New API: yara_load

The yara_load API allows to load a set of Yara rules contained within a
file on the host.

Rules can be in binary format, as when compiled with yarac command, or
in source code format. In the latter case, the rules will be first
compiled and then loaded.

Subsequent calls of the yara_load API will result in the discard of the
previously loaded rules.

Signed-off-by: Matteo Cafasso <noxdafox@gmail.com>
This commit is contained in:
Matteo Cafasso
2017-04-25 23:03:01 +03:00
committed by Richard W.M. Jones
parent 2e24129da3
commit 27f175b717
12 changed files with 305 additions and 2 deletions

View File

@@ -50,7 +50,8 @@ let daemon_functions =
Actions_core_deprecated.daemon_functions @
Actions_debug.daemon_functions @
Actions_hivex.daemon_functions @
Actions_tsk.daemon_functions
Actions_tsk.daemon_functions @
Actions_yara.daemon_functions
(* Some post-processing of the basic lists of actions. *)