@litko/yara-x 0.2.0 → 0.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +34 -28
- package/index.d.ts +20 -161
- package/package.json +8 -5
package/README.md
CHANGED
|
@@ -1,7 +1,5 @@
|
|
|
1
1
|
# @litko/yara-x
|
|
2
2
|
|
|
3
|
-
**v0.1.1**
|
|
4
|
-
|
|
5
3
|
## Features
|
|
6
4
|
|
|
7
5
|
- High Performance: Built with [napi-rs](https://napi-rs.com) and [VirusTotal/yara-x](https://github.com/VirusTotal/yara-x)
|
|
@@ -363,31 +361,42 @@ if (warnings.length > 0) {
|
|
|
363
361
|
|
|
364
362
|
## Performance Benchmarks
|
|
365
363
|
|
|
366
|
-
|
|
364
|
+
`node-yara-x` delivers exceptional performance through intelligent scanner caching and optimized Rust implementation.
|
|
365
|
+
|
|
366
|
+
### Benchmark Results
|
|
367
|
+
|
|
368
|
+
Test Environment: MacBook Pro M3 Max, 36GB RAM, Release build with LTO
|
|
369
|
+
Methodology: Statistical analysis across multiple iterations with percentile reporting
|
|
370
|
+
|
|
371
|
+
#### Scanner Creation Performance
|
|
367
372
|
|
|
368
|
-
|
|
369
|
-
|
|
370
|
-
|
|
373
|
+
| Rule Type | Mean | p50 | p95 | p99 |
|
|
374
|
+
| -------------- | ------ | ------ | ------ | ------ |
|
|
375
|
+
| Simple Rule | 2.44ms | 2.42ms | 2.67ms | 3.00ms |
|
|
376
|
+
| Complex Rule | 2.79ms | 2.78ms | 3.00ms | 3.26ms |
|
|
377
|
+
| Regex Rule | 8.63ms | 8.63ms | 8.91ms | 9.34ms |
|
|
378
|
+
| Multiple Rules | 2.42ms | 2.39ms | 2.69ms | 3.07ms |
|
|
371
379
|
|
|
372
|
-
|
|
380
|
+
#### Scanning Performance by Data Size
|
|
373
381
|
|
|
374
|
-
|
|
|
375
|
-
|
|
|
376
|
-
|
|
|
377
|
-
|
|
|
378
|
-
|
|
|
379
|
-
|
|
|
380
|
-
|
|
|
381
|
-
|
|
|
382
|
-
| Scanning Large Data (10MB, Simple Rule) | 0.347 ms | 10 | 0.340 ms | 0.394 ms | 0.394 ms |
|
|
383
|
-
| Scanning Medium Data (100KB, Complex Rule) | 0.219 ms | 100 | 0.215 ms | 0.254 ms | 0.269 ms |
|
|
384
|
-
| Scanning Medium Data (100KB, Regex Rule) | 0.156 ms | 100 | 0.152 ms | 0.182 ms | 0.210 ms |
|
|
385
|
-
| Scanning Medium Data (100KB, Multiple Rules) | 0.218 ms | 100 | 0.212 ms | 0.261 ms | 0.353 ms |
|
|
386
|
-
| Async Scanning Medium Data (100KB, Simple Rule) | 0.012 ms | 100 | 0.011 ms | 0.016 ms | 0.027ms |
|
|
387
|
-
| Scanning with Variables | 0.143 ms | 1000 | 0.140 ms | 0.155 ms | 0.166 ms |
|
|
388
|
-
| Scanning with Variables (Override at Scan Time) | 0.144 ms | 1000 | 0.142 ms | 0.158 ms | 0.175 ms |
|
|
382
|
+
| Data Size | Rule Type | Mean | Throughput |
|
|
383
|
+
| --------- | -------------- | ----- | ---------- |
|
|
384
|
+
| 64 bytes | Simple | 3μs | ~21 MB/s |
|
|
385
|
+
| 100KB | Simple | 6μs | ~16.7 GB/s |
|
|
386
|
+
| 100KB | Complex | 71μs | ~1.4 GB/s |
|
|
387
|
+
| 100KB | Regex | 7μs | ~14.3 GB/s |
|
|
388
|
+
| 100KB | Multiple Rules | 71μs | ~1.4 GB/s |
|
|
389
|
+
| 10MB | Simple | 196μs | ~51 GB/s |
