goyara

Documentation

Index

• func Load(rules []Rule) (*yara.Rules, error)
• type Rule
• type Scanner
  • func New(rulesPath string) (Scanner, error)
  • func NewFromRules(rules []Rule) (Scanner, error)
  • func (s Scanner) ScanBytes(buff []byte) ([]yara.MatchRule, error)
  • func (s Scanner) ScanFile(filepath string) ([]yara.MatchRule, error)
  • func (s Scanner) ScanProc(pid int) ([]yara.MatchRule, error)

Functions

func Load

func Load(rules []Rule) (*yara.Rules, error)

Load and compile yara rules.

Types

type Rule

type Rule struct {
	Namespace string
	Filename  string
}

Rule represents a Yara rule.

type Scanner

type Scanner struct {
	// contains filtered or unexported fields
}

func New

func New(rulesPath string) (Scanner, error)

func NewFromRules

func NewFromRules(rules []Rule) (Scanner, error)

func (Scanner) ScanBytes

func (s Scanner) ScanBytes(buff []byte) ([]yara.MatchRule, error)

ScanBytes performs a scan over a byte stream.

func (Scanner) ScanFile

func (s Scanner) ScanFile(filepath string) ([]yara.MatchRule, error)

ScanFile performs a scan over a file path.

func (Scanner) ScanProc

func (s Scanner) ScanProc(pid int) ([]yara.MatchRule, error)

ScanProc performs a process scan.