yara-rust
yara-rust copied to clipboard
feat: add ability to set module data in scan callback
Some modules in YARA need to be fed data to be usable, notably the cuckoo module. This works by setting the module data in the "import module" callback, as can be seen here:
https://github.com/VirusTotal/yara/blob/923368eab/cli/yara.c#L1200
This MR adds bindings to be able to do exactly this: the object related to this callback msg is wrapped in a YrModuleImport object, which exposes two functions:
- one to retrieve the module name
- one to set the module data
This makes the code looks like this:
let report = r#"{ "network": ... }"#;
let res = yara_scanner.scan_mem_callback(b"", |msg| {
if let yara::CallbackMsg::ImportModule(mut module) = msg {
if module.name() == Some(b"cuckoo") {
// Safety: report is alive for longer than the scan.
unsafe {
module.set_module_data(
report.as_mut_ptr().cast(),
report.len(),
);
}
}
}
yara::CallbackReturn::Continue
});
I haven't added a test for it, because the only module that uses this is the cuckoo module, and to use it, the module-cuckoo feature must be enabled and the libjansson-dev needs to be installed. If you prefer to have a test, I can try to update the CI to have a test like this working.
Looks like the macos-latest runner was updated from 12.7 to 14.4 and it no longer works well, i don't think it's related to my changes
I also don't see a better way to expose the setter for module data, without asking for a box or some complicated lifetimes stunts. LGTM, thanks!