retdec
modifications.h
Go to the documentation of this file.
1 
7 #ifndef PAT2YARA_MODIFICATIONS_H
8 #define PAT2YARA_MODIFICATIONS_H
9 
10 #include <memory>
11 #include <string>
12 
13 // Forward declarations.
14 namespace yaramod {
15 
16  class HexString;
17  class Rule;
18  class YaraRuleBuilder;
19  class YaraFileBuilder;
20 
21 } // namespace yaramod
22 
23 class RuleRelations;
24 
28 constexpr std::size_t YARA_BUF_SIZE = 8000;
29 
30 std::unique_ptr<yaramod::Rule> createArchitectureRule(
31  const yaramod::Rule* rule);
32 
33 std::unique_ptr<yaramod::Rule> createLogRule(
34  const yaramod::Rule* rule,
35  const std::string &reason);
36 
37 std::shared_ptr<yaramod::HexString> cutHexString(
38  const std::shared_ptr<yaramod::HexString> &hexString,
39  std::size_t limit);
40 
41 std::string cutStringWhitespace(
42  const std::string &inputString,
43  std::size_t limit);
44 
46  yaramod::YaraRuleBuilder &builder,
47  const yaramod::Rule* rule);
48 
50  yaramod::YaraRuleBuilder &builder,
51  const yaramod::Rule* rule);
52 
53 void packDelhpi(
54  yaramod::YaraFileBuilder &builder,
55  const RuleRelations &alternativeRules);
56 
57 #endif
Definition: compare.h:22
yaramod::Rule * rule
Base rule.
Definition: compare.h:56
std::string cutStringWhitespace(const std::string &inputString, std::size_t limit)
Definition: modifications.cpp:174
void packDelhpi(yaramod::YaraFileBuilder &builder, const RuleRelations &alternativeRules)
Definition: modifications.cpp:249
std::unique_ptr< yaramod::Rule > createArchitectureRule(const yaramod::Rule *rule)
Definition: modifications.cpp:68
std::shared_ptr< yaramod::HexString > cutHexString(const std::shared_ptr< yaramod::HexString > &hexString, std::size_t limit)
void copyRuleToBuilder(yaramod::YaraRuleBuilder &builder, const yaramod::Rule *rule)
constexpr std::size_t YARA_BUF_SIZE
Definition: modifications.h:28
std::unique_ptr< yaramod::Rule > createLogRule(const yaramod::Rule *rule, const std::string &reason)
Definition: modifications.cpp:104
void filterMetaSection(yaramod::YaraRuleBuilder &builder, const yaramod::Rule *rule)
Definition: symbol_pattern.h:17