retdec
|
Rule manipulation functions for yara patterns filter. More...
#include <set>
#include "pat2yara/compare.h"
#include "pat2yara/modifications.h"
#include "pat2yara/utils.h"
#include "yaramod/builder/yara_expression_builder.h"
#include "yaramod/builder/yara_file_builder.h"
#include "yaramod/builder/yara_rule_builder.h"
#include "yaramod/types/rule.h"
Functions | |
std::unique_ptr< Rule > | createArchitectureRule (const yaramod::Rule *rule) |
std::unique_ptr< Rule > | createLogRule (const yaramod::Rule *rule, const std::string &reason="") |
std::shared_ptr< HexString > | cutHexString (const std::shared_ptr< HexString > &hexString, std::size_t limit) |
std::string | cutStringWhitespace (const std::string &inputString, std::size_t limit) |
void | filterMetaSection (YaraRuleBuilder &builder, const Rule *rule) |
void | copyRuleToBuilder (YaraRuleBuilder &builder, const Rule *rule) |
void | packDelhpi (yaramod::YaraFileBuilder &builder, const RuleRelations &alternativeRules) |
Rule manipulation functions for yara patterns filter.
void copyRuleToBuilder | ( | YaraRuleBuilder & | builder, |
const Rule * | rule | ||
) |
Copy rule to new builder.
Only metas copied are name, size, note and references (cut to refs).
builder | target rule builder |
rule | source rule |
std::unique_ptr<Rule> createArchitectureRule | ( | const yaramod::Rule * | rule | ) |
Create architecture rule from another rule.
rule | source rule (usually first rule from input file) |
std::unique_ptr<Rule> createLogRule | ( | const yaramod::Rule * | rule, |
const std::string & | reason = "" |
||
) |
Create log-file rule from another rule.
rule | source rule (usually rule that is being removed) |
reason | reason of rule being removed |
std::shared_ptr<HexString> cutHexString | ( | const std::shared_ptr< HexString > & | hexString, |
std::size_t | limit | ||
) |
Create new HexString with limited size.
hexString | original HexString |
limit | maximal size in bytes |
std::string cutStringWhitespace | ( | const std::string & | inputString, |
std::size_t | limit | ||
) |
Cut string before limit but on whitespace.
inputString | original string |
limit | maximal string size |
void filterMetaSection | ( | YaraRuleBuilder & | builder, |
const Rule * | rule | ||
) |
Add necessary meta attributes to new rule builder.
builder | target rule builder |
rule | source rule |
void packDelhpi | ( | yaramod::YaraFileBuilder & | builder, |
const RuleRelations & | alternativeRules | ||
) |
Pack Delphi template names to simple format Class<T>.Method or similar.
builder | target for final rule |
alternativeRules | rule with name and its alternatives |