retdec
|
Logic for yara patterns filter. More...
#include <cctype>
#include <regex>
#include "pat2yara/logic.h"
#include "yaramod/types/hex_string.h"
#include "yaramod/types/rule.h"
Functions | |
std::size_t | getPureInformationSize (const std::shared_ptr< HexString > &pattern) |
bool | hasEnoughPureInformation (const std::shared_ptr< HexString > &pattern, std::size_t pureMinimum) |
std::size_t | getHexStringSize (const std::shared_ptr< HexString > &pattern) |
std::size_t | getTrailingNopSize (const std::shared_ptr< HexString > &pattern, const std::uint8_t nopOpCode) |
std::size_t | getNamedRelocationCount (const Rule *rule) |
bool | nameFilter (const Rule *rule) |
Logic for yara patterns filter.
std::size_t getHexStringSize | ( | const std::shared_ptr< HexString > & | pattern | ) |
Get HexString size in bytes.
pattern | input pattern |
std::size_t getNamedRelocationCount | ( | const Rule * | rule | ) |
Get number of named relocations.
rule | input rule |
std::size_t getPureInformationSize | ( | const std::shared_ptr< HexString > & | pattern | ) |
Get size of pure information (no wild-cards etc.) in HexString in bytes.
pattern | input pattern |
std::size_t getTrailingNopSize | ( | const std::shared_ptr< HexString > & | pattern, |
const std::uint8_t | nopOpCode | ||
) |
Get number of trailing NOP instructions used to align functions.
pattern | input pattern |
nopOpCode | code for NOP instruction |
bool hasEnoughPureInformation | ( | const std::shared_ptr< HexString > & | pattern, |
std::size_t | pureMinimum | ||
) |
Check if pattern has enough pure information.
pattern | input pattern |
pureMinimum | pure information requirement |
true
if pattern has enough pure information, false
otherwise bool nameFilter | ( | const Rule * | rule | ) |
Check if this rule should be removed because of its name.
rule | input rule |
true
if rule should be removed, false
otherwise