ast

package
v0.0.0-...-3c3a7e7 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 25, 2026 License: Apache-2.0 Imports: 8 Imported by: 0

Documentation

Index

Constants

View Source 
const OpMaxPrecedence = 11

OpMaxPrecedence is the maximum possible precedence. This is also the precedence for unary operators "~" and "-".

Variables

View Source 
var OpPrecedence = map[OperatorType]int{
	OpOr:             0,
	OpAnd:            1,
	OpNot:            2,
	OpEqual:          3,
	OpNotEqual:       3,
	OpLessThan:       4,
	OpLessOrEqual:    4,
	OpGreaterThan:    4,
	OpGreaterOrEqual: 4,
	OpContains:       4,
	OpIContains:      4,
	OpStartsWith:     4,
	OpIStartsWith:    4,
	OpEndsWith:       4,
	OpIEndsWith:      4,
	OpIEquals:        4,
	OpMatches:        4,
	OpBitOr:          5,
	OpBitXor:         6,
	OpBitAnd:         7,
	OpShiftLeft:      8,
	OpShiftRight:     8,
	OpAdd:            9,
	OpSub:            9,
	OpMul:            10,
	OpDiv:            10,
	OpMod:            10,
}

OpPrecedence is the operator precedence table.

Functions

func DepthFirstSearch 

func DepthFirstSearch(node Node, v Visitor)

DepthFirstSearch performs a depth-first traversal of the given node's syntax tree. It receives a Visitor that must implement PreOrderVisitor, PostOrderVisitor or both.

func Escape 

func Escape(s string) string

Escape replaces any character outside the printable ASCII range by their corresponding escape sequence (\n, \\, \", etc). Characters that don't have their own escape sequence are replaced by \xHH, where HH is the hex value for the character. Printable ASCII characters remain the same.

Types

type BaseString 

type BaseString struct {
	// Identifier for the string, without the $ prefix.
	Identifier string
	// Line number where the string was defined.
	LineNo int
}

BaseString is a structure that contains the fields that are common to all types of strings. This structure is embedded in TextString, HexString and RegexpString.

func (*BaseString) GetIdentifier 

func (s *BaseString) GetIdentifier() string

func (*BaseString) GetLineNo 

func (s *BaseString) GetLineNo() int

type BitwiseNot 

type BitwiseNot struct {
	Expression Expression
}

BitwiseNot is an Expression that represents the bitwise not operation.

func (*BitwiseNot) AsProto 

func (b *BitwiseNot) AsProto() *pb.Expression

func (*BitwiseNot) Children 

func (b *BitwiseNot) Children() []Node

func (*BitwiseNot) WriteSource 

func (b *BitwiseNot) WriteSource(w io.Writer) error

WriteSource writes the node's source into the writer w.

type Defined 

type Defined struct {
	Expression Expression
}

Defined is an Expression that represents the "defined" operation.

func (*Defined) AsProto 

func (d *Defined) AsProto() *pb.Expression

AsProto returns the Expression serialized as a pb.Expression.

func (*Defined) Children 

func (d *Defined) Children() []Node

func (*Defined) WriteSource 

func (d *Defined) WriteSource(w io.Writer) error

WriteSource writes the node's source into the writer w.

type Enum 

type Enum struct {
	Values []Expression
}

Enum is a Node that represents an enumeration. Example: (1,2,3,4).

func (*Enum) AsProto 

func (e *Enum) AsProto() *pb.IntegerEnumeration

AsProto returns the node serialized as pb.Range.

func (*Enum) Children 

func (e *Enum) Children() []Node

Children returns the Node's children.

func (*Enum) WriteSource 

func (e *Enum) WriteSource(w io.Writer) error

WriteSource writes the node's source into the writer w.

type Expression 

type Expression interface {
	Node
	AsProto() *pb.Expression
}

Expression is the interface implemented by all expressions in the AST. Not all nodes are expressions, but all expressions are nodes. In general, an expression is a Node that can be used as an operand in some kind of operation.

type ForIn 

type ForIn struct {
	Quantifier Expression
	Variables  []string
	Iterator   Node
	Condition  Expression
}

