class Yara::ScanResult

Constants

METAS_IDENTIFIER
META_FLAGS_LAST_IN_RULE
META_TYPE_BOOLEAN
META_TYPE_INTEGER
META_TYPE_STRING
RULE_IDENTIFIER
RULE_MATCHING
RULE_NOT_MATCHING
STRING_FLAGS_LAST_IN_RULE
STRING_IDENTIFIER
STRING_LENGTH
STRING_POINTER

Attributes

callback_type[R]
rule[R]

Public Class Methods

new(callback_type, rule_ptr) click to toggle source
# File lib/yara/scan_result.rb, line 23
def initialize(callback_type, rule_ptr)
  @callback_type = callback_type
  @rule = YrRule.new(rule_ptr)
end

Public Instance Methods

match?() click to toggle source
# File lib/yara/scan_result.rb, line 77
def match?
  callback_type == RULE_MATCHING
end
rule_meta() click to toggle source
# File lib/yara/scan_result.rb, line 32
def rule_meta
  metas = {}
  reading_metas = true
  meta_index = 0
  meta_pointer = @rule.values[METAS_IDENTIFIER]
  while reading_metas do
    meta = YrMeta.new(meta_pointer + meta_index * YrMeta.size)
    metas.merge!(meta_as_hash(meta))
    flags = meta.values.last
    if flags == META_FLAGS_LAST_IN_RULE
      reading_metas = false
    else
      meta_index += 1
    end
  end
  metas
end
rule_name() click to toggle source
# File lib/yara/scan_result.rb, line 28
def rule_name
  @rule.values[RULE_IDENTIFIER]
end
rule_outcome?() click to toggle source
# File lib/yara/scan_result.rb, line 73
def rule_outcome?
  [RULE_MATCHING, RULE_NOT_MATCHING].include?(callback_type)
end
rule_strings() click to toggle source
# File lib/yara/scan_result.rb, line 50
def rule_strings
  strings = {}
  reading_strings = true
  string_index = 0
  string_pointer = @rule.values[STRING_IDENTIFIER]
  while reading_strings do
    string = YrString.new(string_pointer + string_index * YrString.size)
    string_length = string.values[STRING_LENGTH]
    flags = string.values.first
    if flags == STRING_FLAGS_LAST_IN_RULE
      reading_strings = false
    else
      strings.merge!(string_as_hash(string)) unless string_length == 0
      string_index += 1
    end
  end
  strings
end
scan_complete?() click to toggle source
# File lib/yara/scan_result.rb, line 69
def scan_complete?
  callback_type == SCAN_FINISHED
end

Private Instance Methods

meta_as_hash(meta) click to toggle source
# File lib/yara/scan_result.rb, line 83
def meta_as_hash(meta)
  name, string_value, int_value, type, _flags = meta.values
  value = meta_value(string_value, int_value, type)
  { name.to_sym => value }
end
meta_value(string_value, int_value, type) click to toggle source
# File lib/yara/scan_result.rb, line 95
def meta_value(string_value, int_value, type)
  if type == META_TYPE_INTEGER
    int_value
  elsif type == META_TYPE_BOOLEAN
    int_value == 1
  else
    string_value
  end
end
string_as_hash(yr_string) click to toggle source
# File lib/yara/scan_result.rb, line 89
def string_as_hash(yr_string)
  string_pointer = yr_string.values[STRING_POINTER]
  string_identifier = yr_string.values.last
  { string_identifier.to_sym => string_pointer.read_string }
end