yara-x 1.0.0__tar.gz → 1.0.1__tar.gz

{yara_x-1.0.0 → yara_x-1.0.1}/Cargo.lock

@@ -4682,7 +4682,7 @@ checksum = "cfe53a6657fd280eaa890a3bc59152892ffa3e30101319d168b781ed6529b049"
 
 [[package]]
 name = "yara-x"
-version = "1.0.0"
+version = "1.0.1"
 dependencies = [
  "aho-corasick",
  "annotate-snippets",
@@ -4756,7 +4756,7 @@ dependencies = [
 
 [[package]]
 name = "yara-x-capi"
-version = "1.0.0"
+version = "1.0.1"
 dependencies = [
  "cbindgen",
  "serde_json",
@@ -4765,7 +4765,7 @@ dependencies = [
 
 [[package]]
 name = "yara-x-cli"
-version = "1.0.0"
+version = "1.0.1"
 dependencies = [
  "anyhow",
  "assert_cmd",
@@ -4790,6 +4790,7 @@ dependencies = [
  "strum",
  "strum_macros",
  "superconsole",
+ "unicode-width",
  "wild",
  "yansi",
  "yara-x",
@@ -4801,7 +4802,7 @@ dependencies = [
 
 [[package]]
 name = "yara-x-fmt"
-version = "1.0.0"
+version = "1.0.1"
 dependencies = [
  "bitflags 2.9.1",
  "bstr",
@@ -4815,7 +4816,7 @@ dependencies = [
 
 [[package]]
 name = "yara-x-macros"
-version = "1.0.0"
+version = "1.0.1"
 dependencies = [
  "darling",
  "proc-macro2",
@@ -4825,7 +4826,7 @@ dependencies = [
 
 [[package]]
 name = "yara-x-parser"
-version = "1.0.0"
+version = "1.0.1"
 dependencies = [
  "anyhow",
  "ascii_tree",
@@ -4849,7 +4850,7 @@ dependencies = [
 
 [[package]]
 name = "yara-x-proto"
-version = "1.0.0"
+version = "1.0.1"
 dependencies = [
  "protobuf",
  "protobuf-codegen",
@@ -4858,7 +4859,7 @@ dependencies = [
 
 [[package]]
 name = "yara-x-proto-json"
-version = "1.0.0"
+version = "1.0.1"
 dependencies = [
  "base64 0.22.1",
  "globwalk",
@@ -4872,7 +4873,7 @@ dependencies = [
 
 [[package]]
 name = "yara-x-proto-yaml"
-version = "1.0.0"
+version = "1.0.1"
 dependencies = [
  "chrono",
  "globwalk",
@@ -4886,7 +4887,7 @@ dependencies = [
 
 [[package]]
 name = "yara-x-py"
-version = "1.0.0"
+version = "1.0.1"
 dependencies = [
  "base64 0.22.1",
  "protobuf",

{yara_x-1.0.0 → yara_x-1.0.1}/Cargo.toml

@@ -1,5 +1,5 @@
 [workspace.package]
-version = "1.0.0"
+version = "1.0.1"
 authors = ["Victor M. Alvarez <vmalvarez@virustotal.com>"]
 edition = "2021"
 homepage = "https://virustotal.github.io/yara-x"
@@ -94,13 +94,13 @@ walrus = "0.23.3"
 wasmtime = { version = "33.0.0", default-features = false }
 x509-parser = "0.17.0"
 yansi = "1.0.1"
-yara-x = { path = "lib", version = "1.0.0" }
-yara-x-fmt = { path = "fmt", version = "1.0.0" }
-yara-x-macros = { path = "macros", version = "1.0.0" }
-yara-x-parser = { path = "parser", version = "1.0.0" }
-yara-x-proto = { path = "proto", version = "1.0.0" }
-yara-x-proto-yaml = { path = "proto-yaml", version = "1.0.0" }
-yara-x-proto-json = { path = "proto-json", version = "1.0.0" }
+yara-x = { path = "lib", version = "1.0.1" }
+yara-x-fmt = { path = "fmt", version = "1.0.1" }
+yara-x-macros = { path = "macros", version = "1.0.1" }
+yara-x-parser = { path = "parser", version = "1.0.1" }
+yara-x-proto = { path = "proto", version = "1.0.1" }
+yara-x-proto-yaml = { path = "proto-yaml", version = "1.0.1" }
+yara-x-proto-json = { path = "proto-json", version = "1.0.1" }
 zip = "4.0.0"
 