ForIn is an Expression representing a "for in" loop. Example: 

for <quantifier> <variables> in <iterator> : ( <condition> )

func (*ForIn) AsProto 

func (f *ForIn) AsProto() *pb.Expression

AsProto returns the Expression serialized as a pb.Expression.

func (*ForIn) Children 

func (f *ForIn) Children() []Node

Children returns the node's child nodes.

func (*ForIn) WriteSource 

func (f *ForIn) WriteSource(w io.Writer) error

WriteSource writes the node's source into the writer w.

type ForOf 

type ForOf struct {
	Quantifier Expression
	Strings    Node
	Condition  Expression
}

ForOf is an Expression representing a "for of" loop. Example: 

for <quantifier> of <string_set> : ( <condition> )

func (*ForOf) AsProto 

func (f *ForOf) AsProto() *pb.Expression

AsProto returns the Expression serialized as a pb.Expression.

func (*ForOf) Children 

func (f *ForOf) Children() []Node

Children returns the node's child nodes.

func (*ForOf) WriteSource 

func (f *ForOf) WriteSource(w io.Writer) error

WriteSource writes the node's source into the writer w.

type FunctionCall 

type FunctionCall struct {
	Callable  Expression
	Arguments []Expression
	Builtin   bool
}

FunctionCall is an Expression that represents a function call.

func (*FunctionCall) AsProto 

func (f *FunctionCall) AsProto() *pb.Expression

AsProto returns the Expression serialized as a pb.Expression.

func (*FunctionCall) Children 

func (f *FunctionCall) Children() []Node

Children returns the Node's children.

func (*FunctionCall) WriteSource 

func (f *FunctionCall) WriteSource(w io.Writer) error

WriteSource writes the node's source into the writer w.

type Group 

type Group struct {
	Expression Expression
}

Group is an Expression that encloses another Expression in parentheses.

func (*Group) AsProto 

func (g *Group) AsProto() *pb.Expression

func (*Group) Children 

func (g *Group) Children() []Node

Children returns the group's children, which is the expression inside the group.

func (*Group) WriteSource 

func (g *Group) WriteSource(w io.Writer) error

WriteSource writes the node's source into the writer w.

type HexBytes 

type HexBytes struct {
	Bytes []byte
	Masks []byte
	Nots  []bool
}

HexBytes is an HexToken that represents a byte sequence. The bytes are stored in Bytes, while Masks contains a nibble-wise mask for each of the bytes (both arrays have the same length). Possible masks are: 00 -> Full wildcard, the corresponding byte is ignored (??). 0F -> The higher nibble is ignored (?X) F0 -> The lower nibble is ignored (X?) FF -> No wildcard at all. The Nots array is an array of boolean values that indicate which of the bytes are prefixed with a ~ indicating they should NOT be the given value.

func (*HexBytes) AsProto 

func (h *HexBytes) AsProto() *pb.BytesSequence

AsProto returns the Node serialized as pb.String.

func (*HexBytes) Children 

func (h *HexBytes) Children() []Node

Children returns the Node's children.

func (*HexBytes) WriteSource 

func (h *HexBytes) WriteSource(w io.Writer) error

WriteSource writes the node's source into the writer w.

type HexJump 

type HexJump struct {
	Start int
	End   int
}

HexJump is an HexToken that represents a jump in the hex string, like for example the [10-20] jump in {01 02 [10-20] 03 04}. If End is 0, it means infinite, the jump [20-] has Start=20 and End=0.

func (*HexJump) AsProto 

func (h *HexJump) AsProto() *pb.Jump

AsProto returns the Node serialized as pb.String.

func (*HexJump) Children 

func (h *HexJump) Children() []Node

Children returns the Node's children.

func (*HexJump) WriteSource 

func (h *HexJump) WriteSource(w io.Writer) (err error)

WriteSource writes the node's source into the writer w.

type HexOr 

type HexOr struct {
	Alternatives HexTokens
}

HexOr is an HexToken that represents an alternative in the hex string, like the (03 04 | 05 06) alternative in { 01 02 (03 04 | 05 06) 07 08 }. Each item in Alternatives corresponds to an alternative.

