retdec
yara_detector.h
Go to the documentation of this file.
1 
7 #ifndef RETDEC_YARACPP_YARA_DETECTOR_H
8 #define RETDEC_YARACPP_YARA_DETECTOR_H
9 
10 #include <string>
11 #include <unordered_map>
12 #include <vector>
13 
15 
16 typedef struct _YR_COMPILER YR_COMPILER;
17 typedef struct YR_RULES YR_RULES;
18 typedef struct YR_SCAN_CONTEXT YR_SCAN_CONTEXT;
19 
20 namespace retdec {
21 namespace yaracpp {
22 
27 {
28  public:
33  {
34  private:
36  bool storeAll;
38  std::vector<YaraRule> &storedDetected;
40  std::vector<YaraRule> &storedUndetected;
41  public:
43  bool cStoreAll,
44  std::vector<YaraRule> &cDetected,
45  std::vector<YaraRule> &cUndetected
46  );
47 
50  void addDetected(YaraRule &rule);
51  void addUndetected(YaraRule &rule);
52  bool storeAllRules() const;
54  };
55 
56  struct RuleFile
57  {
59  const std::string& pathToFile_,
60  bool precompiled_,
61  FILE* handle_)
62  : pathToFile(pathToFile_)
63  , precompiled(precompiled_)
64  , handle(handle_)
65  {}
66 
67  std::string pathToFile;
69  FILE* handle;
70  };
71 
72  private:
74  YR_COMPILER *compiler = nullptr;
76  std::vector<FILE*> files;
78  std::vector<YaraRule> detectedRules;
80  std::vector<YaraRule> undetectedRules;
84  std::vector<YR_RULES*> precompiledRules;
86  bool stateIsValid = true;
88  bool needsRecompilation = true;
89 
92  static int yaraCallback(
93  YR_SCAN_CONTEXT* context,
94  int message,
95  void *messageData,
96  void *userData
97  );
99 
102  template <typename T> bool analyzeWithScan(
103  T&& value,
104  bool storeAllRules = false
105  );
108  public:
109  YaraDetector();
110  ~YaraDetector();
111 
114  bool addRules(const char *string);
115  bool addRuleFile(
116  const std::string &pathToFile,
117  const std::string &nameSpace = std::string()
118  );
119  bool isInValidState() const;
121 
124  bool analyze(
125  const std::string &pathToInputFile,
126  bool storeAllRules = false
127  );
128  bool analyze(
129  std::vector<std::uint8_t> &bytes,
130  bool storeAllRules = false
131  );
132  const std::vector<YaraRule>& getDetectedRules() const;
133  const std::vector<YaraRule>& getUndetectedRules() const;
135 };
136 
137 } // namespace yaracpp
138 } // namespace retdec
139 
140 #endif
bool storeAllRules() const
Definition: yara_detector.cpp:174
void addDetected(YaraRule &rule)
Definition: yara_detector.cpp:156
CallbackSettings(bool cStoreAll, std::vector< YaraRule > &cDetected, std::vector< YaraRule > &cUndetected)
Definition: yara_detector.cpp:141
std::vector< YaraRule > & storedDetected
link to detected rules
Definition: yara_detector.h:38
bool storeAll
set to true if you want store all rules (not only detected)
Definition: yara_detector.h:36
void addUndetected(YaraRule &rule)
Definition: yara_detector.cpp:165
std::vector< YaraRule > & storedUndetected
link to undetected rules
Definition: yara_detector.h:40
Definition: yara_detector.h:27
bool analyzeWithScan(T &&value, bool storeAllRules=false)
Definition: yara_detector.cpp:392
const std::vector< YaraRule > & getDetectedRules() const
Definition: yara_detector.cpp:370
bool needsRecompilation
indicates whether text files need recompilation
Definition: yara_detector.h:88
std::vector< YaraRule > detectedRules
representation of detected rules
Definition: yara_detector.h:78
YaraDetector()
Definition: yara_detector.cpp:94
~YaraDetector()
Definition: yara_detector.cpp:105
YR_COMPILER * compiler
compiler or text rules
Definition: yara_detector.h:74
std::vector< YaraRule > undetectedRules
representation of undetected rules
Definition: yara_detector.h:80
bool addRuleFile(const std::string &pathToFile, const std::string &nameSpace=std::string())
Definition: yara_detector.cpp:300
std::vector< FILE * > files
representation of files with rules
Definition: yara_detector.h:76
static int yaraCallback(YR_SCAN_CONTEXT *context, int message, void *messageData, void *userData)
Definition: yara_detector.cpp:190
bool analyze(const std::string &pathToInputFile, bool storeAllRules=false)
Definition: yara_detector.cpp:347
bool stateIsValid
internal state of instance
Definition: yara_detector.h:86
bool isInValidState() const
Definition: yara_detector.cpp:335
YR_RULES * getCompiledRules()
Definition: yara_detector.cpp:420
const std::vector< YaraRule > & getUndetectedRules() const
Definition: yara_detector.cpp:379
bool addRules(const char *string)
Definition: yara_detector.cpp:284
YR_RULES * textFilesRules
rules from input text files
Definition: yara_detector.h:82
std::vector< YR_RULES * > precompiledRules
rules from precompiled files
Definition: yara_detector.h:84
Definition: yara_rule.h:23
Definition: archive_wrapper.h:19
Definition: yara_detector.h:57
bool precompiled
Definition: yara_detector.h:68
std::string pathToFile
Definition: yara_detector.h:67
RuleFile(const std::string &pathToFile_, bool precompiled_, FILE *handle_)
Definition: yara_detector.h:58
FILE * handle
Definition: yara_detector.h:69
struct YR_SCAN_CONTEXT YR_SCAN_CONTEXT
Definition: yara_detector.h:18
struct YR_RULES YR_RULES
Definition: yara_detector.h:17
struct _YR_COMPILER YR_COMPILER
Definition: yara_detector.h:16
Library representation of one YARA rule.