|
|
389
390
|
|
|
390
|
-
|
|
391
|
+
#### Advanced Features Performance
|
|
392
|
+
|
|
393
|
+
| Feature | Mean | Notes |
|
|
394
|
+
| ----------------- | ---- | -------------------------- |
|
|
395
|
+
| Variable Scanning | 1μs | Pre-compiled variables |
|
|
396
|
+
| Runtime Variables | 2μs | Variables set at scan time |
|
|
397
|
+
| Async Scanning | 12μs | Non-blocking operations |
|
|
398
|
+
|
|
399
|
+
## API Reference
|
|
391
400
|
|
|
392
401
|
### Functions
|
|
393
402
|
|
|
@@ -395,7 +404,7 @@ if (warnings.length > 0) {
|
|
|
395
404
|
- `compileToWasm(ruleSource: string, outputPath: string, options?: CompilerOptions)` - Compiles yara rules from a string to WASM file.
|
|
396
405
|
- `compileFileToWasm(rulesPath: string, outputPath: string, options?: CompilerOptions)` - Compiles yara rules from a file to WASM file.
|
|
397
406
|
- `validate(ruleSource: string, options?: CompilerOptions)` - Validates yara rules without executing them.
|
|
398
|
-
- `create(
|
|
407
|
+
- `create()` - Creates an empty rules scanner to add rules incrementally.
|
|
399
408
|
- `fromFile(rulePath: string, options?: CompilerOptions)` - Compiles yara rules from a file.
|
|
400
409
|
|
|
401
410
|
### yarax Methods
|
|
@@ -409,10 +418,7 @@ if (warnings.length > 0) {
|
|
|
409
418
|
- `emitWasmFileAsync(filePath: string)` - Emit compiled rules to WASM file asynchronously.
|
|
410
419
|
- `addRuleSource(rules: string)` - Add rules from a string to an existing scanner.
|
|
411
420
|
- `addRuleFile(filePath: string)` - Add rules from a file to an existing scanner.
|
|
412
|
-
|
|
413
|
-
### Rule Validation
|
|
414
|
-
|
|
415
|
-
- `validate(rules: string, options?: CompilerOptions)` - Validate yara rules without executing them.
|
|
421
|
+
- `defineVariable(name: string, value: string)` - Define a variable for the YARA compiler.
|
|
416
422
|
|
|
417
423
|
## Licenses
|
|
418
424
|
|
package/index.d.ts
CHANGED
|
@@ -1,73 +1,25 @@
|
|
|
1
1
|
/* auto-generated by NAPI-RS */
|
|
2
2
|
/* eslint-disable */
|
|
3
|
-
/**
|
|
4
|
-
* YaraX struct represents the YARA rules and their associated data.
|
|
5
|
-
* It contains the compiled rules, source code, warnings, and variables.
|
|
6
|
-
*
|
|
7
|
-
* See [yara_x::Rules](https://docs.rs/yara-x/latest/yara_x/struct.Rules.html) for more details.
|
|
8
|
-
*/
|
|
3
|
+
/** YaraX struct represents the YARA rules and their associated data. */
|
|
9
4
|
export declare class YaraX {
|
|
10
5
|
getWarnings(): Array<CompilerWarning>
|
|
11
|
-
/**
|
|
12
|
-
* Scans the provided data using the compiled YARA rules.
|
|
13
|
-
* This function takes the scanned data and an optional object of variables,
|
|
14
|
-
* and returns a vector of RuleMatch representing the matching rules found during the scan.
