Hugal31 / yara-rust

Rust bindings for VirusTotal/Yara
Apache License 2.0
77 stars 29 forks source link

Add support for iterating over the compiled ruleset #135

Closed jpohls1 closed 1 year ago

jpohls1 commented 1 year ago

I did not find a way to iterate over a compiled ruleset (without performing a scan first). This is useful for printing metadata of the ruleset, for example:

let compiler = Compiler::new().unwrap();
let compiler = compiler
        .add_rules_str(RULES)
        .expect("Should have parsed rule");
for rule in rules.getRules() {
   println!(rule.identifier);
}

Note, this would also work for compiled rules loaded with Rules::load_from_file.

My final use-case (for which this is a precondition) involves disabling rules based on certain conditions, for example:

for rule in rules.getRules() {
   if x == 42 {
     rule.disable();
  }
}

For reference, this is possible with the Yara-Go-bindings; they use the yr_rules_foreach macro for this. However, in this repo there seem to be no bindings for it available yet.

vthib commented 1 year ago

Interesting, I didn't know it was possible to disable rules after compilation like this. This shouldn't be too hard to implement bindings for it. I might take a shot at this when I implement this feature on my side