LoadYaraRules compile yara rules from specified paths and return a pointer to the yara compiler
(path []string, rc4key string, verbose bool)
| 83 | |
| 84 | // LoadYaraRules compile yara rules from specified paths and return a pointer to the yara compiler |
| 85 | func LoadYaraRules(path []string, rc4key string, verbose bool) (compiler *yara.Compiler, err error) { |
| 86 | compiler, err = yara.NewCompiler() |
| 87 | if err != nil { |
| 88 | return nil, errors.New("Failed to initialize YARA compiler") |
| 89 | } |
| 90 | |
| 91 | for _, dir := range path { |
| 92 | f, err := os.ReadFile(dir) |
| 93 | if err != nil && verbose { |
| 94 | logMessage(LOG_ERROR, "[ERROR]", "Could not read rule file ", dir, err) |
| 95 | } |
| 96 | |
| 97 | if len(rc4key) > 0 && !bytes.Contains(f, []byte("rule ")) { |
| 98 | c, err := rc4.NewCipher([]byte(rc4key)) |
| 99 | if err != nil { |
| 100 | logMessage(LOG_ERROR, "[ERROR]", err) |
| 101 | } |
| 102 | |
| 103 | c.XORKeyStream(f, f) |
| 104 | } |
| 105 | |
| 106 | namespace := filepath.Base(dir)[:len(filepath.Base(dir))-4] |
| 107 | if err = compiler.AddString(string(f), namespace); err != nil && verbose { |
| 108 | logMessage(LOG_ERROR, "[ERROR]", "Could not load rule file ", dir, err) |
| 109 | } |
| 110 | } |
| 111 | |
| 112 | return compiler, nil |
| 113 | } |
| 114 | |
| 115 | // CompileRules try to compile every rules from the given compiler |
| 116 | func CompileRules(compiler *yara.Compiler) (rules *yara.Rules, err error) { |