|
|
15
|
-
*/
|
|
6
|
+
/** Scans the provided data using the compiled YARA rules. */
|
|
16
7
|
scan(data: Buffer, variables?: Record<string, string | number>): Array<RuleMatch>
|
|
17
|
-
/**
|
|
18
|
-
* Scans a file using the compiled YARA rules.
|
|
19
|
-
* This function takes the file path and an optional object of variables,
|
|
20
|
-
* and returns a vector of RuleMatch representing the matching rules found during the scan.
|
|
21
|
-
*/
|
|
8
|
+
/** Scans a file using the compiled YARA rules. */
|
|
22
9
|
scanFile(filePath: string, variables?: Record<string, string | number>): Array<RuleMatch>
|
|
23
|
-
/**
|
|
24
|
-
* Emits a WASM file from the compiled YARA rules.
|
|
25
|
-
* This function takes the output path and writes the compiled rules to a WASM file.
|
|
26
|
-
*/
|
|
10
|
+
/** Emits a WASM file from the compiled YARA rules. */
|
|
27
11
|
emitWasmFile(outputPath: string): void
|
|
28
|
-
/**
|
|
29
|
-
* Scans the provided data asynchronously using the compiled YARA rules.
|
|
30
|
-
* This function takes the scanned data and an optional object of variables,
|
|
31
|
-
* and returns an AsyncTask that will resolve to a vector of RuleMatch representing the matching
|
|
32
|
-
* rules found during the scan.
|
|
33
|
-
*
|
|
34
|
-
* This allows for non-blocking scanning of data, which can be useful for large datasets or
|
|
35
|
-
* performance-critical applications.
|
|
36
|
-
*/
|
|
12
|
+
/** Scans the provided data asynchronously using the compiled YARA rules. */
|
|
37
13
|
scanAsync(data: Buffer, variables?: object | undefined | null): Promise<unknown>
|
|
38
|
-
/**
|
|
39
|
-
* Scans a file asynchronously using the compiled YARA rules.
|
|
40
|
-
* This function takes the file path and an optional object of variables,
|
|
41
|
-
* and returns an AsyncTask that will resolve to a vector of RuleMatch representing the matching
|
|
42
|
-
* rules found during the scan.
|
|
43
|
-
*
|
|
44
|
-
* This allows for non-blocking scanning of files, which can be useful for large files or
|
|
45
|
-
* performance-critical applications.
|
|
46
|
-
*/
|
|
14
|
+
/** Scans a file asynchronously using the compiled YARA rules. */
|
|
47
15
|
scanFileAsync(filePath: string, variables?: object | undefined | null): Promise<unknown>
|
|
48
|
-
/**
|
|
49
|
-
* Emits a WASM file asynchronously from the compiled YARA rules.
|
|
50
|
-
* This function takes the output path
|
|
51
|
-
* and returns an AsyncTask that will resolve when the WASM file is successfully emitted.
|
|
52
|
-
*/
|
|
16
|
+
/** Emits a WASM file asynchronously from the compiled YARA rules. */
|
|
53
17
|
emitWasmFileAsync(outputPath: string): Promise<unknown>
|
|
54
|
-
/**
|
|
55
|
-
* Adds a rule source to the YARA compiler.
|
|
56
|
-
* This function takes a rule source string,
|
|
57
|
-
* compiles it, and updates the YaraX instance with the new rules.
|
|
58
|
-
*/
|
|
18
|
+
/** Adds a rule source to the YARA compiler. */
|
|
59
19
|
addRuleSource(ruleSource: string): void
|
|
60
|
-
/**
|
|
61
|
-
* Adds a rule file to the YARA compiler.
|
|
62
|
-
* This function takes a file path,
|
|
63
|
-
* reads the file content, and adds it to the YaraX instance.
|
|
64
|
-
*/
|
|
20
|
+
/** Adds a rule file to the YARA compiler. */
|
|
65
21
|
addRuleFile(filePath: string): void
|
|
66
|
-
/**
|
|
67
|
-
* Defines a variable for the YARA compiler.
