7 #ifndef RETDEC_YARACPP_YARA_DETECTOR_H
8 #define RETDEC_YARACPP_YARA_DETECTOR_H
11 #include <unordered_map>
44 std::vector<YaraRule> &cDetected,
45 std::vector<YaraRule> &cUndetected
59 const std::string& pathToFile_,
104 bool storeAllRules =
false
116 const std::string &pathToFile,
117 const std::string &nameSpace = std::string()
125 const std::string &pathToInputFile,
126 bool storeAllRules =
false
129 std::vector<std::uint8_t> &bytes,
130 bool storeAllRules =
false
Definition: yara_detector.h:33
bool storeAllRules() const
Definition: yara_detector.cpp:174
void addDetected(YaraRule &rule)
Definition: yara_detector.cpp:156
CallbackSettings(bool cStoreAll, std::vector< YaraRule > &cDetected, std::vector< YaraRule > &cUndetected)
Definition: yara_detector.cpp:141
std::vector< YaraRule > & storedDetected
link to detected rules
Definition: yara_detector.h:38
bool storeAll
set to true if you want store all rules (not only detected)
Definition: yara_detector.h:36
void addUndetected(YaraRule &rule)
Definition: yara_detector.cpp:165
std::vector< YaraRule > & storedUndetected
link to undetected rules
Definition: yara_detector.h:40
Definition: yara_detector.h:27
bool analyzeWithScan(T &&value, bool storeAllRules=false)
Definition: yara_detector.cpp:392
const std::vector< YaraRule > & getDetectedRules() const
Definition: yara_detector.cpp:370
bool needsRecompilation
indicates whether text files need recompilation
Definition: yara_detector.h:88
std::vector< YaraRule > detectedRules
representation of detected rules
Definition: yara_detector.h:78
YaraDetector()
Definition: yara_detector.cpp:94
~YaraDetector()
Definition: yara_detector.cpp:105
YR_COMPILER * compiler
compiler or text rules
Definition: yara_detector.h:74
std::vector< YaraRule > undetectedRules
representation of undetected rules
Definition: yara_detector.h:80
bool addRuleFile(const std::string &pathToFile, const std::string &nameSpace=std::string())
Definition: yara_detector.cpp:300
std::vector< FILE * > files
representation of files with rules
Definition: yara_detector.h:76
static int yaraCallback(YR_SCAN_CONTEXT *context, int message, void *messageData, void *userData)
Definition: yara_detector.cpp:190
bool analyze(const std::string &pathToInputFile, bool storeAllRules=false)
Definition: yara_detector.cpp:347
bool stateIsValid
internal state of instance
Definition: yara_detector.h:86
bool isInValidState() const
Definition: yara_detector.cpp:335
YR_RULES * getCompiledRules()
Definition: yara_detector.cpp:420
const std::vector< YaraRule > & getUndetectedRules() const
Definition: yara_detector.cpp:379
bool addRules(const char *string)
Definition: yara_detector.cpp:284
YR_RULES * textFilesRules
rules from input text files
Definition: yara_detector.h:82
std::vector< YR_RULES * > precompiledRules
rules from precompiled files
Definition: yara_detector.h:84
Definition: yara_rule.h:23
Definition: archive_wrapper.h:19
Definition: yara_detector.h:57
bool precompiled
Definition: yara_detector.h:68
std::string pathToFile
Definition: yara_detector.h:67
RuleFile(const std::string &pathToFile_, bool precompiled_, FILE *handle_)
Definition: yara_detector.h:58
FILE * handle
Definition: yara_detector.h:69
struct YR_SCAN_CONTEXT YR_SCAN_CONTEXT
Definition: yara_detector.h:18
struct YR_RULES YR_RULES
Definition: yara_detector.h:17
struct _YR_COMPILER YR_COMPILER
Definition: yara_detector.h:16
Library representation of one YARA rule.