boreal-parser

此crate提供YARA文件的解析器。

概述

此crate旨在由boreal crate使用，该crate实现了YARA规则的评估。

支持的YARA版本

处理了YARA 4.5版本中所有可用的功能。

lib.rs:

YARA规则的解析器。

此crate旨在由boreal crate使用。

它公开了一个主入口点函数，parse，该函数解析YARA文件的内容。

use boreal_parser::*;
use boreal_parser::expression::*;
use boreal_parser::file::*;
use boreal_parser::rule::*;

let file = parse(r#"
import "pe"

private rule b : tag1 {
    meta:
        a = true
    strings:
        $b = "\\mspaint.exe" wide
    condition:
        pe.is_dll() and all of them
}"#)?;

assert_eq!(
    file.components[0],
    YaraFileComponent::Import(Import {
        name: "pe".to_owned(),
        span: 1..12,
    })
);
assert_eq!(
    file.components[1],
    YaraFileComponent::Rule(Box::new(Rule {
        name: "b".to_owned(),
        name_span: 27..28,
        tags: vec![RuleTag {
            tag: "tag1".to_owned(),
            span: 31..35
        }],
        metadatas: vec![Metadata {
            name: "a".to_owned(),
            value: MetadataValue::Boolean(true)
        }],
        variables: vec![VariableDeclaration {
            name: "b".to_owned(),
            value: VariableDeclarationValue::Bytes(b"\\mspaint.exe".to_vec()),
            modifiers: VariableModifiers {
                wide: true,
                ..Default::default()
            },
            span: 86..111,
        }],

        condition: Expression {
            expr: ExpressionKind::And(vec![
                Expression {
                    expr: ExpressionKind::Identifier(Identifier {
                        name: "pe".to_owned(),
                        name_span: 135..137,
                        operations: vec![
                            IdentifierOperation {
                                op: IdentifierOperationType::Subfield(
                                    "is_dll".to_owned()
                                ),
                                span: 137..144,
                            },
                            IdentifierOperation {
                                op: IdentifierOperationType::FunctionCall(vec![]),
                                span: 144..146,
                            }
                        ],
                    }),
                    span: 135..146,
                },
                Expression {
                    expr: ExpressionKind::For {
                        selection: ForSelection::All,
                        set: VariableSet { elements: vec![] },

                        body: None,
                    },
                    span: 151..162,
                }
            ]),
            span: 135..162
        },
        is_private: true,
        is_global: false,
    }))
);