Generalized and refactored malduck.yara

malduck/__init__.py

@@ -111,7 +111,7 @@
 )
 from .structure import Structure
 from .verify import verify
-from .yara import Yara, YaraString, YaraStringMatch
+from .yara import Yara, YaraString
 
 __all__ = [
     # bits
@@ -240,7 +240,6 @@
     # verify
     "verify",
     # yara
-    "YaraStringMatch",
     "YaraString",
     "Yara",
 ]

malduck/extractor/extract_manager.py

@@ -5,7 +5,7 @@
 from typing import Any, Dict, List, Optional, Type, Union
 
 from ..procmem import ProcessMemory
-from ..yara import Yara, YaraRuleOffsets, YaraRulesetMatch
+from ..yara import RulesetMatch, Yara
 from .extractor import Extractor
 from .loaders import load_modules
 
@@ -308,15 +308,15 @@ def on_extractor_error(
         self.parent.on_extractor_error(exc, extractor, method_name)
 
     def push_procmem(
-        self, p: ProcessMemory, _matches: Optional[YaraRulesetMatch] = None
+        self, p: ProcessMemory, _matches: Optional[RulesetMatch] = None
     ) -> None:
         """
         Pushes ProcessMemory object for extraction
 
         :param p: ProcessMemory object
         :type p: :class:`malduck.procmem.ProcessMemory`
-        :param _matches: YaraRulesetMatch object (used internally)
-        :type _matches: :class:`malduck.yara.YaraRulesetMatch`
+        :param _matches: RulesetMatch object (used internally)
+        :type _matches: :class:`malduck.yara.RulesetMatch`
         """
         matches = _matches or p.yarav(self.parent.rules, extended=True)
         # For each extractor...
@@ -338,7 +338,7 @@ def push_procmem(
                                 DeprecationWarning,
                             )
                             getattr(extractor, "handle_yara")(
-                                p, YaraRuleOffsets(matches[rule])
+                                p, matches.get_ruleset_offsets()[rule]
                             )
                         else:
                             extractor.handle_match(p, matches[rule])

malduck/extractor/extractor.pyi

@@ -17,7 +17,7 @@ from typing import (
 from typing_extensions import Protocol
 
 from ..procmem import ProcessMemory, ProcessMemoryELF, ProcessMemoryPE
-from ..yara import YaraRuleMatch, YaraStringMatch
+from ..yara import RuleMatch, StringMatch
 from .extract_manager import ProcmemExtractManager
 
 Config = Dict[str, Any]
@@ -31,13 +31,11 @@ class _StringOffsetCallback(Protocol[T, U]):
 
 class _StringCallback(Protocol[T, U]):
     def __call__(
-        cls, self: T, p: U, addr: int, match: YaraStringMatch
+        cls, self: T, p: U, addr: int, match: StringMatch
     ) -> Union[Config, bool, None]: ...
 
 class _RuleCallback(Protocol[T, U]):
-    def __call__(
-        cls, self: T, p: U, match: YaraRuleMatch
-    ) -> Union[Config, bool, None]: ...
+    def __call__(cls, self: T, p: U, match: RuleMatch) -> Union[Config, bool, None]: ...
 
 class _FinalCallback(Protocol[T, U]):
     def __call__(cls, self: T, p: U) -> Union[Config, bool, None]: ...
@@ -109,7 +107,7 @@ class Extractor:
     def log(self) -> logging.Logger: ...
     def _get_methods(self, method_type: Type[V]) -> Iterator[Tuple[str, V]]: ...
     def on_error(self, exc: Exception, method_name: str) -> None: ...
-    def handle_match(self, p: ProcessMemory, match: YaraRuleMatch) -> None: ...
+    def handle_match(self, p: ProcessMemory, match: RuleMatch) -> None: ...
     # Extractor method decorators
     @overload
     @staticmethod

