Hi,
I have a problem when wanna formatting my yara rules(rule.text remove my comments).
When we use parse_file() function it will create for us object from <class 'yaramod.YaraFile'>:
yara_file = yaramod.Yaramod().parse_file(in_path)
and when iterating over yara_file rules it will create <class 'yaramod.Rule'> object for us:
yara_file = yaramod.Yaramod().parse_file(in_path):
for rule in yara_file.rules:
.....
In my case, i create include file(include.yar) that contain multiple other yara file paths like below:
include "/path_to_rules/rule1.yar"
include "/path_to_rules/rule2.yar"
.....
When i use rule.text it will give me formatted rule content as i want but it remove all the comments!
yara_file = yaramod.Yaramod().parse_file(in_path):
for rule in yara_file.rules:
print(rule.text)
I need sth like text_formatted that we can use for yaramod.YaraFile object that don't remove yara rule comments when parsing.
I can't parse and use each yara file separately due to some rules use other rules and need to be included before.
Something like this is unfortunately not supported right now. If you'd like this kind of functionality, we're welcoming PRs but currently, it's not in our capacity to add this. Sorry.
Hi, I have a problem when wanna formatting my yara rules(rule.text remove my comments). When we use parse_file() function it will create for us object from <class 'yaramod.YaraFile'>:
and when iterating over yara_file rules it will create <class 'yaramod.Rule'> object for us:
In my case, i create include file(include.yar) that contain multiple other yara file paths like below:
When i use rule.text it will give me formatted rule content as i want but it remove all the comments!
I need sth like text_formatted that we can use for yaramod.YaraFile object that don't remove yara rule comments when parsing.
I can't parse and use each yara file separately due to some rules use other rules and need to be included before.