yara-x icon indicating copy to clipboard operation
yara-x copied to clipboard

Implement API for accessing module outputs in Go library

Open xorhex opened this issue 1 year ago • 1 comments

Reviewing the python documentation, one can get the module outputs. How does one access this structure when using golang as Scan returns the matching rules without the module outputs (as far as I can tell)?

// Scan scans the provided data with the Rules associated to the Scanner.
func (s *Scanner) Scan(buf []byte) ([]*Rule, error) {
	var ptr *C.uint8_t
	// When `buf` is an empty slice `ptr` will be nil. That's ok, because
	// yrx_scanner_scan allows the data pointer to be null as long as the data
	// size is 0.
	if len(buf) > 0 {
		ptr = (*C.uint8_t)(unsafe.Pointer(&(buf[0])))
	}

	s.matchingRules = nil

	runtime.LockOSThread()
	defer runtime.UnlockOSThread()

	var err error
	switch r := C.yrx_scanner_scan(s.cScanner, ptr, C.size_t(len(buf))); r {
	case C.SUCCESS:
		err = nil
	case C.SCAN_TIMEOUT:
		err = ErrTimeout
	default:
		err = errors.New(C.GoString(C.yrx_last_error()))
	}

	return s.matchingRules, err
}

xorhex avatar Aug 13 '24 14:08 xorhex

Module outputs are are not implemented in the Golang API yet.

plusvic avatar Aug 13 '24 20:08 plusvic