Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Add support for rule metadata to be output in scan mode #170

Merged
merged 9 commits into from
Aug 2, 2024

Commits on Aug 1, 2024

  1. Add -m to scan.

    This adds support for the -m flag (print metadata) so that rule metadata is
    printed when a scan matches. Currently only outputs in text form, json will be
    next.
    wxsBSD committed Aug 1, 2024
    Configuration menu
    Copy the full SHA
    a8cee79 View commit details
    Browse the repository at this point in the history
  2. Configuration menu
    Copy the full SHA
    1ca78b3 View commit details
    Browse the repository at this point in the history
  3. Implement -m for json output.

    wxsBSD committed Aug 1, 2024
    Configuration menu
    Copy the full SHA
    9629b5d View commit details
    Browse the repository at this point in the history

Commits on Aug 2, 2024

  1. Configuration menu
    Copy the full SHA
    6b608cf View commit details
    Browse the repository at this point in the history
  2. Implement xor output in scan command.

    If a string is using the xor modifier we now display the xor information (key
    and plaintext) in both text and json output modes.
    
    ```
    wxs@mbp yara-x % ./target/debug/yr scan -o ndjson -s rules/a.yara ~/src/yara/tests/data/xor.out | jq .
    {
      "path": "/Users/wxs/src/yara/tests/data/xor.out",
      "rules": [
        {
          "identifier": "freebsd",
          "strings": [
            {
              "identifier": "$a",
              "start": 28,
              "length": 19,
              "data": "Uihr!qsnfs`l!b`oonu",
              "xor_key": 1,
              "plaintext": "This program cannot"
            },
            {
              "identifier": "$a",
              "start": 52,
              "length": 19,
              "data": "Vjkq\\\"rpmepco\\\"acllmv",
              "xor_key": 2,
              "plaintext": "This program cannot"
            },
            {
              "identifier": "$b",
              "start": 4,
              "length": 19,
              "data": "This program cannot"
            }
          ]
        }
      ]
    }
    wxs@mbp yara-x % ./target/debug/yr scan -s rules/a.yara ~/src/yara/tests/data/xor.out
    freebsd /Users/wxs/src/yara/tests/data/xor.out
    0x1c:19:$a xor(0x1,This program cannot): Uihr!qsnfs`l!b`oonu
    0x34:19:$a xor(0x2,This program cannot): Vjkq\"rpmepco\"acllmv
    0x4:19:$b: This program cannot
    ────────────────────────────────────────────────────────────────────────────────────────────────────────────────
     1 file(s) scanned in 0.0s. 1 file(s) matched.
    wxs@mbp yara-x %
    ```
    
    When using --print-strings-limit it looks like this in text mode:
    
    ```
    wxs@mbp yara-x % ./target/debug/yr scan -s --print-strings-limit 5 rules/a.yara ~/src/yara/tests/data/xor.out
    freebsd /Users/wxs/src/yara/tests/data/xor.out
    0x1c:19:$a xor(0x1,This ): Uihr! ... 14 more bytes
    0x34:19:$a xor(0x2,This ): Vjkq\" ... 14 more bytes
    0x4:19:$b: This  ... 14 more bytes
    ────────────────────────────────────────────────────────────────────────────────────────────────────────────────
     1 file(s) scanned in 0.0s. 1 file(s) matched.
    wxs@mbp yara-x %
    ```
    
    Not sure if we want to print the "... X more bytes" part in the plaintext or
    just leave it implied.
    
    I've also included a bug fix here where we were only printing the last matching
    pattern.
    wxsBSD committed Aug 2, 2024
    Configuration menu
    Copy the full SHA
    df11ab2 View commit details
    Browse the repository at this point in the history
  3. Configuration menu
    Copy the full SHA
    160f98d View commit details
    Browse the repository at this point in the history
  4. style: fix clippy warnings

    plusvic committed Aug 2, 2024
    Configuration menu
    Copy the full SHA
    25a9ac6 View commit details
    Browse the repository at this point in the history
  5. style: apply rustfmt

    plusvic committed Aug 2, 2024
    Configuration menu
    Copy the full SHA
    6838515 View commit details
    Browse the repository at this point in the history
  6. Configuration menu
    Copy the full SHA
    edd000b View commit details
    Browse the repository at this point in the history