stellarbear / yarasharp Goto Github PK
View Code? Open in Web Editor NEWC# wrapper around the Yara pattern matching library
License: MIT License
C# wrapper around the Yara pattern matching library
License: MIT License
I would like to add rules or patterns, but couldn't find any refs. My boss told me to use this library for full-text search engine. So I just want to search a txt file for search words.
I guess I can add some rules below...
YSRules rules = compiler.GetRules();
I added two new functions according to my own needs.
โ
1. CompileFromString -> Instance.cpp
2. CompileFromFile -> Instance.cpp
I hope it helps :)
I want to add rules using a string and not a external file
I'm attempting to use the library via a simple example:
YSInstance YSInstance = new YSInstance();
Dictionary<string, object> CONST_YS_EXTERNAL_VALUES =
new Dictionary<string, object>()
{
{ "filename", string.Empty },
{ "filepath", string.Empty },
{ "extension", string.Empty }
};
// Get list of YARA rules
List<string> ruleFilenames =
Directory.GetFiles(@"F:\Configuration\Yara", "*.yara", SearchOption.AllDirectories).ToList();
YSRules reviewRules = null;
using (YSContext context = new YSContext())
{
// Compiling rules
using (YSCompiler compiler = YSInstance.CompileFromFiles(ruleFilenames, CONST_YS_EXTERNAL_VALUES))
{
// Get compiled rules
reviewRules = compiler.GetRules();
YSReport errors = compiler.GetErrors();
YSReport warnings = compiler.GetWarnings();
}
}
string[] list = new string[] { "Flare", "Something", "blah blah", "offensive" };
foreach (var TmpVal in list)
{
byte[] commTextBytes = ASCIIEncoding.ASCII.GetBytes(TmpVal);
List<YSMatches> Matches =
YSInstance.ScanMemory(commTextBytes,
poReviewRules,
CONST_YS_EXTERNAL_VALUES,
1000);
}
But when I call "ScanMemory()", I get the following result:
System.AccessViolationException: 'Attempted to read or write protected memory. This is often an indication that other memory is corrupt.'
Have you seen this before?
Trying to recompile the project to target .net 3.5, but can't locate four dependencies and not sure where to find them after searching everywhere.
Is there a nuget service I should be using to find:
YARA.Jansson.x64 / YARA.Jansson.x86
YARA.OpenSSL.x64 / YARA.OpenSSL.x86
Or are these just normal Jansson/OpenSLL projects that have been renamed/recompiled?
Hi,
in Instance.cpp an exception can be thrown, as a result the "delete PScanner;" will not be called
adding try...catch...finally... or try...finally... should fix the issue
in case of an exception the YSScanner is not disposed
List<YSMatches^>^ YSInstance::ScanProcess(int pID, YSRules^ rules, Dictionary<String^, Object^>^ externalVariables, int timeout)
{
YSScanner^ PScanner = gcnew YSScanner(rules, externalVariables, timeout);
try{
List<YSMatches^>^ results = PScanner->ScanProcess(pID);
return results;
}
catch (System::Exception^ e){
throw e;
}
finally{
delete PScanner;
}
}
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.