I did not find a way to iterate over a compiled ruleset (without performing a scan first). This is useful for printing metadata of the ruleset, for example:
let compiler = Compiler::new().unwrap();
let compiler = compiler
.add_rules_str(RULES)
.expect("Should have parsed rule");
for rule in rules.getRules() {
println!(rule.identifier);
}
Note, this would also work for compiled rules loaded with Rules::load_from_file.
My final use-case (for which this is a precondition) involves disabling rules based on certain conditions, for example:
for rule in rules.getRules() {
if x == 42 {
rule.disable();
}
}
For reference, this is possible with the Yara-Go-bindings; they use the yr_rules_foreach macro for this. However, in this repo there seem to be no bindings for it available yet.
Interesting, I didn't know it was possible to disable rules after compilation like this. This shouldn't be too hard to implement bindings for it. I might take a shot at this when I implement this feature on my side
I did not find a way to iterate over a compiled ruleset (without performing a scan first). This is useful for printing metadata of the ruleset, for example:
Note, this would also work for compiled rules loaded with
Rules::load_from_file
.My final use-case (for which this is a precondition) involves disabling rules based on certain conditions, for example:
For reference, this is possible with the Yara-Go-bindings; they use the
yr_rules_foreach
macro for this. However, in this repo there seem to be no bindings for it available yet.