expect("Should have parsed rule"); - let rules = compiler.compile_rules() + let rules = compiler + .compile_rules() .expect("Should have compiled rules"); - let results = rules.scan_mem("I love Rust!".as_bytes(), 5) + let results = rules + .scan_mem("I love Rust!".as_bytes(), 5) .expect("Should have scanned"); assert!(results.iter().any(|r| r.identifier == "contains_rust")); } diff --git a/examples/tutorial.rs b/examples/tutorial.rs new file mode 100644 index 0000000..a0d1552 --- /dev/null +++ b/examples/tutorial.rs @@ -0,0 +1,24 @@ +use yara::Compiler; + +const RULES: &str = r#" + rule contains_rust { + strings: + $rust = "rust" nocase + condition: + $rust + } +"#; + +fn main() { + let compiler = Compiler::new().unwrap(); + let compiler = compiler + .add_rules_str(RULES) + .expect("Should have parsed rule"); + let rules = compiler + .compile_rules() + .expect("Should have compiled rules"); + let results = rules + .scan_mem("I love Rust!".as_bytes(), 5) + .expect("Should have scanned"); + assert!(results.iter().any(|r| r.identifier == "contains_rust")); +}