Documentation
¶
Index ¶
Constants ¶
const DefaultAlphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
DefaultAlphabet is the default alphabet used for the base64 modifier
Variables ¶
var ErrInvalidStringModifierCombo = fmt.Errorf(`invalid string modifier combination`)
ErrInvalidStringModifierCombo denotes when an invalid combination of string modifiers is used
Functions ¶
This section is empty.
Types ¶
type Base64 ¶ added in v0.8.0
type Base64 []byte
Base64 represents the base64 modifier that may or may not contain an alphabet. Alphabets must contain exactly 64 bytes.
func (Base64) Serialize ¶ added in v0.8.0
Serialize for the base64 string modifier returns a representation depending on the provided alphabet. If the Base64 is nil, then the modifier is assumed to be not present, and an empty string is output. If the Base64 is zero-length, then the form of the modifier is assumed to be base64 without an alphabet. If the Base64 is not zero-length, it must be 64 bytes representing a 64-character alphabet
type Dec ¶ added in v0.7.0
type Dec int64
Dec formats its value using base-10
type Hex ¶ added in v0.7.0
type Hex int64
Hex formats its value using base-16
type Int ¶ added in v0.7.0
type Int interface {
Value() int64
}
An Int can return its underlying value as int64
type Meta ¶ added in v0.2.0
type Meta struct {
Key string `json:"key"`
Val interface{} `json:"val"`
}
A Meta is a simple key/value pair. Val should be restricted to int, string, and bool.
type Metas ¶
type Metas []Meta
Metas are slices of Meta. A single Meta may be duplicated within Metas.
type Oct ¶ added in v0.7.0
type Oct int64
Oct formats its value using base-8
type Rule ¶
type Rule struct {
Modifiers RuleModifiers `json:"modifiers"`
Identifier string `json:"identifier"`
Tags []string `json:"tags"`
Meta Metas `json:"meta"`
Strings Strings `json:"strings"`
Condition string `json:"condition"`
}
A Rule is a single yara rule
type RuleModifiers ¶
RuleModifiers denote whether a Rule is global, private, neither, or both.
type RuleSet ¶
type RuleSet struct {
File string `json:"file"` // Name of the yara file
Imports []string `json:"imports"`
Includes []string `json:"includes"`
Rules []Rule `json:"rules"`
}
RuleSet represents the contents of a yara file
type String ¶
type String struct {
ID string `json:"id"`
Type StringType `json:"type"`
Text string `json:"text"`
Modifiers StringModifiers `json:"modifiers"`
}
String is a string, regex, or byte pair sequence
type StringModifiers ¶
type StringModifiers struct {
Nocase bool `json:"nocase"`
ASCII bool `json:"ascii"`
Wide bool `json:"wide"`
Fullword bool `json:"fullword"`
Private bool `json:"private"`
Xor Xor `json:"xor"`
Base64 Base64 `json:"base64"`
Base64Wide Base64 `json:"base64wide"`
I bool `json:"i"` // for regex
S bool `json:"s"` // for regex
}
StringModifiers denote the status of the possible modifiers for strings
func (*StringModifiers) Serialize ¶ added in v0.5.0
func (m *StringModifiers) Serialize() (out string, err error)
Serialize for StringModifiers creates a space-sparated list of string modifiers, excluding the i and s which are appended to /regex/ The returned error must be nil.
func (StringModifiers) String ¶ added in v0.5.0
func (m StringModifiers) String() string
String for StringModifiers returns a string representation of the modifiers
func (*StringModifiers) Validate ¶ added in v0.7.0
func (m *StringModifiers) Validate() error
Validate returns an error that can be unwrapped to ErrInvalidStringModifierCombo if an illegal combination of string modifiers is present
type StringType ¶
type StringType int
StringType is used to differentiate between string, hex bytes, and regex
const ( TypeString StringType = iota TypeHexString TypeRegex )
Type of String
func (StringType) String ¶ added in v0.5.0
func (t StringType) String() string
type Strings ¶ added in v0.2.0
type Strings []String
Strings are slices of String. No two String structs may have the same identifier within a Strings, except for the $ anonymous identifier.
type Xor ¶ added in v0.7.0
type Xor []Int
Xor represents the xor modifier. Xor can have 0-2 members, representing respectively: xor, xor(val), xor(min-max). A nil Xor indicates absence of the xor modifier
type YARAError ¶ added in v0.7.0
type YARAError struct {
// contains filtered or unexported fields
}
YARAError can be used to wrap an error type and a message to go along with it
Source Files