|
|
68
|
-
* This function takes a variable name and value,
|
|
69
|
-
* and adds it to the YaraX instance.
|
|
70
|
-
*/
|
|
22
|
+
/** Defines a variable for the YARA compiler. */
|
|
71
23
|
defineVariable(name: string, value: string): void
|
|
72
24
|
}
|
|
73
25
|
|
|
@@ -81,41 +33,13 @@ export interface BannedModule {
|
|
|
81
33
|
errorMessage: string
|
|
82
34
|
}
|
|
83
35
|
|
|
84
|
-
/**
|
|
85
|
-
* Compiles a YARA rule source string and returns a YaraX instance with the compiled rules.
|
|
86
|
-
*
|
|
87
|
-
* Exported as `compile` in the NAPI interface.
|
|
88
|
-
*
|
|
89
|
-
* Example
|
|
90
|
-
*
|
|
91
|
-
* ```javascript
|
|
92
|
-
* const { compile } = require('your_yara_module');
|
|
93
|
-
* const yarax = compile('rule example { strings: $a = "example" condition: $a }');
|
|
94
|
-
* ```
|
|
95
|
-
*/
|
|
36
|
+
/** Compiles a YARA rule source string and returns a YaraX instance with the compiled rules. */
|
|
96
37
|
export declare function compile(ruleSource: string, options?: CompilerOptions | undefined | null): YaraX
|
|
97
38
|
|
|
98
|
-
/**
|
|
99
|
-
* Compiles a YARA rule file to a WASM file.
|
|
100
|
-
*
|
|
101
|
-
* Exported as `compileFileToWasm` in the NAPI interface.
|
|
102
|
-
*
|
|
103
|
-
* Example
|
|
104
|
-
*
|
|
105
|
-
* ```javascript
|
|
106
|
-
* const { compileFileToWasm } = require('your_yara_module');
|
|
107
|
-
* compileFileToWasm('path/to/rule_file.yar', 'output.wasm');
|
|
108
|
-
* ```
|
|
109
|
-
*/
|
|
39
|
+
/** Compiles a YARA rule file to a WASM file. */
|
|
110
40
|
export declare function compileFileToWasm(rulePath: string, outputPath: string, options?: CompilerOptions | undefined | null): void
|
|
111
41
|
|
|
112
|
-
/**
|
|
113
|
-
* CompilerError struct represents an error generated by the YARA compiler.
|
|
114
|
-
*
|
|
115
|
-
* See
|
|
116
|
-
* [yara_x::CompileError](https://docs.rs/yara-x/latest/yara_x/errors/enum.CompileError.html)
|
|
117
|
-
* for more details.
|
|
118
|
-
*/
|
|
42
|
+
/** CompilerError struct represents an error generated by the YARA compiler. */
|
|
119
43
|
export interface CompilerError {
|
|
120
44
|
/** The code of the error. */
|
|
121
45
|
code: string
|
|
@@ -129,10 +53,7 @@ export interface CompilerError {
|
|
|
129
53
|
column?: number
|
|
130
54
|
}
|
|
131
55
|
|
|
132
|
-
/**
|
|
133
|
-
* CompileResult struct represents the result of compiling YARA rules.
|
|
134
|
-
* It contains any warnings or errors generated during the compilation process.
|
|
135
|
-
*/
|
|
56
|
+
/** CompileResult struct represents the result of compiling YARA rules. */
|
|
136
57
|
export interface CompileResult {
|
|
137
58
|
/** Any warnings generated during the compilation process. */
|
|
138
59
|
warnings: Array<CompilerWarning>
|
|
@@ -140,12 +61,7 @@ export interface CompileResult {
|
|
|
140
61
|
errors: Array<CompilerError>
|
|
141
62
|
}
|
|
142
63
|
|
|
143
|
-
/**
|
|
144
|
-
* CompilerOptions struct represents the options for the YARA compiler.