func (*HexOr) AsProto 

func (h *HexOr) AsProto() *pb.HexAlternative

AsProto returns the Node serialized as pb.String.

func (*HexOr) Children 

func (h *HexOr) Children() []Node

Children returns the Node's children.

func (*HexOr) WriteSource 

func (h *HexOr) WriteSource(w io.Writer) error

WriteSource writes the node's source into the writer w.

type HexString 

type HexString struct {
	BaseString
	Tokens  HexTokens
	Private bool
}

HexString describes a YARA hex string. Hex strings have an identifier and a sequence of tokens that conform the abstract syntax tree for the hex string. Each token can be any of the following types: 

HexBytes: Represents a sequence of bytes, possibly masked, like:
   01 02 03,  34 ?? A1 F? 03 ?3
HexJump: Represents a jump in the hex string, like:
   [21], [0-100]
HexOr: Represents an alternative, like:
   (A|B), (A|B|C)

func (*HexString) AsProto 

func (h *HexString) AsProto() *pb.String

AsProto returns the string serialized as pb.String.

func (*HexString) String 

func (h *HexString) String() string

func (*HexString) WriteSource 

func (h *HexString) WriteSource(w io.Writer) (err error)

WriteSource writes the node's source into the writer w.

type HexToken 

type HexToken interface {
	Node
}

HexToken is the interface implemented by all types of token

type HexTokens 

type HexTokens []HexToken

HexTokens is a sequence of tokens.

func (HexTokens) AsProto 

func (h HexTokens) AsProto() *pb.HexTokens

AsProto returns the tokens serialized as a pb.HexTokens.

func (HexTokens) Children 

func (h HexTokens) Children() []Node

Children returns the Node's children.

func (HexTokens) WriteSource 

func (h HexTokens) WriteSource(w io.Writer) error

WriteSource writes the node's source into the writer w.

type Identifier 

type Identifier struct {
	Identifier string
}

Identifier is an Expression that represents an identifier.

func (*Identifier) AsProto 

func (i *Identifier) AsProto() *pb.Expression

AsProto returns the Expression serialized as a pb.Expression.

func (*Identifier) Children 

func (i *Identifier) Children() []Node

Children returns the Node's children.

func (*Identifier) WriteSource 

func (i *Identifier) WriteSource(w io.Writer) error

WriteSource writes the node's source into the writer w.

type Keyword 

type Keyword string

Keyword is a Node that represents a keyword. 

const (
	KeywordAll        Keyword = "all"
	KeywordAny        Keyword = "any"
	KeywordNone       Keyword = "none"
	KeywordEntrypoint Keyword = "entrypoint"
	KeywordFalse      Keyword = "false"
	KeywordFilesize   Keyword = "filesize"
	KeywordThem       Keyword = "them"
	KeywordTrue       Keyword = "true"
)

Constants for existing keywords.

func (Keyword) AsProto 

func (k Keyword) AsProto() *pb.Expression

AsProto returns the Expression serialized as a pb.Expression.

func (Keyword) Children 

func (k Keyword) Children() []Node

Children returns nil as a keyword never has children, this function is required anyways in order to satisfy the Node interface.

func (Keyword) WriteSource 

func (k Keyword) WriteSource(w io.Writer) error

WriteSource writes the keyword into the writer w.

type LiteralFloat 

type LiteralFloat struct {
	Value float64
}

LiteralFloat is an Expression that represents a literal float.

func (*LiteralFloat) AsProto 

func (l *LiteralFloat) AsProto() *pb.Expression

AsProto returns the Expression serialized as a pb.Expression.

func (*LiteralFloat) Children 

func (l *LiteralFloat) Children() []Node

Children returns the Node's children.

func (*LiteralFloat) WriteSource 

func (l *LiteralFloat) WriteSource(w io.Writer) error

WriteSource writes the node's source into the writer w.

type LiteralInteger 

type LiteralInteger struct {
	Value int64
	Base  int64
}

LiteralInteger is an Expression that represents a literal integer.

