Skip to content

muteb/yara-rust

This branch is 1 commit ahead of, 26 commits behind Hugal31/yara-rust:refs/heads/master.

Folders and files

NameName
Last commit message
Last commit date

Latest commit

580a4be · Dec 16, 2023
Aug 3, 2023
Nov 26, 2023
Nov 27, 2023
Apr 4, 2023
Dec 16, 2023
May 11, 2018
Apr 23, 2021
Jun 6, 2022
Nov 29, 2023
Nov 29, 2023
May 13, 2018
May 13, 2018
Jun 21, 2022

Repository files navigation

yara-rust

Tests Status Crates.io Documentation

Bindings for the Yara library from VirusTotal.

More documentation can be found on the Yara's documentation.

Example

The implementation is inspired from yara-python.

const RULES: &str = r#"
    rule contains_rust {
      strings:
        $rust = "rust" nocase
      condition:
        $rust
    }
"#;

fn main() {
    let compiler = Compiler::new().unwrap();
    let compiler = compiler
        .add_rules_str(RULES)
        .expect("Should have parsed rule");
    let rules = compiler
        .compile_rules()
        .expect("Should have compiled rules");
    let results = rules
        .scan_mem("I love Rust!".as_bytes(), 5)
        .expect("Should have scanned");
    assert!(results.iter().any(|r| r.identifier == "contains_rust"));
}

Features

  • Support from Yara v4.1.
  • Compile rules from strings or files.
  • Save and load compiled rules.
  • Scan byte arrays (&[u8]) or files.

Feature flags and Yara linking.

Look at the yara-sys crate documentation for a list of feature flags and how to link to your Yara crate.

TODO

  • Remove some unwrap on string conversions (currently this crate assume the rules, meta and namespace identifier are valid Rust's str).
  • Accept AsRef<Path> instead of &str on multiple functions.
  • Implement the scanner API.
  • Add process scanning.
  • Report the warnings to the user.

License

Licensed under either of

at your option.

Contributing

Please follow the conventional commit rules when committing to this repository.

If you add any new feature, add the corresponding unit/doc tests.

About

Rust bindings for VirusTotal/Yara

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Rust 100.0%