Documentation ¶
Overview ¶
Package gyp provides a pure Go parser for YARA rules.
For example, you can parse YARA rules from a string:
ruleset, err := gyp.ParseString("rule test { condition: true }")
Or from a io.Reader:
ruleset, err := gyp.Parse(os.Stdin)
The rules can be written to source again:
err := ruleset.WriteSource(os.Stdout)
Or you can iterate over the rules and inspect their attributes:
for _, rule := ruleset.Rules { fmt.Println(rule.Identifier) }
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type YaraSerializer ¶
type YaraSerializer struct {
// contains filtered or unexported fields
}
YaraSerializer converts a RuleSet from proto to YARA ruleset. Contains configuration options.
func NewSerializer ¶
func NewSerializer(w io.Writer) *YaraSerializer
NewSerializer returns a YaraSerializer that writes the serialization output to w.
func (*YaraSerializer) Serialize ¶
func (ys *YaraSerializer) Serialize(rs *pb.RuleSet) error
Serialize converts the provided RuleSet proto to a YARA ruleset.
func (*YaraSerializer) SerializeExpression ¶
func (ys *YaraSerializer) SerializeExpression(e *pb.Expression) error
SerializeExpression serializes an Expression in a YARA rule condition.
func (*YaraSerializer) SerializeStringValue ¶
func (ys *YaraSerializer) SerializeStringValue(str *pb.String) error
Serializes the value of a string in a YARA rule.
func (*YaraSerializer) SetIndent ¶
func (ys *YaraSerializer) SetIndent(indent string)
SetIndent sets the indentation string used for each indentation level. Default value: 2 whitespaces.