Native bindings for the Yara library from VirusTotal. Only works with Yara v4.
More documentation can be found on the Yara's documentation.
By default, this crate uses bindgen to generate bindings on-the-fly, but you can also use the following features to use pre-built bindings file for different version of Yara. Just make sure the version you specify is the same that the version on your system!
bindgen
: recommended: this is the default feature, to use generated bindings.bundled-4_1_2
: use pre-generated bindings for Yara 4.1.2. Useful if you do not
want to install LLVM to run bindgen. However, you'll have to make sure you use
a version of Yara with the same major and minor version number.vendored
: automatically compile and link libyara v4.1.2.You can specify the location of Yara:
YARA_LIBRARY_PATH
environment
variable.YARA_INCLUDE_DIR
environment
variable, if you use the bindgen
feature.You can specify compile options for libyara v4.1.2 if choice vendored
(0
- disable, 1
- enable):
- YARAENABLEPROFILING - enable rules profiling support (default: Disable)
- YARAENABLENDEBUG - enable NDEBUG (default: Enable)
- YARAENABLEHASH - enable hash module (default: Disable)
- YARAENABLEMAGIC - enable magic module (depends on libmagic) (default: Disable)
- YARAENABLECUCKOO - enable cuckoo module (depends on Jansson for parsing JSON) (default: Disable)
- YARAENABLEDOTNET - enable dotnet module (default: Enable)
- YARAENABLEDEX - enable dex module (default: Enable)
- YARAENABLEDEXDEBUG - enable dex module debugging (default: Disable)
- YARAENABLEMACHO - enable macho module (default: Enable)
- YARAENABLECRYPTO - enable OpenSSL (default: Enable)
- YARADEBUGVERBOSITY - Set debug level information on runtime (default: 0)
- OPENSSLLIB_DIR - path to OpenSSL library directory
Licensed under either of
at your option.