Hugal31 / yara-rust

Rust bindings for VirusTotal/Yara
Apache License 2.0
73 stars 29 forks source link

feat: add helpers to get module values on scans #96

Closed vthib closed 1 year ago

vthib commented 1 year ago

I need to be able to read and enumerate the module values that YARA generated during a scan. This can be done by listening for the ModuleImported callback msg, and going through the object given by YARA.

This MR adds helper to be able to do this with Rust bindings:

This isn't the cleaner code i've ever written, but the yara code is quite messy as well. the YR_OBJECT is a "simulated OOP in C"-style struct, and like all OOP impls in C, it is terribly unsafe. So I have used a big unsafe block when converting the YR_OBJECT to a rust enum (YrObjectValue), which does the same thing that is done on yara's side when it is reading those values. I could remove this huge unsafe block and replace it with multiple local unsafe blocks, but i'm not sure how much it would really improve this code.

Please tell me what you think, thanks!

vthib commented 1 year ago

Linter is failing but unrelated to this MR: rust 1.67 just got released and some new lints are reported on existing code.

vthib commented 1 year ago

Anything blocking this MR, or that you want me to change @Hugal31 ?

Hugal31 commented 1 year ago

Nop, it's fine. Thank you!