#include <yara_detector.h>
◆ YaraDetector()
retdec::yaracpp::YaraDetector::YaraDetector |
( |
| ) |
|
◆ ~YaraDetector()
retdec::yaracpp::YaraDetector::~YaraDetector |
( |
| ) |
|
◆ addRuleFile()
bool retdec::yaracpp::YaraDetector::addRuleFile |
( |
const std::string & |
pathToFile, |
|
|
const std::string & |
nameSpace = std::string() |
|
) |
| |
Add external file with text rules
- Parameters
-
pathToFile | Path to rule file |
nameSpace | Namespace to use for the given rule file. If the file is already compiled, this has no effect. If it is a text file, this allows to have multiple rules with the same ID across multiple rule files. |
◆ addRules()
bool retdec::yaracpp::YaraDetector::addRules |
( |
const char * |
string | ) |
|
Add text rules to compiler
- Parameters
-
◆ analyze() [1/2]
bool retdec::yaracpp::YaraDetector::analyze |
( |
const std::string & |
pathToInputFile, |
|
|
bool |
storeAllRules = false |
|
) |
| |
Analyze input file
- Parameters
-
pathToInputFile | Path to input file |
storeAllRules | If this parameter is set to true , store all rules (not only detected) |
- Returns
true
if analysis completed without any error, otherwise false
.
◆ analyze() [2/2]
bool retdec::yaracpp::YaraDetector::analyze |
( |
std::vector< std::uint8_t > & |
bytes, |
|
|
bool |
storeAllRules = false |
|
) |
| |
Analyze input bytes
- Parameters
-
bytes | Vector of input bytes |
storeAllRules | If this parameter is set to true , store all rules (not only detected) |
- Returns
true
if analysis completed without any error, otherwise false
.
◆ analyzeWithScan()
template<typename T >
bool retdec::yaracpp::YaraDetector::analyzeWithScan |
( |
T && |
value, |
|
|
bool |
storeAllRules = false |
|
) |
| |
|
private |
Analyze input sequence
- Parameters
-
value | Value to analyze |
storeAllRules | If this parameter is set to true , store all rules (not only detected) |
- Returns
true
if analysis completed without any error, otherwise false
.
◆ getCompiledRules()
YR_RULES * retdec::yaracpp::YaraDetector::getCompiledRules |
( |
| ) |
|
|
private |
Returns the compiled rules from text files.
- Returns
- Compiled rules.
◆ getDetectedRules()
const std::vector< YaraRule > & retdec::yaracpp::YaraDetector::getDetectedRules |
( |
| ) |
const |
Get detected rules
- Returns
- Detected rules
◆ getUndetectedRules()
const std::vector< YaraRule > & retdec::yaracpp::YaraDetector::getUndetectedRules |
( |
| ) |
const |
Get undetected rules
- Returns
- Undetected rules
◆ isInValidState()
bool retdec::yaracpp::YaraDetector::isInValidState |
( |
| ) |
const |
Getter for state of instance
- Returns
true
if all is OK, false
otherwise
◆ yaraCallback()
int retdec::yaracpp::YaraDetector::yaraCallback |
( |
YR_SCAN_CONTEXT * |
context, |
|
|
int |
message, |
|
|
void * |
messageData, |
|
|
void * |
userData |
|
) |
| |
|
staticprivate |
Callback function for scanning of input file
- Parameters
-
context | YARA context |
message | Type of message from libyara |
messageData | Content of message |
userData | Pointer for save information about detected rules |
- Returns
- Instruction for the next scan
Read libyara documentation for more detailed information about callback function
◆ compiler
YR_COMPILER* retdec::yaracpp::YaraDetector::compiler = nullptr |
|
private |
◆ detectedRules
std::vector<YaraRule> retdec::yaracpp::YaraDetector::detectedRules |
|
private |
representation of detected rules
◆ files
std::vector<FILE*> retdec::yaracpp::YaraDetector::files |
|
private |
representation of files with rules
◆ needsRecompilation
bool retdec::yaracpp::YaraDetector::needsRecompilation = true |
|
private |
indicates whether text files need recompilation
◆ precompiledRules
std::vector<YR_RULES*> retdec::yaracpp::YaraDetector::precompiledRules |
|
private |
rules from precompiled files
◆ stateIsValid
bool retdec::yaracpp::YaraDetector::stateIsValid = true |
|
private |
internal state of instance
◆ textFilesRules
YR_RULES* retdec::yaracpp::YaraDetector::textFilesRules = nullptr |
|
private |
rules from input text files
◆ undetectedRules
std::vector<YaraRule> retdec::yaracpp::YaraDetector::undetectedRules |
|
private |
representation of undetected rules
The documentation for this class was generated from the following files: