avast / yaramod

Parsing of YARA rules into AST and building new rulesets in C++.
MIT License
120 stars 44 forks source link

'yaramod.Rule' object has no attribute 'text_formatted' #226

Open overdozzz2020 opened 2 years ago

overdozzz2020 commented 2 years ago

Hi, I have a problem when wanna formatting my yara rules(rule.text remove my comments). When we use parse_file() function it will create for us object from <class 'yaramod.YaraFile'>:

yara_file = yaramod.Yaramod().parse_file(in_path)

and when iterating over yara_file rules it will create <class 'yaramod.Rule'> object for us:

yara_file = yaramod.Yaramod().parse_file(in_path):
for rule in yara_file.rules:
         .....       

In my case, i create include file(include.yar) that contain multiple other yara file paths like below:

include "/path_to_rules/rule1.yar"
include "/path_to_rules/rule2.yar"
          .....

When i use rule.text it will give me formatted rule content as i want but it remove all the comments!

yara_file = yaramod.Yaramod().parse_file(in_path):
for rule in yara_file.rules:
   print(rule.text)

I need sth like text_formatted that we can use for yaramod.YaraFile object that don't remove yara rule comments when parsing.

I can't parse and use each yara file separately due to some rules use other rules and need to be included before.

metthal commented 1 year ago

Something like this is unfortunately not supported right now. If you'd like this kind of functionality, we're welcoming PRs but currently, it's not in our capacity to add this. Sorry.