func (*LiteralInteger) AsProto 

func (l *LiteralInteger) AsProto() *pb.Expression

AsProto returns the Expression serialized as a pb.Expression.

func (*LiteralInteger) Children 

func (l *LiteralInteger) Children() []Node

Children returns the Node's children.

func (*LiteralInteger) WriteSource 

func (l *LiteralInteger) WriteSource(w io.Writer) error

WriteSource writes the node's source into the writer w.

type LiteralRegexp 

type LiteralRegexp struct {
	Value     string
	Modifiers RegexpModifiers
}

LiteralRegexp is an Expression that represents a literal regular expression, like for example /ab.*cd/.

func (*LiteralRegexp) AsProto 

func (l *LiteralRegexp) AsProto() *pb.Expression

AsProto returns the Expression serialized as a pb.Expression.

func (*LiteralRegexp) Children 

func (l *LiteralRegexp) Children() []Node

Children returns the Node's children.

func (*LiteralRegexp) String 

func (l *LiteralRegexp) String() string

func (*LiteralRegexp) WriteSource 

func (l *LiteralRegexp) WriteSource(w io.Writer) error

WriteSource writes the node's source into the writer w.

type LiteralString 

type LiteralString struct {
	Value string
}

LiteralString is an Expression that represents a literal string.

func (*LiteralString) AsProto 

func (l *LiteralString) AsProto() *pb.Expression

AsProto returns the Expression serialized as a pb.Expression.

func (*LiteralString) Children 

func (l *LiteralString) Children() []Node

Children returns the Node's children.

func (*LiteralString) String 

func (l *LiteralString) String() string

func (*LiteralString) WriteSource 

func (l *LiteralString) WriteSource(w io.Writer) error

WriteSource writes the node's source into the writer w.

type MemberAccess 

type MemberAccess struct {
	Container Expression
	Member    string
}

MemberAccess is an Expression that represents a member access operation (.). For example, in "foo.bar" we have a MemberAccess operation where Node is the "foo" identifier and the member is "bar".

func (*MemberAccess) AsProto 

func (m *MemberAccess) AsProto() *pb.Expression

AsProto returns the Expression serialized as a pb.Expression.

func (*MemberAccess) Children 

func (m *MemberAccess) Children() []Node

Children returns the node's child nodes.

func (*MemberAccess) WriteSource 

func (m *MemberAccess) WriteSource(w io.Writer) error

WriteSource writes the node's source into the writer w.

type Meta 

type Meta struct {
	Key   string
	Value interface{}
}

Meta represents an entry in a rule's metadata section. Each entry is composed of a key and a value. The value can be either a string, an int64 or a bool. When value is a string it appears exactly as in the source code, escaped characters remain escaped.

func (*Meta) AsProto 

func (m *Meta) AsProto() *pb.Meta

AsProto returns the meta serialized as a Meta protobuf.

func (*Meta) String 

func (m *Meta) String() string

String returns the string representation of a metadata entry.

func (*Meta) UnescapedValue 

func (m *Meta) UnescapedValue() string

UnescapedValue returns the metadata Value with any escape sequence replaced by the actual character that it represents.

type Minus 

type Minus struct {
	Expression Expression
}

Minus is an Expression that represents the unary minus operation.

func (*Minus) AsProto 

func (m *Minus) AsProto() *pb.Expression

AsProto returns the Expression serialized as a pb.Expression.

func (*Minus) Children 

func (m *Minus) Children() []Node

func (*Minus) WriteSource 

func (m *Minus) WriteSource(w io.Writer) error

WriteSource writes the node's source into the writer w.

type Node 

type Node interface {
	// WriteSource writes the source of the node to a writer.
	WriteSource(io.Writer) error
	// Children returns the node's children. The children are returned left to
	// right, if the node represents the operation A + B + C, the children will
	// appear as A, B, C. The result can be nil if the Node does not have
	// children.
	Children() []Node
}

Node is the interface implemented by all types of nodes in the AST.

type Not 

type Not struct {
	Expression Expression
}

Not is an Expression that represents the "not" operation.

func (*Not) AsProto 

func (n *Not) AsProto() *pb.Expression

AsProto returns the Expression serialized as a pb.Expression.

