class Yara::ScanResult
Constants
- METAS_IDENTIFIER
- META_FLAGS_LAST_IN_RULE
- META_TYPE_BOOLEAN
- META_TYPE_INTEGER
- META_TYPE_STRING
- RULE_IDENTIFIER
- RULE_MATCHING
- RULE_NOT_MATCHING
- STRING_FLAGS_LAST_IN_RULE
- STRING_IDENTIFIER
- STRING_LENGTH
- STRING_POINTER
Attributes
callback_type[R]
rule[R]
Public Class Methods
new(callback_type, rule_ptr)
click to toggle source
# File lib/yara/scan_result.rb, line 23 def initialize(callback_type, rule_ptr) @callback_type = callback_type @rule = YrRule.new(rule_ptr) end
Public Instance Methods
match?()
click to toggle source
# File lib/yara/scan_result.rb, line 77 def match? callback_type == RULE_MATCHING end
rule_meta()
click to toggle source
# File lib/yara/scan_result.rb, line 32 def rule_meta metas = {} reading_metas = true meta_index = 0 meta_pointer = @rule.values[METAS_IDENTIFIER] while reading_metas do meta = YrMeta.new(meta_pointer + meta_index * YrMeta.size) metas.merge!(meta_as_hash(meta)) flags = meta.values.last if flags == META_FLAGS_LAST_IN_RULE reading_metas = false else meta_index += 1 end end metas end
rule_name()
click to toggle source
# File lib/yara/scan_result.rb, line 28 def rule_name @rule.values[RULE_IDENTIFIER] end
rule_outcome?()
click to toggle source
# File lib/yara/scan_result.rb, line 73 def rule_outcome? [RULE_MATCHING, RULE_NOT_MATCHING].include?(callback_type) end
rule_strings()
click to toggle source
# File lib/yara/scan_result.rb, line 50 def rule_strings strings = {} reading_strings = true string_index = 0 string_pointer = @rule.values[STRING_IDENTIFIER] while reading_strings do string = YrString.new(string_pointer + string_index * YrString.size) string_length = string.values[STRING_LENGTH] flags = string.values.first if flags == STRING_FLAGS_LAST_IN_RULE reading_strings = false else strings.merge!(string_as_hash(string)) unless string_length == 0 string_index += 1 end end strings end
scan_complete?()
click to toggle source
# File lib/yara/scan_result.rb, line 69 def scan_complete? callback_type == SCAN_FINISHED end
Private Instance Methods
meta_as_hash(meta)
click to toggle source
# File lib/yara/scan_result.rb, line 83 def meta_as_hash(meta) name, string_value, int_value, type, _flags = meta.values value = meta_value(string_value, int_value, type) { name.to_sym => value } end
meta_value(string_value, int_value, type)
click to toggle source
# File lib/yara/scan_result.rb, line 95 def meta_value(string_value, int_value, type) if type == META_TYPE_INTEGER int_value elsif type == META_TYPE_BOOLEAN int_value == 1 else string_value end end
string_as_hash(yr_string)
click to toggle source
# File lib/yara/scan_result.rb, line 89 def string_as_hash(yr_string) string_pointer = yr_string.values[STRING_POINTER] string_identifier = yr_string.values.last { string_identifier.to_sym => string_pointer.read_string } end