malduck/procmem/procmem.pyi

@@ -18,7 +18,7 @@ from typing_extensions import Literal, Protocol
 from ..disasm import Instruction
 from ..extractor import ExtractManager, ExtractorModules
 from ..ints import IntType
-from ..yara import Yara, YaraRulesetMatch, YaraRulesetOffsets
+from ..yara import RulesetMatch, RulesetOffsets, Yara
 from .region import Region
 
 class MemoryBuffer(object):
@@ -39,15 +39,15 @@ class ProcessMemoryYaraCallback(Protocol):
         addr: Optional[int],
         length: Optional[int],
         extended: Literal[True],
-    ) -> YaraRulesetMatch: ...
+    ) -> RulesetMatch: ...
     @overload
     def __call__(
         self,
         ruleset: Yara,
         offset: Optional[int],
         length: Optional[int],
         extended: Literal[True],
-    ) -> YaraRulesetMatch: ...
+    ) -> RulesetMatch: ...
 
 class ProcessMemory:
     f: Optional[BinaryIO]
@@ -242,7 +242,7 @@ class ProcessMemory:
         offset: Optional[int] = None,
         length: Optional[int] = None,
         extended: Literal[False] = False,
-    ) -> YaraRulesetOffsets: ...
+    ) -> RulesetOffsets: ...
     # yarap(ruleset, offset, length, extended=True)
     @overload
     def yarap(
@@ -251,21 +251,21 @@ class ProcessMemory:
         offset: Optional[int],
         length: Optional[int],
         extended: Literal[True],
-    ) -> YaraRulesetMatch: ...
+    ) -> RulesetMatch: ...
     # yarap(ruleset, extended=True)
     @overload
-    def yarap(self, ruleset: Yara, *, extended: Literal[True]) -> YaraRulesetMatch: ...
+    def yarap(self, ruleset: Yara, *, extended: Literal[True]) -> RulesetMatch: ...
     # yarap(ruleset, offset=0, extended=True)
     # yarap(ruleset, 0, extended=True)
     @overload
     def yarap(
         self, ruleset: Yara, offset: Optional[int], *, extended: Literal[True]
-    ) -> YaraRulesetMatch: ...
+    ) -> RulesetMatch: ...
     # yarap(ruleset, length=0, extended=True)
     @overload
     def yarap(
         self, ruleset: Yara, *, length: Optional[int], extended: Literal[True]
-    ) -> YaraRulesetMatch: ...
+    ) -> RulesetMatch: ...
     # yarav(ruleset)
     # yarav(ruleset, addr)
     # yarav(ruleset, addr, length)
@@ -277,7 +277,7 @@ class ProcessMemory:
         addr: Optional[int] = None,
         length: Optional[int] = None,
         extended: Literal[False] = False,
-    ) -> YaraRulesetOffsets: ...
+    ) -> RulesetOffsets: ...
     # yarav(ruleset, addr, length, extended=True)
     @overload
     def yarav(
@@ -286,21 +286,21 @@ class ProcessMemory:
         addr: Optional[int],
         length: Optional[int],
         extended: Literal[True],
-    ) -> YaraRulesetMatch: ...
+    ) -> RulesetMatch: ...
     # yarav(ruleset, extended=True)
     @overload
-    def yarav(self, ruleset: Yara, *, extended: Literal[True]) -> YaraRulesetMatch: ...
+    def yarav(self, ruleset: Yara, *, extended: Literal[True]) -> RulesetMatch: ...
     # yarav(ruleset, addr=0, extended=True)
     # yarav(ruleset, 0, extended=True)
     @overload
     def yarav(
         self, ruleset: Yara, addr: Optional[int], *, extended: Literal[True]
-    ) -> YaraRulesetMatch: ...
+    ) -> RulesetMatch: ...
     # yarav(ruleset, length=0, extended=True)
     @overload
     def yarav(
         self, ruleset: Yara, *, length: Optional[int], extended: Literal[True]
-    ) -> YaraRulesetMatch: ...
+    ) -> RulesetMatch: ...
     def _findbytes(
         self,
         yara_fn: ProcessMemoryYaraCallback,