func (*Not) Children 

func (n *Not) Children() []Node

func (*Not) WriteSource 

func (n *Not) WriteSource(w io.Writer) error

WriteSource writes the node's source into the writer w.

type Of 

type Of struct {
	Quantifier  Expression
	Strings     Node
	Rules       Node
	TextStrings []string
	In          *Range
	At          Expression
}

Of is an Expression representing a "of" operation. Example: 

<quantifier> of <string_set>
<quantifier> of <string_set> in <range>

If "In" is non-nil there is an "in" condition: 3 of them in (0..100) If "At" is non-nil there is an "at" condition: 1 of them at 0

func (*Of) AsProto 

func (o *Of) AsProto() *pb.Expression

AsProto returns the Expression serialized as a pb.Expression.

func (*Of) Children 

func (o *Of) Children() []Node

Children returns the node's child nodes.

func (*Of) WriteSource 

func (o *Of) WriteSource(w io.Writer) error

WriteSource writes the node's source into the writer w.

type Operation 

type Operation struct {
	Operator OperatorType
	Operands []Expression
}

Operation is an Expression representing an operation with two or more operands, like "A or B", "A and B and C", "A + B + C", "A - B - C", etc. If there are more than two operands the operation is considered left-associative, it's ok to have a single operation for representing A - B - C, but for A - (B - C) we need two operations with two operands each.

func (*Operation) AsProto 

func (o *Operation) AsProto() *pb.Expression

AsProto returns the Expression serialized as a pb.Expression.

func (*Operation) Children 

func (o *Operation) Children() []Node

Children returns the operation's children nodes.

func (*Operation) WriteSource 

func (o *Operation) WriteSource(w io.Writer) error

WriteSource writes the operation into the writer w.

type OperatorType 

type OperatorType string

OperatorType is the type of operators. 

const (
	OpUnknown        OperatorType = ""
	OpOr             OperatorType = "or"
	OpAnd            OperatorType = "and"
	OpNot            OperatorType = "not"
	OpDefined        OperatorType = "defined"
	OpBitOr          OperatorType = "|"
	OpBitXor         OperatorType = "^"
	OpBitAnd         OperatorType = "&"
	OpEqual          OperatorType = "=="
	OpNotEqual       OperatorType = "!="
	OpLessThan       OperatorType = "<"
	OpGreaterThan    OperatorType = ">"
	OpLessOrEqual    OperatorType = "<="
	OpGreaterOrEqual OperatorType = ">="
	OpAdd            OperatorType = "+"
	OpSub            OperatorType = "-"
	OpMul            OperatorType = "*"
	OpDiv            OperatorType = "\\"
	OpMod            OperatorType = "%"
	OpShiftLeft      OperatorType = "<<"
	OpShiftRight     OperatorType = ">>"
	OpContains       OperatorType = "contains"
	OpIContains      OperatorType = "icontains"
	OpStartsWith     OperatorType = "startswith"
	OpIStartsWith    OperatorType = "istartswith"
	OpEndsWith       OperatorType = "endswith"
	OpIEndsWith      OperatorType = "iendswith"
	OpIEquals        OperatorType = "iequals"
	OpMatches        OperatorType = "matches"
)

Constants that represents operators.

type Percentage 

type Percentage struct {
	Expression Expression
}

Percentage is an Expression used in evaluating string sets. Example: 

<expression>% of <string set>

func (*Percentage) AsProto 

func (p *Percentage) AsProto() *pb.Expression

AsProto returns the Expression serialized as a pb.Expression.

func (*Percentage) Children 

func (p *Percentage) Children() []Node

func (*Percentage) WriteSource 

func (p *Percentage) WriteSource(w io.Writer) error

WriteSource writes the node's source into the writer w.

type PostOrderVisitor 

type PostOrderVisitor interface {
	Visitor
	PostOrderVisit(Node)
}

PostOrderVisitor is the interface that must be implemented by a visitor that wants to be notified about expressions after all of the expression's sub expressions are visited.

