retdec
Namespaces | Functions | Variables
modifications.h File Reference

Rule manipulation functions for yara patterns filter. More...

#include <memory>
#include <string>

Go to the source code of this file.

Namespaces

 yaramod
 

Functions

std::unique_ptr< yaramod::Rule > createArchitectureRule (const yaramod::Rule *rule)
 
std::unique_ptr< yaramod::Rule > createLogRule (const yaramod::Rule *rule, const std::string &reason)
 
std::shared_ptr< yaramod::HexString > cutHexString (const std::shared_ptr< yaramod::HexString > &hexString, std::size_t limit)
 
std::string cutStringWhitespace (const std::string &inputString, std::size_t limit)
 
void filterMetaSection (yaramod::YaraRuleBuilder &builder, const yaramod::Rule *rule)
 
void copyRuleToBuilder (yaramod::YaraRuleBuilder &builder, const yaramod::Rule *rule)
 
void packDelhpi (yaramod::YaraFileBuilder &builder, const RuleRelations &alternativeRules)
 

Variables

constexpr std::size_t YARA_BUF_SIZE = 8000
 

Detailed Description

Rule manipulation functions for yara patterns filter.

Function Documentation

◆ copyRuleToBuilder()

void copyRuleToBuilder ( yaramod::YaraRuleBuilder &  builder,
const yaramod::Rule *  rule 
)

◆ createArchitectureRule()

std::unique_ptr<yaramod::Rule> createArchitectureRule ( const yaramod::Rule *  rule)

Create architecture rule from another rule.

Parameters
rulesource rule (usually first rule from input file)
Returns
private empty rule with architecture information only

◆ createLogRule()

std::unique_ptr<yaramod::Rule> createLogRule ( const yaramod::Rule *  rule,
const std::string &  reason = "" 
)

Create log-file rule from another rule.

Parameters
rulesource rule (usually rule that is being removed)
reasonreason of rule being removed
Returns
rule for log-file

◆ cutHexString()

std::shared_ptr<yaramod::HexString> cutHexString ( const std::shared_ptr< yaramod::HexString > &  hexString,
std::size_t  limit 
)

◆ cutStringWhitespace()

std::string cutStringWhitespace ( const std::string &  inputString,
std::size_t  limit 
)

Cut string before limit but on whitespace.

Parameters
inputStringoriginal string
limitmaximal string size
Returns
shortened string

◆ filterMetaSection()

void filterMetaSection ( yaramod::YaraRuleBuilder &  builder,
const yaramod::Rule *  rule 
)

◆ packDelhpi()

void packDelhpi ( yaramod::YaraFileBuilder &  builder,
const RuleRelations alternativeRules 
)

Pack Delphi template names to simple format Class<T>.Method or similar.

Parameters
buildertarget for final rule
alternativeRulesrule with name and its alternatives

Variable Documentation

◆ YARA_BUF_SIZE

constexpr std::size_t YARA_BUF_SIZE = 8000
constexpr

Yara buffer limit.