 # Special profile that builds a release binary with link-time optimization.

{yara_x-1.0.0 → yara_x-1.0.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: yara-x
-Version: 1.0.0
+Version: 1.0.1
 Classifier: Programming Language :: Rust
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Python :: Implementation :: PyPy

{yara_x-1.0.0 → yara_x-1.0.1}/lib/build.rs

@@ -157,16 +157,8 @@ fn main() {
         proto_parser.pure();
     }
 
-    proto_compiler
-        .cargo_out_dir("protos")
-        .include("./src/modules/protos")
-        .include("../proto/src")
-        .input("../proto/src/yara.proto");
-
-    proto_parser
-        .include("./src/modules/protos")
-        .include("../proto/src")
-        .input("../proto/src/yara.proto");
+    proto_compiler.cargo_out_dir("protos").include("./src/modules/protos");
+    proto_parser.include("./src/modules/protos");
 
     // All `.proto` files in src/modules/protos must be compiled
     for entry in globwalk::glob("src/modules/protos/**").unwrap().flatten() {

{yara_x-1.0.0 → yara_x-1.0.1}/lib/src/compiler/mod.rs

@@ -526,21 +526,18 @@ impl<'a> Compiler<'a> {
     /// Adds some YARA source code to be compiled.
     ///
     /// The `src` parameter accepts any type that implements [`Into<SourceCode>`],
-    /// such as `&str`, `&[u8]`, and naturally, [`SourceCode`] itself. This input
-    /// can include one or more YARA rules.
+    /// such as `&str`, `&[u8]`, or an instance of [`SourceCode`] itself. The source
+    /// code may include one or more YARA rules.
     ///
-    /// This function may be invoked multiple times to add several sets of YARA
-    /// rules. If the rules provided in `src` contain errors that prevent
-    /// compilation, the function will return the first error encountered.
-    /// Additionally, the compiler will store this error, along with any others
-    /// discovered during compilation, which can be accessed using
+    /// You can call this function multiple times to add different sets of rules.
+    /// If the provided source code contains syntax or semantic errors that prevent
+    /// compilation, the function returns the first encountered error. All errors
+    /// found during compilation are also recorded and can be retrieved using
     /// [`Compiler::errors`].
     ///
-    /// Even if a previous invocation resulted in a compilation error, you can
-    /// continue calling this function for adding more rules. In such cases, any
-    /// rules that failed to compile will not be included in the final compiled
-    /// set.
-    /// about the source code's origin.
+    /// Even if previous calls to this function resulted in compilation errors,
+    /// you may continue adding additional rules. Only successfully compiled rules
+    /// will be included in the final rule set.
     pub fn add_source<'src, S>(
         &mut self,
         src: S,
@@ -608,15 +605,17 @@ impl<'a> Compiler<'a> {
 
     /// Defines a global variable and sets its initial value.
     ///
-    /// Global variables must be defined before using [`Compiler::add_source`]
-    /// for adding any YARA source code that uses those variables. The variable
-    /// will retain its initial value when the compiled [`Rules`] are used for
-    /// scanning data, however each scanner can change the variable's initial
-    /// value by calling [`crate::Scanner::set_global`].
+    /// Global variables must be defined before adding any YARA source code
+    /// that references them via [`Compiler::add_source`]. Once defined, the
+    /// variable's initial value is preserved in the compiled [`Rules`] and
+    /// will be used unless overridden.
     ///
-    /// `T` can be any type that implements [`TryInto<Variable>`], which
-    /// includes: `i64`, `i32`, `i16`, `i8`, `u32`, `u16`, `u8`, `f64`, `f32`,
-    /// `bool`, `&str`, `String` and [`serde_json::Value`].
+    /// When scanning, each scanner instance can modify the initial value of
+    /// the variable using [`crate::Scanner::set_global`].
+    ///
+    /// `T` can be any type that implements [`TryInto<Variable>`], including:
+    /// `i64`, `i32`, `i16`, `i8`, `u32`, `u16`, `u8`, `f64`, `f32`, `bool`,
+    /// `&str`, `String` and [`serde_json::Value`].
     ///
     /// ```
     /// # use yara_x::Compiler;
@@ -964,8 +963,6 @@ impl<'a> Compiler<'a> {
     /// include the content of other files. When includes are disabled, any
     /// attempt to use an `include` statement will result in a compile error.
     ///
-    /// # Example
-    ///
     /// ```
     /// # use yara_x::Compiler;
     /// let mut compiler = Compiler::new();

{yara_x-1.0.0 → yara_x-1.0.1}/lib/src/types/func.rs

@@ -1,6 +1,6 @@
 use crate::types::{StringConstraint, TypeValue};
 use itertools::Itertools;
-use nom::AsChar;
+
 use serde::{Deserialize, Serialize};
 use std::cmp::Ordering;
 use std::hash::{Hash, Hasher};
@@ -127,7 +127,7 @@ impl MangledFnName {
                         Some('N') => {
                             let n = chars
                                 .by_ref()
-                                .peeking_take_while(|&c| c.is_dec_digit())
+                                .peeking_take_while(|&c| c.is_ascii_digit())
                                 .collect::<String>()
                                 .parse::<usize>()
                                 .unwrap_or_else(|_| {

yara_x-1.0.1/proto/src/yara.proto

@@ -0,0 +1,169 @@
+// Protocol buffer that specifies the options that can be used in other protos
+// for controlling the generation of YARA modules.
+
+syntax = "proto2";
+
+package yara;
+
+import "google/protobuf/descriptor.proto";
+
+message ModuleOptions {
+  required string name = 1;
+  required string root_message = 2;
+  optional string rust_module = 3;
+  optional string cargo_feature = 4;
+}
+
+message FieldOptions {
+  // Name of the field in YARA rules.
+  //
+  // By default, the name of the field in YARA rules is the same it has in
+  // the protobuf, but sometimes it's useful to override this behaviour and
+  // specify our own name. For instance, suppose we have the following field
+  // definition:
+  //
+  // FileMetadata metadata = 32 [(yara.field_options).name = "meta"];
+  //
+  // The name of the field in the protobuf is "metadata", but this is a
+  // reserved keyword in YARA, so we use (yara.field_options).name = "meta"
+  // for specifying a different name.
+  optional string name = 1;
+
+  // Ignore the field and don't use it in YARA.
+  //
+  // This useful when the protobuf definition has some fields that we don't
+  // want to expose to YARA rules. For example:
+  //
+  // string some_private_data = 32 [(yara.field_options).ignore = true];
+  optional bool ignore = 2;
+
+  // Control under which circumstances the field is accessible by YARA rules.
+  //
+  // In some cases, a field should only be used in YARA rules when certain
+  // requirements are satisfied. Consider the following field definition:
+  //
+  // uint64 my_field = 1 [
+  //   (yara.field_options) = {
+  //     acl: [
+  //       {
+  //         accept_if: ["foo", "FOO"],
+  //         error_title: "foo is required",
+  //         error_label: "this field was used without foo"
+  //       },
+  //       {
+  //         accept_if: "bar",
+  //         error_title: "bar is required",
+  //         error_label: "this field was used without bar"
+  //       },
+  //       {
+  //         reject_if: "baz",
+  //         error_title: "baz is forbidden",
+  //         error_label: "this field was used with baz"
+  //       }
+  //     ]
+  //   }
+  // ];
+  //
+  // The field "my_field" can be used in YARA rules, but only if the features
+  // "foo" (or "FOO") and "bar" are enabled in the YARA compiler, while "baz"
+  // must not be enabled. If these conditions are not met, the compiler will
+  // return an error. For example, if "FOO" and "baz" are enabled, the following
+  // error will occur:
+  //
+  // error[E034]: bar is required
+  //  --> line:5:29
+  //   |
+  // 5 |  my_module.my_field == 0
+  //   |            ^^^^^^^^ this field was used without bar
+  //   |
+  //
+  // Notice that the error message's title and label are derived from the ACL
+  // entry that was not satisfied.
+  //
+  // Also, keep in mind that ACL entries are evaluated sequentially. The first
+  // entry that fails will trigger the corresponding error message.
+  repeated AclEntry acl = 3;
+
+  // Indicates that a string field is always lowercase.
+  //
+  // This option can be used only with fields of type string. If used with some
+  // other type YARA will panic.
+  //
+  // string some_lowercase_string = 32 [(yara.field_options).lowercase = true];
+  optional bool lowercase = 4;
+
+  // Specifies the format of the field when converted to a string.
+  //
+  // This option can be used with integer, float, and boolean fields. It uses
+  // Rust's formatting syntax. For example, if an integer field has `fmt = "{:#x}"`
+  // it will be formatted as a hexadecimal string with a "0x" prefix.
+  optional string fmt = 5;
+}
+
+// An entry in a field's ACL.
+//
+// Each entry in the ACL is a condition that must be met. If some of the
+// conditions in the ACL is not met, the compiler shows an error message that
+// is defined by the ACL entry itself.
+//
+// The condition depends on the features listed in "accept_if" and "reject_if".
+// Let's see some examples:
+//
+// accept_if: "foo"
+//
+// In the example above, the field can be used if the feature "foo" is enabled,
+// otherwise the compiler shows an error.
+//
+// accept_if: ["foo", "bar"]
+//
+// In the example above, the field can be used if any of the features in the
+// list is enabled, otherwise the error is shown. This can be read as: accept
+// if "foo" or "bar".
+//
+// reject_if: ["foo", "bar"]
+//
+// In the example above, the field can be used if none of the features in the
+// list is enabled, otherwise the error is shown. This can be read as: reject
+// if "foo" or "bar".
+message AclEntry {
+  required string error_title = 1;
+  required string error_label = 2;
+  repeated string accept_if = 3;
+  repeated string reject_if = 4;
+}
+
+message MessageOptions {
+  optional string name = 1;
+}
+
+message EnumOptions {
+  optional string name = 1;
+  optional bool inline = 2;
+}
+
+message EnumValueOptions {
+  oneof value {
+    int64 i64 = 1;
+    double f64 = 2;
+  }
+}
+
+extend google.protobuf.FileOptions {
+  optional ModuleOptions module_options = 51503;
+}
+
+extend google.protobuf.FieldOptions {
+  optional FieldOptions field_options = 51504;
+}
+
+extend google.protobuf.MessageOptions {
+  optional MessageOptions message_options = 51505;
+}
+
+extend google.protobuf.EnumOptions {
+  optional EnumOptions enum_options = 51506;
+}
+
+extend google.protobuf.EnumValueOptions {
+  optional EnumValueOptions enum_value = 51507;
+}

{yara_x-1.0.0 → yara_x-1.0.1}/proto-json/build.rs

@@ -5,10 +5,9 @@ fn main() {
     Codegen::new()
         .pure()
         .cargo_out_dir("protos")
-        .include("../proto/src")
         .include("src/tests")
         .include("src")
         .input("src/tests/test.proto")
-        .input("../proto/src/yara.proto")
+        .input("src/yara.proto")
         .run_from_script();
 }

{yara_x-1.0.0 → yara_x-1.0.1}/proto-json/src/lib.rs

@@ -253,7 +253,7 @@ impl<W: Write> Serializer<W> {
                 BASE64_STANDARD.encode(v).paint(self.colors.string)
             )?,
             ReflectValueRef::Enum(d, v) => match d.value_by_number(*v) {
-                Some(e) => write!(self.output, "{}", e.name())?,
+                Some(e) => write!(self.output, "\"{}\"", e.name())?,
                 None => write!(self.output, "{}", v)?,
             },
             ReflectValueRef::Message(msg) => self.write_msg(msg)?,

{yara_x-1.0.0 → yara_x-1.0.1}/proto-json/src/tests/test.proto

@@ -20,4 +20,19 @@ message Message {
   repeated SubMessage repeated_msg = 8;
   optional SubMessage nested_msg = 9;
   optional int32 timestamp= 10 [(yara.field_options).fmt = "t"];
+  optional Enum enum = 11;
+  required uint32 flags = 12 [(yara.field_options).fmt = "flags:Flags"];
+
+}
+
+enum Enum {
+  Foo = 1;
+  Bar = 2;
 }
+
+enum Flags {
+  option (yara.enum_options).inline = true;
+  FOO = 0x1;
+  BAR = 0x2;
+  BAZ = 0x4;
+}

{yara_x-1.0.0 → yara_x-1.0.1}/proto-json/src/tests/testdata/1.in

@@ -4,6 +4,8 @@ str: "foo"
 bool: true
 bytes: "\xCA\xFE"
 timestamp: 0
+enum: Foo
+flags: 3
 repeated_msg {
   i32: 456
   str: "bar\nbar"

{yara_x-1.0.0 → yara_x-1.0.1}/proto-json/src/tests/testdata/1.out

@@ -25,5 +25,7 @@
             "foo": "bar"
         }
     },
-    "timestamp": { "encoding": "timestamp", "value": 0 }
+    "timestamp": { "encoding": "timestamp", "value": 0 },
+    "enum": "Foo",
+    "flags": 3
 }

yara_x-1.0.1/proto-json/src/yara.proto

@@ -0,0 +1,169 @@
+// Protocol buffer that specifies the options that can be used in other protos
+// for controlling the generation of YARA modules.
+
+syntax = "proto2";
+
+package yara;
+
+import "google/protobuf/descriptor.proto";
+
+message ModuleOptions {
+  required string name = 1;
+  required string root_message = 2;
+  optional string rust_module = 3;
+  optional string cargo_feature = 4;
+}
+
+message FieldOptions {
+  // Name of the field in YARA rules.
+  //
+  // By default, the name of the field in YARA rules is the same it has in
+  // the protobuf, but sometimes it's useful to override this behaviour and
+  // specify our own name. For instance, suppose we have the following field
+  // definition:
+  //
+  // FileMetadata metadata = 32 [(yara.field_options).name = "meta"];
+  //
+  // The name of the field in the protobuf is "metadata", but this is a
+  // reserved keyword in YARA, so we use (yara.field_options).name = "meta"
+  // for specifying a different name.
+  optional string name = 1;
+
+  // Ignore the field and don't use it in YARA.
+  //
+  // This useful when the protobuf definition has some fields that we don't
+  // want to expose to YARA rules. For example:
+  //
+  // string some_private_data = 32 [(yara.field_options).ignore = true];
+  optional bool ignore = 2;
+
+  // Control under which circumstances the field is accessible by YARA rules.
+  //
+  // In some cases, a field should only be used in YARA rules when certain
+  // requirements are satisfied. Consider the following field definition:
+  //
+  // uint64 my_field = 1 [
+  //   (yara.field_options) = {
+  //     acl: [
+  //       {
+  //         accept_if: ["foo", "FOO"],
+  //         error_title: "foo is required",
+  //         error_label: "this field was used without foo"
+  //       },
+  //       {
+  //         accept_if: "bar",
+  //         error_title: "bar is required",
+  //         error_label: "this field was used without bar"
+  //       },
+  //       {
+  //         reject_if: "baz",
+  //         error_title: "baz is forbidden",
+  //         error_label: "this field was used with baz"
+  //       }
+  //     ]
+  //   }
+  // ];
+  //
+  // The field "my_field" can be used in YARA rules, but only if the features
+  // "foo" (or "FOO") and "bar" are enabled in the YARA compiler, while "baz"
+  // must not be enabled. If these conditions are not met, the compiler will
+  // return an error. For example, if "FOO" and "baz" are enabled, the following
+  // error will occur:
+  //
+  // error[E034]: bar is required
+  //  --> line:5:29
+  //   |
+  // 5 |  my_module.my_field == 0
+  //   |            ^^^^^^^^ this field was used without bar
+  //   |
+  //
+  // Notice that the error message's title and label are derived from the ACL
+  // entry that was not satisfied.
+  //
+  // Also, keep in mind that ACL entries are evaluated sequentially. The first
+  // entry that fails will trigger the corresponding error message.
+  repeated AclEntry acl = 3;
+
+  // Indicates that a string field is always lowercase.
+  //
+  // This option can be used only with fields of type string. If used with some
+  // other type YARA will panic.
+  //
+  // string some_lowercase_string = 32 [(yara.field_options).lowercase = true];
+  optional bool lowercase = 4;
+
+  // Specifies the format of the field when converted to a string.
+  //
+  // This option can be used with integer, float, and boolean fields. It uses
+  // Rust's formatting syntax. For example, if an integer field has `fmt = "{:#x}"`
+  // it will be formatted as a hexadecimal string with a "0x" prefix.
+  optional string fmt = 5;
+}
+
+// An entry in a field's ACL.
+//
+// Each entry in the ACL is a condition that must be met. If some of the
+// conditions in the ACL is not met, the compiler shows an error message that
+// is defined by the ACL entry itself.
+//
+// The condition depends on the features listed in "accept_if" and "reject_if".
+// Let's see some examples:
+//
+// accept_if: "foo"
+//
+// In the example above, the field can be used if the feature "foo" is enabled,
+// otherwise the compiler shows an error.
+//
+// accept_if: ["foo", "bar"]
+//
+// In the example above, the field can be used if any of the features in the
+// list is enabled, otherwise the error is shown. This can be read as: accept
+// if "foo" or "bar".
+//
+// reject_if: ["foo", "bar"]
+//
+// In the example above, the field can be used if none of the features in the
+// list is enabled, otherwise the error is shown. This can be read as: reject
+// if "foo" or "bar".
+message AclEntry {
+  required string error_title = 1;
+  required string error_label = 2;
+  repeated string accept_if = 3;
+  repeated string reject_if = 4;
+}
+
+message MessageOptions {
+  optional string name = 1;
+}
+
+message EnumOptions {
+  optional string name = 1;
+  optional bool inline = 2;
+}
+
+message EnumValueOptions {
+  oneof value {
+    int64 i64 = 1;
+    double f64 = 2;
+  }
+}
+
+extend google.protobuf.FileOptions {
+  optional ModuleOptions module_options = 51503;
+}
+
+extend google.protobuf.FieldOptions {
+  optional FieldOptions field_options = 51504;
+}
+
+extend google.protobuf.MessageOptions {
+  optional MessageOptions message_options = 51505;
+}
+
+extend google.protobuf.EnumOptions {
+  optional EnumOptions enum_options = 51506;
+}
+
+extend google.protobuf.EnumValueOptions {
+  optional EnumValueOptions enum_value = 51507;
+}

{yara_x-1.0.0 → yara_x-1.0.1}/proto-yaml/build.rs

@@ -5,10 +5,9 @@ fn main() {
     Codegen::new()
         .pure()
         .cargo_out_dir("protos")
-        .include("../proto/src")
         .include("src/tests")
         .include("src")
         .input("src/tests/test.proto")
-        .input("../proto/src/yara.proto")
+        .input("src/yara.proto")
         .run_from_script();
 }