|
|
145
|
-
*
|
|
146
|
-
* See [yara_x::Compiler](https://docs.rs/yara-x/latest/yara_x/struct.Compiler.html) for more
|
|
147
|
-
* details.
|
|
148
|
-
*/
|
|
64
|
+
/** CompilerOptions struct represents the options for the YARA compiler. */
|
|
149
65
|
export interface CompilerOptions {
|
|
150
66
|
/** Defines global variables for the YARA rules. */
|
|
151
67
|
defineVariables?: object
|
|
@@ -165,12 +81,7 @@ export interface CompilerOptions {
|
|
|
165
81
|
errorOnSlowLoop?: boolean
|
|
166
82
|
}
|
|
167
83
|
|
|
168
|
-
/**
|
|
169
|
-
* CompilerWarning struct represents a warning generated by the YARA compiler.
|
|
170
|
-
*
|
|
171
|
-
* See [yara_x::CompilerWarning](https://docs.rs/yara-x/latest/yara_x/warnings/enum.Warning.html)
|
|
172
|
-
* for more details.
|
|
173
|
-
*/
|
|
84
|
+
/** CompilerWarning struct represents a warning generated by the YARA compiler. */
|
|
174
85
|
export interface CompilerWarning {
|
|
175
86
|
/** The code of the warning. */
|
|
176
87
|
code: string
|
|
@@ -184,52 +95,13 @@ export interface CompilerWarning {
|
|
|
184
95
|
column?: number
|
|
185
96
|
}
|
|
186
97
|
|
|
187
|
-
/**
|
|
188
|
-
* Compiles a YARA rule source string to a WASM file.
|
|
189
|
-
*
|
|
190
|
-
* Exported as `compileToWasm` in the NAPI interface.
|
|
191
|
-
*
|
|
192
|
-
* Example
|
|
193
|
-
*
|
|
194
|
-
* ```javascript
|
|
195
|
-
* const { compileToWasm } = require('your_yara_module');
|
|
196
|
-
* compileToWasm('rule example { strings: $a = "example" condition: $a }', 'output.wasm');
|
|
197
|
-
* ```
|
|
198
|
-
*/
|
|
98
|
+
/** Compiles a YARA rule source string to a WASM file. */
|
|
199
99
|
export declare function compileToWasm(ruleSource: string, outputPath: string, options?: CompilerOptions | undefined | null): void
|
|
200
100
|
|
|
201
|
-
/**
|
|
202
|
-
* Creates a new YaraX instance with empty rules and no source code.
|
|
203
|
-
*
|
|
204
|
-
* Exported as `create` in the NAPI interface.
|
|
205
|
-
*
|
|
206
|
-
* Example
|
|
207
|
-
*
|
|
208
|
-
* ```javascript
|
|
209
|
-
* const { create } = require('your_yara_module');
|
|
210
|
-
* const yarax = create();
|
|
211
|
-
*
|
|
212
|
-
* // Now you can add rules or compile them later
|
|
213
|
-
*
|
|
214
|
-
* yarax.addRuleSource('rule example { strings: $a = "example" condition: $a }');
|
|
215
|
-
* yarax.addRuleFile('path/to/rule_file.yar');
|
|
216
|
-
* yarax.defineVariable('myVar', 'myValue');
|
|
217
|
-
* ```
|
|
218
|
-
*/
|
|
101
|
+
/** Creates a new YaraX instance with empty rules and no source code. */
|
|
219
102
|
export declare function create(): YaraX
|
|
220
103
|
|
|
221
|
-
/**
|
|
222
|
-
* Creates a new YaraX instance from a file containing YARA rules.
|
|
223
|
-
*
|
|
224
|
-
* Exported as `fromFile` in the NAPI interface.
