VirusTotal / yara-python

The Python interface for YARA
http://virustotal.github.io/yara/
Apache License 2.0
646 stars 179 forks source link

How to add the match file path name to the callback function argument? #189

Open YahuiWong opened 2 years ago

YahuiWong commented 2 years ago

Here is an example:

import yara

def mycallback(data):
  print(data)
  return yara.CALLBACK_CONTINUE

matches = rules.match('/foo/bar/my_file', callback=mycallback, which_callbacks=yara.CALLBACK_MATCHES) The passed dictionary will be something like this:

{
  'tags': ['foo', 'bar'],
  'matches': True,
  'namespace': 'default',
  'rule': 'my_rule',
  'meta': {},
  'strings': [(81L, '$a', 'abc'), (141L, '$b', 'def')]
}

How to add the match file path name to the callback function argument? The passed dictionary will be something like this:

{
  'file_path':'/foo/bar/my_file',
  'tags': ['foo', 'bar'],
  'matches': True,
  'namespace': 'default',
  'rule': 'my_rule',
  'meta': {},
  'strings': [(81L, '$a', 'abc'), (141L, '$b', 'def')]
}