type PreOrderVisitor 

type PreOrderVisitor interface {
	Visitor
	PreOrderVisit(Node)
}

PreOrderVisitor is the interface that must be implemented by a visitor that wants to be notified about expressions before any of the expression's sub expressions is visited.

type Range 

type Range struct {
	Start Expression
	End   Expression
}

Range is a Node that represents an integer range. Example: (1..10).

func (*Range) AsProto 

func (r *Range) AsProto() *pb.Range

AsProto returns the node serialized as pb.Range.

func (*Range) Children 

func (r *Range) Children() []Node

Children returns the Node's children.

func (*Range) WriteSource 

func (r *Range) WriteSource(w io.Writer) error

WriteSource writes the node's source into the writer w.

type RegexpModifiers 

type RegexpModifiers int

RegexpModifiers are flags containing the modifiers for a LiteralRegexp. 

const (

	// RegexpCaseInsensitive is the flag corresponding to the /i modifier in a
	// regular expression literal.
	RegexpCaseInsensitive RegexpModifiers = 1 << iota
	// RegexpDotAll is the flag corresponding to the /s modifier in a regular
	// expression literal.
	RegexpDotAll
)

type RegexpString 

type RegexpString struct {
	BaseString
	// Value contains the string exactly as it appears in the YARA rule. Escape
	// sequences remain escaped. See the UnescapeValue function.
	Regexp   *LiteralRegexp
	ASCII    bool
	Wide     bool
	Nocase   bool
	Fullword bool
	Private  bool
}

RegexpString describes a YARA regexp.

func (*RegexpString) AsProto 

func (r *RegexpString) AsProto() *pb.String

AsProto returns the string serialized as pb.String.

func (*RegexpString) String 

func (r *RegexpString) String() string

func (*RegexpString) WriteSource 

func (r *RegexpString) WriteSource(w io.Writer) (err error)

WriteSource writes the node's source into the writer w.

type Rule 

type Rule struct {
	// Line number where the rule starts
	LineNo     int
	Global     bool
	Private    bool
	Identifier string
	Tags       []string
	Meta       []*Meta
	Strings    []String
	Condition  Expression
}

Rule describes a YARA rule.

func RuleFromProto 

func RuleFromProto(r *pb.Rule) *Rule

RuleFromProto creates a Rule from its corresponding protobuf.

func (*Rule) AsProto 

func (r *Rule) AsProto() *pb.Rule

AsProto returns the rule serialized as a Rule protobuf message.

func (*Rule) Children 

func (r *Rule) Children() []Node

Children returns the node's children.

func (*Rule) WriteSource 

func (r *Rule) WriteSource(w io.Writer) error

WriteSource writes the rule's source into the writer w.

type RuleSet 

type RuleSet struct {
	Imports  []string
	Includes []string
	Rules    []*Rule
}

RuleSet describes a set of YARA rules.

func RuleSetFromProto 

func RuleSetFromProto(rs *pb.RuleSet) *RuleSet

RuleSetFromProto creates a RuleSet from its corresponding protobuf.

func (*RuleSet) AsProto 

func (r *RuleSet) AsProto() *pb.RuleSet

AsProto returns the rule set serialized as the RuleSet protobuf message.

func (*RuleSet) WriteSource 

func (r *RuleSet) WriteSource(w io.Writer) error

WriteSource writes the ruleset's source into the writer w.

type String 

type String interface {
	fmt.Stringer
	AsProto() *pb.String
	GetIdentifier() string
	GetLineNo() int
}

String is the interface implemented by the different types of strings that are supported by YARA (i.e: text strings, hex strings and regexps).

type StringCount 

type StringCount struct {
	Identifier string
	In         *Range
}

StringCount is an Expression that represents a string count operation, like "#a". Notice that the Identifier field doesn't contain the # prefix. "In" is non-nil if the identifier is accompanied by an "in" condition, like "#a in (0..100) == 2".

func (*StringCount) AsProto 

func (s *StringCount) AsProto() *pb.Expression

AsProto returns the Expression serialized as a pb.Expression.

func (*StringCount) Children 

func (s *StringCount) Children() []Node

Children returns the Node's children.

func (*StringCount) WriteSource 

func (s *StringCount) WriteSource(w io.Writer) error

WriteSource writes the node's source into the writer w.

