Hugal31 / yara-rust

Rust bindings for VirusTotal/Yara
Apache License 2.0
70 stars 30 forks source link

feat: add ability to set module data in scan callback #147

Closed vthib closed 2 months ago

vthib commented 2 months ago

Some modules in YARA need to be fed data to be usable, notably the cuckoo module. This works by setting the module data in the "import module" callback, as can be seen here:

https://github.com/VirusTotal/yara/blob/923368eab/cli/yara.c#L1200

This MR adds bindings to be able to do exactly this: the object related to this callback msg is wrapped in a YrModuleImport object, which exposes two functions:

This makes the code looks like this:

let report = r#"{ "network": ... }"#;
let res = yara_scanner.scan_mem_callback(b"", |msg| {
    if let yara::CallbackMsg::ImportModule(mut module) = msg {
        if module.name() == Some(b"cuckoo") {
            // Safety: report is alive for longer than the scan.
            unsafe {
                module.set_module_data(
                    report.as_mut_ptr().cast(),
                    report.len(),
                );
            }
        }
    }
    yara::CallbackReturn::Continue
});

I haven't added a test for it, because the only module that uses this is the cuckoo module, and to use it, the module-cuckoo feature must be enabled and the libjansson-dev needs to be installed. If you prefer to have a test, I can try to update the CI to have a test like this working.

vthib commented 2 months ago

Looks like the macos-latest runner was updated from 12.7 to 14.4 and it no longer works well, i don't think it's related to my changes

Hugal31 commented 2 months ago

I also don't see a better way to expose the setter for module data, without asking for a box or some complicated lifetimes stunts. LGTM, thanks!