yara-ffi
A Ruby library for using libyara via FFI.
Installation
Add this line to your application's Gemfile:
gem "yara"And then execute:
$ bundle install
Or install it yourself as:
$ gem install yara-ffi
Usage
Yara.start # run before you start using the Yara API.
rule = <<-RULE
rule ExampleRule
{
meta:
string_meta = "an example rule for testing"
strings:
$my_text_string = "we were here"
$my_text_regex = /were here/
condition:
$my_text_string or $my_text_regex
}
RULE
scanner = Yara::Scanner.new
scanner.add_rule(rule)
scanner.compile
result = scanner.call("one day we were here and then we were not").first
result.match?
# => true
scanner.close # run when you are done using the scanner API and want to free up memory.
Yara.stop # run when you are completely done using the Yara API to free up memory.Development
After checking out the repo, run bin/setup to install dependencies. Then, run rake test to run the tests. You can also run bin/console for an interactive prompt that will allow you to experiment.
Contributing
Bug reports and pull requests are welcome on GitHub at https://github.com/jonmagic/yara-ffi. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the code of conduct.
License
The gem is available as open source under the terms of the MIT License.
Code of Conduct
Everyone interacting in the Yara::Ffi project's codebases, issue trackers, chat rooms and mailing lists is expected to follow the code of conduct.