module Yara
Constants
- SCAN_FINISHED
- VERSION
Public Class Methods
test(rule_string, test_string)
click to toggle source
# File lib/yara.rb, line 14 def self.test(rule_string, test_string) user_data = UserData.new scanning = true results = [] Yara::FFI.yr_initialize compiler_pointer = ::FFI::MemoryPointer.new(:pointer) Yara::FFI.yr_compiler_create(compiler_pointer) compiler_pointer = compiler_pointer.get_pointer(0) error_callback = proc do |error_level, file_name, line_number, rule, message, user_data| # noop end Yara::FFI.yr_compiler_set_callback(compiler_pointer, error_callback, user_data) Yara::FFI.yr_compiler_add_string(compiler_pointer, rule_string, nil) rules_pointer =::FFI::MemoryPointer.new(:pointer) Yara::FFI.yr_compiler_get_rules(compiler_pointer, rules_pointer) rules_pointer = rules_pointer.get_pointer(0) result_callback = proc do |context_ptr, callback_type, rule_ptr, user_data_ptr| if callback_type == SCAN_FINISHED scanning = false else result = ScanResult.new(callback_type, rule_ptr) results << result if result.rule_outcome? end 0 # ERROR_SUCCESS end test_string_bytesize = test_string.bytesize test_string_pointer = ::FFI::MemoryPointer.new(:char, test_string_bytesize) test_string_pointer.put_bytes(0, test_string) Yara::FFI.yr_rules_scan_mem( rules_pointer, test_string_pointer, test_string_bytesize, 0, result_callback, user_data, 1, ) while scanning do end results ensure Yara::FFI.yr_rules_destroy(rules_pointer) Yara::FFI.yr_compiler_destroy(compiler_pointer) Yara::FFI.yr_finalize end