retdec
Functions
modifications.cpp File Reference

Rule manipulation functions for yara patterns filter. More...

#include <set>
#include "pat2yara/compare.h"
#include "pat2yara/modifications.h"
#include "pat2yara/utils.h"
#include "yaramod/builder/yara_expression_builder.h"
#include "yaramod/builder/yara_file_builder.h"
#include "yaramod/builder/yara_rule_builder.h"
#include "yaramod/types/rule.h"

Functions

std::unique_ptr< Rule > createArchitectureRule (const yaramod::Rule *rule)
 
std::unique_ptr< Rule > createLogRule (const yaramod::Rule *rule, const std::string &reason="")
 
std::shared_ptr< HexString > cutHexString (const std::shared_ptr< HexString > &hexString, std::size_t limit)
 
std::string cutStringWhitespace (const std::string &inputString, std::size_t limit)
 
void filterMetaSection (YaraRuleBuilder &builder, const Rule *rule)
 
void copyRuleToBuilder (YaraRuleBuilder &builder, const Rule *rule)
 
void packDelhpi (yaramod::YaraFileBuilder &builder, const RuleRelations &alternativeRules)
 

Detailed Description

Rule manipulation functions for yara patterns filter.

Function Documentation

◆ copyRuleToBuilder()

void copyRuleToBuilder ( YaraRuleBuilder &  builder,
const Rule *  rule 
)

Copy rule to new builder.

Only metas copied are name, size, note and references (cut to refs).

Parameters
buildertarget rule builder
rulesource rule

◆ createArchitectureRule()

std::unique_ptr<Rule> createArchitectureRule ( const yaramod::Rule *  rule)

Create architecture rule from another rule.

Parameters
rulesource rule (usually first rule from input file)
Returns
private empty rule with architecture information only

◆ createLogRule()

std::unique_ptr<Rule> createLogRule ( const yaramod::Rule *  rule,
const std::string &  reason = "" 
)

Create log-file rule from another rule.

Parameters
rulesource rule (usually rule that is being removed)
reasonreason of rule being removed
Returns
rule for log-file

◆ cutHexString()

std::shared_ptr<HexString> cutHexString ( const std::shared_ptr< HexString > &  hexString,
std::size_t  limit 
)

Create new HexString with limited size.

Parameters
hexStringoriginal HexString
limitmaximal size in bytes
Returns
shortened HexString

◆ cutStringWhitespace()

std::string cutStringWhitespace ( const std::string &  inputString,
std::size_t  limit 
)

Cut string before limit but on whitespace.

Parameters
inputStringoriginal string
limitmaximal string size
Returns
shortened string

◆ filterMetaSection()

void filterMetaSection ( YaraRuleBuilder &  builder,
const Rule *  rule 
)

Add necessary meta attributes to new rule builder.

Parameters
buildertarget rule builder
rulesource rule

◆ packDelhpi()

void packDelhpi ( yaramod::YaraFileBuilder &  builder,
const RuleRelations alternativeRules 
)

Pack Delphi template names to simple format Class<T>.Method or similar.

Parameters
buildertarget for final rule
alternativeRulesrule with name and its alternatives