type StringIdentifier 

type StringIdentifier struct {
	Identifier string
	At         Expression
	In         *Range
}

StringIdentifier is an Expression that represents a string identifier in the condition, like "$a". The "At" field is non-nil if the identifier comes accompanied by an "at" condition, like "$a at 100". Similarly, "In" is non-nil if the identifier is accompanied by an "in" condition, like "$a in (0..100)". Notice that the Identifier field doesn't contain the $ prefix.

func (*StringIdentifier) AsProto 

func (s *StringIdentifier) AsProto() *pb.Expression

AsProto returns the Expression serialized as a pb.Expression.

func (*StringIdentifier) Children 

func (s *StringIdentifier) Children() []Node

Children returns the Node's children.

func (*StringIdentifier) WriteSource 

func (s *StringIdentifier) WriteSource(w io.Writer) error

WriteSource writes the node's source into the writer w.

type StringLength 

type StringLength struct {
	Identifier string
	Index      Expression
}

StringLength is an Expression that represents a string length operation, like "!a". The "Index" field is non-nil if the count operation is indexed, like in "!a[1]". Notice that the Identifier field doesn't contain the ! prefix.

func (*StringLength) AsProto 

func (s *StringLength) AsProto() *pb.Expression

AsProto returns the Expression serialized as a pb.Expression.

func (*StringLength) Children 

func (s *StringLength) Children() []Node

Children returns the Node's children.

func (*StringLength) WriteSource 

func (s *StringLength) WriteSource(w io.Writer) error

WriteSource writes the node's source into the writer w.

type StringOffset 

type StringOffset struct {
	Identifier string
	Index      Expression
}

StringOffset is an Expression that represents a string offset operation, like "@a". The "Index" field is non-nil if the count operation is indexed, like in "@a[1]". Notice that the Identifier field doesn't contain the @ prefix.

func (*StringOffset) AsProto 

func (s *StringOffset) AsProto() *pb.Expression

AsProto returns the Expression serialized as a pb.Expression.

func (*StringOffset) Children 

func (s *StringOffset) Children() []Node

Children returns the Node's children.

func (*StringOffset) WriteSource 

func (s *StringOffset) WriteSource(w io.Writer) error

WriteSource writes the node's source into the writer w.

type Subscripting 

type Subscripting struct {
	Array Expression
	Index Expression
}

Subscripting is an Expression that represents an array subscripting operation ([]). For example, in "foo[1+2]" we have a Subscripting operation where Array is a Node representing the "foo" identifier and Index is another Node that represents the expression "1+2".

func (*Subscripting) AsProto 

func (s *Subscripting) AsProto() *pb.Expression

AsProto returns the Expression serialized as a pb.Expression.

func (*Subscripting) Children 

func (s *Subscripting) Children() []Node

Children returns the node's child nodes.

func (*Subscripting) WriteSource 

func (s *Subscripting) WriteSource(w io.Writer) error

WriteSource writes the node's source into the writer w.

type TextString 

type TextString struct {
	BaseString
	// Value contains the string exactly as it appears in the YARA rule. Escape
	// sequences remain escaped. See the UnescapedValue function.
	Value          string
	ASCII          bool
	Wide           bool
	Nocase         bool
	Fullword       bool
	Private        bool
	Base64         bool
	Base64Wide     bool
	Base64Alphabet string
	Xor            bool
	XorMin         int32
	XorMax         int32
}

TextString describes a YARA text string.

func (*TextString) AsProto 

func (t *TextString) AsProto() *pb.String

AsProto returns the string serialized as pb.String.

func (*TextString) String 

func (t *TextString) String() string

func (*TextString) UnescapedValue 

func (t *TextString) UnescapedValue() string

UnescapedValue returns the string's Value with any escape sequence replaced by the actual character that it represents.

func (*TextString) WriteSource 

func (t *TextString) WriteSource(w io.Writer) error

WriteSource writes the node's source into the writer w.

type Visitor 

type Visitor interface{}

Visitor is the interface that must be implemented for getting notified about nodes visited during ast traversal.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.