37 releases (24 breaking)

0.26.0 Feb 16, 2024
0.24.0 Nov 29, 2023
0.20.0 May 12, 2023
0.17.0 Feb 13, 2023
0.1.0 May 30, 2018

#27 in FFI

Download history 724/week @ 2023-11-30 239/week @ 2023-12-07 320/week @ 2023-12-14 109/week @ 2023-12-21 115/week @ 2023-12-28 119/week @ 2024-01-04 509/week @ 2024-01-11 526/week @ 2024-01-18 497/week @ 2024-01-25 429/week @ 2024-02-01 763/week @ 2024-02-08 821/week @ 2024-02-15 740/week @ 2024-02-22 559/week @ 2024-02-29 684/week @ 2024-03-07 685/week @ 2024-03-14

2,812 downloads per month
Used in 5 crates

MIT/Apache

4MB
101K SLoC

C 57K SLoC // 0.1% comments Rust 36K SLoC // 0.0% comments Happy 3K SLoC Visual Studio Project 2K SLoC C++ 784 SLoC // 0.3% comments Bazel 697 SLoC // 0.3% comments Automake 316 SLoC // 0.1% comments Batch 211 SLoC Visual Studio Solution 191 SLoC M4 190 SLoC // 0.4% comments RPM Specfile 84 SLoC // 0.1% comments JavaScript 84 SLoC // 0.0% comments NuGet Config 47 SLoC Python 34 SLoC // 0.8% comments Shell 3 SLoC Bitbake 1 SLoC

yara-rust

Tests Status Crates.io Documentation

Bindings for the Yara library from VirusTotal.

More documentation can be found on the Yara's documentation.

Example

The implementation is inspired from yara-python.

const RULES: &str = r#"
    rule contains_rust {
      strings:
        $rust = "rust" nocase
      condition:
        $rust
    }
"#;

fn main() {
    let compiler = Compiler::new().unwrap();
    let compiler = compiler
        .add_rules_str(RULES)
        .expect("Should have parsed rule");
    let rules = compiler
        .compile_rules()
        .expect("Should have compiled rules");
    let results = rules
        .scan_mem("I love Rust!".as_bytes(), 5)
        .expect("Should have scanned");
    assert!(results.iter().any(|r| r.identifier == "contains_rust"));
}

Features

  • Support from Yara v4.2.
  • Compile rules from strings or files.
  • Save and load compiled rules.
  • Scan byte arrays (&[u8]) or files.

Feature flags and Yara linking.

Look at the yara-sys crate documentation for a list of feature flags and how to link to your Yara crate.

TODO

  • Remove some unwrap on string conversions (currently this crate assume the rules, meta and namespace identifier are valid Rust's str).
  • Accept AsRef<Path> instead of &str on multiple functions.
  • Implement the scanner API.
  • Add process scanning.
  • Report the warnings to the user.

License

Licensed under either of

at your option.

Contributing

Please follow the conventional commit rules when committing to this repository.

If you add any new feature, add the corresponding unit/doc tests.

Dependencies