retdec
Classes | Public Member Functions | Private Attributes | List of all members
retdec::yaracpp::YaraDetector Class Reference

#include <yara_detector.h>

Collaboration diagram for retdec::yaracpp::YaraDetector:
Collaboration graph
[legend]

Classes

class  CallbackSettings
 
struct  RuleFile
 

Public Member Functions

 YaraDetector ()
 
 ~YaraDetector ()
 
Other methods
bool addRules (const char *string)
 
bool addRuleFile (const std::string &pathToFile, const std::string &nameSpace=std::string())
 
bool isInValidState () const
 
Detection methods
bool analyze (const std::string &pathToInputFile, bool storeAllRules=false)
 
bool analyze (std::vector< std::uint8_t > &bytes, bool storeAllRules=false)
 
const std::vector< YaraRule > & getDetectedRules () const
 
const std::vector< YaraRule > & getUndetectedRules () const
 

Private Member Functions

Auxiliary detection methods
template<typename T >
bool analyzeWithScan (T &&value, bool storeAllRules=false)
 
YR_RULESgetCompiledRules ()
 

Static Private Member Functions

Static auxiliary methods
static int yaraCallback (YR_SCAN_CONTEXT *context, int message, void *messageData, void *userData)
 

Private Attributes

YR_COMPILERcompiler = nullptr
 compiler or text rules More...
 
std::vector< FILE * > files
 representation of files with rules More...
 
std::vector< YaraRuledetectedRules
 representation of detected rules More...
 
std::vector< YaraRuleundetectedRules
 representation of undetected rules More...
 
YR_RULEStextFilesRules = nullptr
 rules from input text files More...
 
std::vector< YR_RULES * > precompiledRules
 rules from precompiled files More...
 
bool stateIsValid = true
 internal state of instance More...
 
bool needsRecompilation = true
 indicates whether text files need recompilation More...
 

Detailed Description

Interpret of YARA rules

Constructor & Destructor Documentation

◆ YaraDetector()

retdec::yaracpp::YaraDetector::YaraDetector ( )

Constructor

◆ ~YaraDetector()

retdec::yaracpp::YaraDetector::~YaraDetector ( )

Destructor

Member Function Documentation

◆ addRuleFile()

bool retdec::yaracpp::YaraDetector::addRuleFile ( const std::string &  pathToFile,
const std::string &  nameSpace = std::string() 
)

Add external file with text rules

Parameters
pathToFilePath to rule file
nameSpaceNamespace to use for the given rule file. If the file is already compiled, this has no effect. If it is a text file, this allows to have multiple rules with the same ID across multiple rule files.

◆ addRules()

bool retdec::yaracpp::YaraDetector::addRules ( const char *  string)

Add text rules to compiler

Parameters
stringYARA rules to add

◆ analyze() [1/2]

bool retdec::yaracpp::YaraDetector::analyze ( const std::string &  pathToInputFile,
bool  storeAllRules = false 
)

Analyze input file

Parameters
pathToInputFilePath to input file
storeAllRulesIf this parameter is set to true, store all rules (not only detected)
Returns
true if analysis completed without any error, otherwise false.

◆ analyze() [2/2]

bool retdec::yaracpp::YaraDetector::analyze ( std::vector< std::uint8_t > &  bytes,
bool  storeAllRules = false 
)

Analyze input bytes

Parameters
bytesVector of input bytes
storeAllRulesIf this parameter is set to true, store all rules (not only detected)
Returns
true if analysis completed without any error, otherwise false.

◆ analyzeWithScan()

template<typename T >
bool retdec::yaracpp::YaraDetector::analyzeWithScan ( T &&  value,
bool  storeAllRules = false 
)
private

Analyze input sequence

Parameters
valueValue to analyze
storeAllRulesIf this parameter is set to true, store all rules (not only detected)
Returns
true if analysis completed without any error, otherwise false.

◆ getCompiledRules()

YR_RULES * retdec::yaracpp::YaraDetector::getCompiledRules ( )
private

Returns the compiled rules from text files.

Returns
Compiled rules.

◆ getDetectedRules()

const std::vector< YaraRule > & retdec::yaracpp::YaraDetector::getDetectedRules ( ) const

Get detected rules

Returns
Detected rules

◆ getUndetectedRules()

const std::vector< YaraRule > & retdec::yaracpp::YaraDetector::getUndetectedRules ( ) const

Get undetected rules

Returns
Undetected rules

◆ isInValidState()

bool retdec::yaracpp::YaraDetector::isInValidState ( ) const

Getter for state of instance

Returns
true if all is OK, false otherwise

◆ yaraCallback()

int retdec::yaracpp::YaraDetector::yaraCallback ( YR_SCAN_CONTEXT context,
int  message,
void *  messageData,
void *  userData 
)
staticprivate

Callback function for scanning of input file

Parameters
contextYARA context
messageType of message from libyara
messageDataContent of message
userDataPointer for save information about detected rules
Returns
Instruction for the next scan

Read libyara documentation for more detailed information about callback function

Member Data Documentation

◆ compiler

YR_COMPILER* retdec::yaracpp::YaraDetector::compiler = nullptr
private

compiler or text rules

◆ detectedRules

std::vector<YaraRule> retdec::yaracpp::YaraDetector::detectedRules
private

representation of detected rules

◆ files

std::vector<FILE*> retdec::yaracpp::YaraDetector::files
private

representation of files with rules

◆ needsRecompilation

bool retdec::yaracpp::YaraDetector::needsRecompilation = true
private

indicates whether text files need recompilation

◆ precompiledRules

std::vector<YR_RULES*> retdec::yaracpp::YaraDetector::precompiledRules
private

rules from precompiled files

◆ stateIsValid

bool retdec::yaracpp::YaraDetector::stateIsValid = true
private

internal state of instance

◆ textFilesRules

YR_RULES* retdec::yaracpp::YaraDetector::textFilesRules = nullptr
private

rules from input text files

◆ undetectedRules

std::vector<YaraRule> retdec::yaracpp::YaraDetector::undetectedRules
private

representation of undetected rules


The documentation for this class was generated from the following files: