yara-x 1.5.0__cp38-abi3-manylinux_2_28_aarch64.whl → 1.6.0__cp38-abi3-manylinux_2_28_aarch64.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of yara-x might be problematic. Click here for more details.
yara_x/__init__.pyi
CHANGED
|
@@ -1,6 +1,23 @@
|
|
|
1
|
-
import typing
|
|
2
1
|
import collections
|
|
3
2
|
|
|
3
|
+
from typing import Any, Dict, BinaryIO, TextIO, Optional, Tuple, final
|
|
4
|
+
|
|
5
|
+
class CompileError(Exception):
|
|
6
|
+
r"""
|
|
7
|
+
Error occurred while compiling rules.
|
|
8
|
+
"""
|
|
9
|
+
|
|
10
|
+
class ScanError(Exception):
|
|
11
|
+
r"""
|
|
12
|
+
Error occurred during a scan operation.
|
|
13
|
+
"""
|
|
14
|
+
|
|
15
|
+
class TimeoutError(Exception):
|
|
16
|
+
r"""
|
|
17
|
+
Error indicating that a timeout occurred during a scan operation.
|
|
18
|
+
"""
|
|
19
|
+
|
|
20
|
+
@final
|
|
4
21
|
class Compiler:
|
|
5
22
|
r"""
|
|
6
23
|
Compiles YARA source code producing a set of compiled [`Rules`].
|
|
@@ -34,7 +51,7 @@ class Compiler:
|
|
|
34
51
|
"""
|
|
35
52
|
...
|
|
36
53
|
|
|
37
|
-
def add_source(self, src: str, origin:
|
|
54
|
+
def add_source(self, src: str, origin: Optional[str] = None) -> None:
|
|
38
55
|
r"""
|
|
39
56
|
Adds a YARA source code to be compiled.
|
|
40
57
|
|
|
@@ -56,7 +73,20 @@ class Compiler:
|
|
|
56
73
|
"""
|
|
57
74
|
...
|
|
58
75
|
|
|
59
|
-
def
|
|
76
|
+
def add_include_dir(self, dir: str) -> None:
|
|
77
|
+
r"""
|
|
78
|
+
Adds a directory to the list of directories where the compiler should
|
|
79
|
+
look for included files.
|
|
80
|
+
"""
|
|
81
|
+
...
|
|
82
|
+
|
|
83
|
+
def enable_includes(self, yes: bool) -> None:
|
|
84
|
+
r"""
|
|
85
|
+
Enables or disables the inclusion of files with the `include` directive.
|
|
86
|
+
"""
|
|
87
|
+
...
|
|
88
|
+
|
|
89
|
+
def define_global(self, ident: str, value: Any) -> None:
|
|
60
90
|
r"""
|
|
61
91
|
Defines a global variable and sets its initial value.
|
|
62
92
|
|
|
@@ -105,7 +135,7 @@ class Compiler:
|
|
|
105
135
|
"""
|
|
106
136
|
...
|
|
107
137
|
|
|
108
|
-
def errors(self) ->
|
|
138
|
+
def errors(self) -> Any:
|
|
109
139
|
r"""
|
|
110
140
|
Retrieves all errors generated by the compiler.
|
|
111
141
|
|
|
@@ -114,7 +144,7 @@ class Compiler:
|
|
|
114
144
|
"""
|
|
115
145
|
...
|
|
116
146
|
|
|
117
|
-
def warnings(self) ->
|
|
147
|
+
def warnings(self) -> Any:
|
|
118
148
|
r"""
|
|
119
149
|
Retrieves all warnings generated by the compiler.
|
|
120
150
|
|
|
@@ -135,20 +165,7 @@ class Compiler:
|
|
|
135
165
|
"""
|
|
136
166
|
...
|
|
137
167
|
|
|
138
|
-
|
|
139
|
-
r"""
|
|
140
|
-
Specify required metadata identifiers and types for the values in each
|
|
141
|
-
rule. Any rule which does not meet these requirements will result in a
|
|
142
|
-
compiler warning.
|
|
143
|
-
|
|
144
|
-
The key in your dictionary corresponds to the metadata identifier and
|
|
145
|
-
the value in your dictionary corresponds to the required type for that
|
|
146
|
-
metadata in the rule.
|
|
147
|
-
|
|
148
|
-
Acceptable values are documented in [the config file](https://virustotal.github.io/yara-x/docs/cli/config-file/).
|
|
149
|
-
"""
|
|
150
|
-
...
|
|
151
|
-
|
|
168
|
+
@final
|
|
152
169
|
class Scanner:
|
|
153
170
|
r"""
|
|
154
171
|
Scans data with already compiled YARA rules.
|
|
@@ -170,13 +187,13 @@ class Scanner:
|
|
|
170
187
|
"""
|
|
171
188
|
...
|
|
172
189
|
|
|
173
|
-
def scan_file(self,
|
|
190
|
+
def scan_file(self, path: str) -> ScanResults:
|
|
174
191
|
r"""
|
|
175
192
|
Scans a file
|
|
176
193
|
"""
|
|
177
194
|
...
|
|
178
195
|
|
|
179
|
-
def set_global(self, ident: str, value:
|
|
196
|
+
def set_global(self, ident: str, value: Any) -> None:
|
|
180
197
|
r"""
|
|
181
198
|
Sets the value of a global variable.
|
|
182
199
|
|
|
@@ -196,7 +213,7 @@ class Scanner:
|
|
|
196
213
|
"""
|
|
197
214
|
...
|
|
198
215
|
|
|
199
|
-
def set_timeout(self, seconds: int):
|
|
216
|
+
def set_timeout(self, seconds: int) -> None:
|
|
200
217
|
r"""
|
|
201
218
|
Sets a timeout for each scan.
|
|
202
219
|
|
|
@@ -204,7 +221,7 @@ class Scanner:
|
|
|
204
221
|
"""
|
|
205
222
|
...
|
|
206
223
|
|
|
207
|
-
def console_log(self, callback: collections.abc.Callable[str]):
|
|
224
|
+
def console_log(self, callback: collections.abc.Callable[[str], Any]) -> None:
|
|
208
225
|
r"""
|
|
209
226
|
Sets a callback that is invoked every time a YARA rule calls the
|
|
210
227
|
`console` module.
|
|
@@ -216,20 +233,21 @@ class Scanner:
|
|
|
216
233
|
"""
|
|
217
234
|
...
|
|
218
235
|
|
|
236
|
+
@final
|
|
219
237
|
class Formatter:
|
|
220
238
|
r"""
|
|
221
239
|
Formats YARA rules.
|
|
222
240
|
"""
|
|
223
241
|
def __new__(
|
|
224
242
|
cls,
|
|
225
|
-
align_metadata: bool,
|
|
226
|
-
align_patterns: bool,
|
|
227
|
-
indent_section_headers: bool,
|
|
228
|
-
indent_section_contents: bool,
|
|
229
|
-
indent_spaces: int,
|
|
230
|
-
newline_before_curly_brace: bool,
|
|
231
|
-
empty_line_before_section_header: bool,
|
|
232
|
-
empty_line_after_section_header: bool,
|
|
243
|
+
align_metadata: bool = True,
|
|
244
|
+
align_patterns: bool = True,
|
|
245
|
+
indent_section_headers: bool = True,
|
|
246
|
+
indent_section_contents: bool = True,
|
|
247
|
+
indent_spaces: int = 2,
|
|
248
|
+
newline_before_curly_brace: bool = False,
|
|
249
|
+
empty_line_before_section_header: bool = True,
|
|
250
|
+
empty_line_after_section_header: bool = False,
|
|
233
251
|
) -> Formatter:
|
|
234
252
|
r"""
|
|
235
253
|
Creates a new [`Formatter`].
|
|
@@ -245,73 +263,87 @@ class Formatter:
|
|
|
245
263
|
"""
|
|
246
264
|
...
|
|
247
265
|
|
|
248
|
-
def format(self, input:
|
|
266
|
+
def format(self, input: TextIO, output: TextIO) -> None:
|
|
249
267
|
r"""
|
|
250
268
|
Format a YARA rule
|
|
251
269
|
"""
|
|
252
270
|
...
|
|
253
271
|
|
|
272
|
+
@final
|
|
254
273
|
class Match:
|
|
255
274
|
r"""
|
|
256
275
|
Represents a match found for a pattern.
|
|
257
276
|
"""
|
|
277
|
+
@property
|
|
258
278
|
def offset(self) -> int:
|
|
259
279
|
r"""
|
|
260
280
|
Offset where the match occurred.
|
|
261
281
|
"""
|
|
262
282
|
...
|
|
263
283
|
|
|
284
|
+
@property
|
|
264
285
|
def length(self) -> int:
|
|
265
286
|
r"""
|
|
266
287
|
Length of the match in bytes.
|
|
267
288
|
"""
|
|
268
289
|
...
|
|
269
290
|
|
|
270
|
-
|
|
291
|
+
@property
|
|
292
|
+
def xor_key(self) -> Optional[int]:
|
|
271
293
|
r"""
|
|
272
294
|
XOR key used for decrypting the data if the pattern had the xor
|
|
273
295
|
modifier, or None if otherwise.
|
|
274
296
|
"""
|
|
275
297
|
...
|
|
276
298
|
|
|
299
|
+
@final
|
|
277
300
|
class Pattern:
|
|
278
301
|
r"""
|
|
279
302
|
Represents a pattern in a YARA rule.
|
|
280
303
|
"""
|
|
304
|
+
|
|
305
|
+
@property
|
|
281
306
|
def identifier(self) -> str:
|
|
282
307
|
r"""
|
|
283
308
|
Pattern identifier (e.g: '$a', '$foo').
|
|
284
309
|
"""
|
|
285
310
|
...
|
|
286
311
|
|
|
312
|
+
@property
|
|
287
313
|
def matches(self) -> tuple:
|
|
288
314
|
r"""
|
|
289
315
|
Matches found for this pattern.
|
|
290
316
|
"""
|
|
291
317
|
...
|
|
292
318
|
|
|
319
|
+
@final
|
|
293
320
|
class Rule:
|
|
294
321
|
r"""
|
|
295
322
|
Represents a rule that matched while scanning some data.
|
|
296
323
|
"""
|
|
324
|
+
|
|
325
|
+
@property
|
|
297
326
|
def identifier(self) -> str:
|
|
298
327
|
r"""
|
|
299
328
|
Returns the rule's name.
|
|
300
329
|
"""
|
|
301
330
|
...
|
|
302
331
|
|
|
332
|
+
@property
|
|
303
333
|
def namespace(self) -> str:
|
|
304
334
|
r"""
|
|
305
335
|
Returns the rule's namespace.
|
|
306
336
|
"""
|
|
307
337
|
...
|
|
308
338
|
|
|
339
|
+
@property
|
|
309
340
|
def tags(self) -> tuple:
|
|
310
341
|
r"""
|
|
311
342
|
Returns the rule's tags.
|
|
312
343
|
"""
|
|
313
344
|
...
|
|
314
345
|
|
|
346
|
+
@property
|
|
315
347
|
def metadata(self) -> tuple:
|
|
316
348
|
r"""
|
|
317
349
|
A tuple of pairs `(identifier, value)` with the metadata associated to
|
|
@@ -319,12 +351,14 @@ class Rule:
|
|
|
319
351
|
"""
|
|
320
352
|
...
|
|
321
353
|
|
|
354
|
+
@property
|
|
322
355
|
def patterns(self) -> tuple:
|
|
323
356
|
r"""
|
|
324
357
|
Patterns defined by the rule.
|
|
325
358
|
"""
|
|
326
359
|
...
|
|
327
360
|
|
|
361
|
+
@final
|
|
328
362
|
class Rules:
|
|
329
363
|
r"""
|
|
330
364
|
A set of YARA rules in compiled form.
|
|
@@ -337,30 +371,34 @@ class Rules:
|
|
|
337
371
|
"""
|
|
338
372
|
...
|
|
339
373
|
|
|
340
|
-
def serialize_into(self, file:
|
|
374
|
+
def serialize_into(self, file: BinaryIO) -> None:
|
|
341
375
|
r"""
|
|
342
376
|
Serializes the rules into a file-like object.
|
|
343
377
|
"""
|
|
344
378
|
...
|
|
345
379
|
|
|
346
380
|
@staticmethod
|
|
347
|
-
def deserialize_from(file:
|
|
381
|
+
def deserialize_from(file: BinaryIO) -> Rules:
|
|
348
382
|
r"""
|
|
349
383
|
Deserializes rules from a file-like object.
|
|
350
384
|
"""
|
|
351
385
|
...
|
|
352
386
|
|
|
387
|
+
@final
|
|
353
388
|
class ScanResults:
|
|
354
389
|
r"""
|
|
355
390
|
Results produced by a scan operation.
|
|
356
391
|
"""
|
|
357
|
-
|
|
392
|
+
|
|
393
|
+
@property
|
|
394
|
+
def matching_rules(self) -> Tuple[Rule, ...]:
|
|
358
395
|
r"""
|
|
359
396
|
Rules that matched during the scan.
|
|
360
397
|
"""
|
|
361
398
|
...
|
|
362
399
|
|
|
363
|
-
|
|
400
|
+
@property
|
|
401
|
+
def module_outputs(self) -> Dict[str, Any]:
|
|
364
402
|
r"""
|
|
365
403
|
Module output from the scan.
|
|
366
404
|
"""
|
|
@@ -375,11 +413,12 @@ def compile(src: str) -> Rules:
|
|
|
375
413
|
"""
|
|
376
414
|
...
|
|
377
415
|
|
|
416
|
+
@final
|
|
378
417
|
class Module:
|
|
379
418
|
r"""A YARA-X module."""
|
|
380
419
|
def __new__(cls, name: str) -> Module:
|
|
381
420
|
r"""Creates a new [`Module`] with the given name, which must be a valid YARA-X module name."""
|
|
382
421
|
...
|
|
383
|
-
def invoke(self, data: str) ->
|
|
422
|
+
def invoke(self, data: str) -> Any:
|
|
384
423
|
r"""Parse the data and collect module metadata."""
|
|
385
424
|
...
|
yara_x/yara_x.abi3.so
CHANGED
|
Binary file
|
|
@@ -0,0 +1,7 @@
|
|
|
1
|
+
yara_x/__init__.py,sha256=nMyCIYe2XAcE0xoh-kWfMlEZjVx9_cnT6O6Iaxh9JoM,107
|
|
2
|
+
yara_x/__init__.pyi,sha256=DVMCd5-GS1-Hm2Ib0DpW7OWWF6AOg7mNDXaV0MfRN9s,12469
|
|
3
|
+
yara_x/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
4
|
+
yara_x/yara_x.abi3.so,sha256=OV_dI5CfMjtEOviIXE7UKVvlsFSe_ZXl4ESjf9t6MeM,29888480
|
|
5
|
+
yara_x-1.6.0.dist-info/METADATA,sha256=SKakLaVrPLSAsxlTaGVTeEuxTR-Csa2pKQCcQ3CbaTA,1831
|
|
6
|
+
yara_x-1.6.0.dist-info/WHEEL,sha256=4YzehTP5v_ECFLjrKSt8__9NzqP9o_8NPyyqjbr2W8s,108
|
|
7
|
+
yara_x-1.6.0.dist-info/RECORD,,
|
yara_x-1.5.0.dist-info/RECORD
DELETED
|
@@ -1,7 +0,0 @@
|
|
|
1
|
-
yara_x/__init__.py,sha256=nMyCIYe2XAcE0xoh-kWfMlEZjVx9_cnT6O6Iaxh9JoM,107
|
|
2
|
-
yara_x/__init__.pyi,sha256=T4g5Ujdu3fJ0Zeh5zoeeCZz7Aw1cIaaRjCoTkmclDzI,12055
|
|
3
|
-
yara_x/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
4
|
-
yara_x/yara_x.abi3.so,sha256=K5FKTP7T3ETY_lB6Oj1xPcgu6SUcSWvYJ1RlmCm664w,29251360
|
|
5
|
-
yara_x-1.5.0.dist-info/METADATA,sha256=R8xh9lqnmE-9i-RuvjJsBPnq8obnorzdn7Lqm9dAkxs,1831
|
|
6
|
-
yara_x-1.5.0.dist-info/WHEEL,sha256=UM2O0HsX1GaIwG7rsyBSqHTSnwuh7-Bl3bPRcvjU3Ho,108
|
|
7
|
-
yara_x-1.5.0.dist-info/RECORD,,
|