|
|
225
|
-
*
|
|
226
|
-
* Example
|
|
227
|
-
*
|
|
228
|
-
* ```javascript
|
|
229
|
-
* const { fromFile } = require('your_yara_module');
|
|
230
|
-
* const yarax = fromFile('path/to/rule_file.yar');
|
|
231
|
-
* ```
|
|
232
|
-
*/
|
|
104
|
+
/** Creates a new YaraX instance from a file containing YARA rules. */
|
|
233
105
|
export declare function fromFile(rulePath: string, options?: CompilerOptions | undefined | null): YaraX
|
|
234
106
|
|
|
235
107
|
/** MatchData struct represents a match found by a YARA rule. */
|
|
@@ -244,11 +116,7 @@ export interface MatchData {
|
|
|
244
116
|
identifier: string
|
|
245
117
|
}
|
|
246
118
|
|
|
247
|
-
/**
|
|
248
|
-
* RuleMatch struct represents a matching rule found during scanning.
|
|
249
|
-
*
|
|
250
|
-
* See [yara_::Match](https://docs.rs/yara-x/latest/yara_x/struct.Match.html) for more details.
|
|
251
|
-
*/
|
|
119
|
+
/** RuleMatch struct represents a matching rule found during scanning. */
|
|
252
120
|
export interface RuleMatch {
|
|
253
121
|
/** The identifier of the rule that matched. */
|
|
254
122
|
ruleIdentifier: string
|
|
@@ -265,14 +133,5 @@ export interface RuleMatch {
|
|
|
265
133
|
/**
|
|
266
134
|
* Compiles a YARA rule source string and returns any warnings or errors generated during the
|
|
267
135
|
* compilation process.
|
|
268
|
-
*
|
|
269
|
-
* Exported as `validate` in the NAPI interface.
|
|
270
|
-
*
|
|
271
|
-
* Example
|
|
272
|
-
*
|
|
273
|
-
* ```javascript
|
|
274
|
-
* const { validate } = require('your_yara_module');
|
|
275
|
-
* const result = validate('rule example { strings: $a = "example" condition: $a }');
|
|
276
|
-
* ```
|
|
277
136
|
*/
|
|
278
137
|
export declare function validate(ruleSource: string, options?: CompilerOptions | undefined | null): CompileResult
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@litko/yara-x",
|
|
3
|
-
"version": "0.2.
|
|
3
|
+
"version": "0.2.1",
|
|
4
4
|
"main": "index.js",
|
|
5
5
|
"types": "index.d.ts",
|
|
6
6
|
"packageManager": "pnpm@10.13.1",
|
|
@@ -41,7 +41,10 @@
|
|
|
41
41
|
"universal": "napi universal",
|
|
42
42
|
"version": "napi version",
|
|
43
43
|
"test": "node --test __test__/index.spec.mjs",
|
|
44
|
-
"benchmark": "node __test__/benchmark.mjs"
|
|
44
|
+
"benchmark": "node __test__/benchmark.mjs",
|
|
45
|
+
"profile": "node --expose-gc __test__/run-profiling.mjs",
|
|
46
|
+
"profile:baseline": "node --expose-gc __test__/run-profiling.mjs --baseline",
|
|
47
|
+
"profile:compare": "node --expose-gc __test__/run-profiling.mjs --compare __test__/baseline-performance.json"
|
|
45
48
|
},
|
|
46
49
|
"files": [
|
|
47
50
|
"index.js",
|
|
@@ -56,8 +59,8 @@
|
|
|
56
59
|
"rust"
|
|
57
60
|
],
|
|
58
61
|
"optionalDependencies": {
|
|
59
|
-
"@litko/yara-x-darwin-x64": "0.2.
|
|
60
|
-
"@litko/yara-x-darwin-arm64": "0.2.
|
|
61
|
-
"@litko/yara-x-linux-x64-gnu": "0.2.
|
|
62
|
+
"@litko/yara-x-darwin-x64": "0.2.1",
|
|
63
|
+
"@litko/yara-x-darwin-arm64": "0.2.1",
|
|
64
|
+
"@litko/yara-x-linux-x64-gnu": "0.2.1"
|
|
62
65
|
}
|
|
63
66
|
}
|