yara-ffi 1.0.0 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 380c0c04b4e921df435344606ae662123cdf59e8e1bb20bc442f1282285d87d1
-  data.tar.gz: 5348991427d0376f4d0b31e8a1e9cd64275e760a2a9839e10eb0cc87dcedbfaf
+  metadata.gz: 77c78c082eac821fd90e99808b1d944d7ac5e0a4c597339d46e9d9806cc61a17
+  data.tar.gz: 75a6e4cb0f1d9b6b89d611bfd615006b5f638532337a8a6b03d5e37bd697a6a5
 SHA512:
-  metadata.gz: a640d8ef7adce2b261de4e7144e2c8ea35519c566cbd2c6a75c04ab68bda54bbf0d339b37bb210fdf60b1bed7bb152fe3c0e0e20355c7f8ec45364c2dd25dc31
-  data.tar.gz: 9063e8934d649121a5c2e9489d662c5bdb64b695ac359981d0801bc439ba64699fded19c8d0096c3ae4900fb59b8823c84cec153e0573bc81219e3d4e0e74b12
+  metadata.gz: de69cea095663dc7a7fe66d896d846139328f3e0e47d07c3ad05340e9f99ee755311da3ec6ab1afc19ddda809fea1de04274fecf4404544c0e7ed48bde48e3de
+  data.tar.gz: c09131210c41e871d677b0779f2a736dad22c6ba1c32d3e155f1083bb4886b3d6d0815c293889a8da497b3af882fad5fb31d234c46733243cefc576c023ee964

data/lib/yara/scan_result.rb

@@ -0,0 +1,74 @@
+module Yara
+  class ScanResult
+    RULE_MATCHING     = 1
+    RULE_NOT_MATCHING = 2
+
+    META_FLAGS_LAST_IN_RULE = 1
+
+    META_TYPE_INTEGER = 1
+    META_TYPE_STRING  = 2
+    META_TYPE_BOOLEAN = 3
+
+    RULE_IDENTIFIER  = 1
+    METAS_IDENTIFIER = 3
+
+    attr_reader :callback_type, :rule
+
+    def initialize(callback_type, rule_ptr)
+      @callback_type = callback_type
+      @rule = YrRule.new(rule_ptr)
+    end
+
+    def rule_name
+      @rule.values[RULE_IDENTIFIER]
+    end
+
+    def rule_meta
+      metas = {}
+      reading_metas = true
+      meta_index = 0
+      meta_pointer = @rule.values[METAS_IDENTIFIER]
+      while reading_metas do
+        meta = YrMeta.new(meta_pointer + meta_index * YrMeta.size)
+        metas.merge!(meta_as_hash(meta))
+        flags = meta.values.last
+        if flags == META_FLAGS_LAST_IN_RULE
+          reading_metas = false
+        else
+          meta_index += 1
+        end
+      end
+      metas
+    end
+
+    def scan_complete?
+      callback_type == SCAN_FINISHED
+    end
+
+    def rule_outcome?
+      [RULE_MATCHING, RULE_NOT_MATCHING].include?(callback_type)
+    end
+
+    def match?
+      callback_type == RULE_MATCHING
+    end
+
+    private
+
+    def meta_as_hash(meta)
+      name, string_value, int_value, type, _flags = meta.values
+      value = meta_value(string_value, int_value, type)
+      { name.to_sym => value }
+    end
+
+    def meta_value(string_value, int_value, type)
+      if type == META_TYPE_INTEGER
+        int_value
+      elsif type == META_TYPE_BOOLEAN
+        int_value == 1
+      else
+        string_value
+      end
+    end
+  end
+end

data/lib/yara/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Yara
-  VERSION = "1.0.0"
+  VERSION = "2.0.0"
 end

data/lib/yara/yr_meta.rb

@@ -2,6 +2,9 @@ module Yara
   class YrMeta < FFI::Struct
     layout \
       :identifier, :string,
-      :type, :int32_t
+      :string, :string,
+      :integer, :int64_t,
+      :type, :int32_t,
+      :flags, :int32_t
   end
 end

data/lib/yara/yr_rule.rb

@@ -4,7 +4,7 @@ module Yara
       :flags, :int32_t,
       :identifier, :string,
       :tags, :string,
-      :metas, YrMeta.ptr,
+      :metas, :pointer,
       :strings, YrString.ptr,
       :ns, YrNamespace.ptr
   end

data/lib/yara.rb

@@ -2,22 +2,17 @@
 
 require "ffi"
 require "pry"
-require_relative "yara/version"
 require_relative "yara/ffi"
+require_relative "yara/scan_result"
+require_relative "yara/version"
 
-# TBD
 module Yara
-  class Error < StandardError; end
+  SCAN_FINISHED = 3
 
-  CALLBACK_MSG_RULE_MATCHING     = 1
-  CALLBACK_MSG_RULE_NOT_MATCHING = 2
-  CALLBACK_MSG_SCAN_FINISHED     = 3
-
-  RULE_IDENTIFIER = 1
+  class Error < StandardError; end
 
   def self.test(rule_string, test_string)
     user_data = UserData.new
-    user_data[:number] = 42
     scanning = true
     results = []
 
@@ -38,14 +33,12 @@ module Yara
     Yara::FFI.yr_compiler_get_rules(compiler_pointer, rules_pointer)
     rules_pointer = rules_pointer.get_pointer(0)
 
-    result_callback = proc do |context_ptr, message, message_data_ptr, user_data_ptr|
-      rule = YrRule.new(message_data_ptr)
-
-      case message
-      when CALLBACK_MSG_RULE_MATCHING
-        results << rule.values[RULE_IDENTIFIER]
-      when CALLBACK_MSG_SCAN_FINISHED
+    result_callback = proc do |context_ptr, callback_type, rule_ptr, user_data_ptr|
+      if callback_type == SCAN_FINISHED
         scanning = false
+      else
+        result = ScanResult.new(callback_type, rule_ptr)
+        results << result if result.rule_outcome?
       end
 
       0 # ERROR_SUCCESS

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: yara-ffi
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 2.0.0
 platform: ruby
 authors:
 - Jonathan Hoyt
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-08-16 00:00:00.000000000 Z
+date: 2021-08-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi
@@ -45,6 +45,7 @@ files:
 - bin/setup
 - lib/yara.rb
 - lib/yara/ffi.rb
+- lib/yara/scan_result.rb
 - lib/yara/user_data.rb
 - lib/yara/version.rb
 - lib/yara/yr_meta.rb