Rule manipulation functions for yara patterns filter.
More...
#include <memory>
#include <string>
Go to the source code of this file.
|
std::unique_ptr< yaramod::Rule > | createArchitectureRule (const yaramod::Rule *rule) |
|
std::unique_ptr< yaramod::Rule > | createLogRule (const yaramod::Rule *rule, const std::string &reason) |
|
std::shared_ptr< yaramod::HexString > | cutHexString (const std::shared_ptr< yaramod::HexString > &hexString, std::size_t limit) |
|
std::string | cutStringWhitespace (const std::string &inputString, std::size_t limit) |
|
void | filterMetaSection (yaramod::YaraRuleBuilder &builder, const yaramod::Rule *rule) |
|
void | copyRuleToBuilder (yaramod::YaraRuleBuilder &builder, const yaramod::Rule *rule) |
|
void | packDelhpi (yaramod::YaraFileBuilder &builder, const RuleRelations &alternativeRules) |
|
Rule manipulation functions for yara patterns filter.
- Copyright
- (c) 2017 Avast Software, licensed under the MIT license
◆ copyRuleToBuilder()
void copyRuleToBuilder |
( |
yaramod::YaraRuleBuilder & |
builder, |
|
|
const yaramod::Rule * |
rule |
|
) |
| |
◆ createArchitectureRule()
std::unique_ptr<yaramod::Rule> createArchitectureRule |
( |
const yaramod::Rule * |
rule | ) |
|
Create architecture rule from another rule.
- Parameters
-
rule | source rule (usually first rule from input file) |
- Returns
- private empty rule with architecture information only
◆ createLogRule()
std::unique_ptr<yaramod::Rule> createLogRule |
( |
const yaramod::Rule * |
rule, |
|
|
const std::string & |
reason = "" |
|
) |
| |
Create log-file rule from another rule.
- Parameters
-
rule | source rule (usually rule that is being removed) |
reason | reason of rule being removed |
- Returns
- rule for log-file
◆ cutHexString()
std::shared_ptr<yaramod::HexString> cutHexString |
( |
const std::shared_ptr< yaramod::HexString > & |
hexString, |
|
|
std::size_t |
limit |
|
) |
| |
◆ cutStringWhitespace()
std::string cutStringWhitespace |
( |
const std::string & |
inputString, |
|
|
std::size_t |
limit |
|
) |
| |
Cut string before limit but on whitespace.
- Parameters
-
inputString | original string |
limit | maximal string size |
- Returns
- shortened string
◆ filterMetaSection()
void filterMetaSection |
( |
yaramod::YaraRuleBuilder & |
builder, |
|
|
const yaramod::Rule * |
rule |
|
) |
| |
◆ packDelhpi()
void packDelhpi |
( |
yaramod::YaraFileBuilder & |
builder, |
|
|
const RuleRelations & |
alternativeRules |
|
) |
| |
Pack Delphi template names to simple format Class<T>.Method or similar.
- Parameters
-
builder | target for final rule |
alternativeRules | rule with name and its alternatives |
◆ YARA_BUF_SIZE
constexpr std::size_t YARA_BUF_SIZE = 8000 |
|
constexpr |