stellarbear / yarasharp Goto Github PK

YSInstance YSInstance = new YSInstance();

Dictionary<string, object> CONST_YS_EXTERNAL_VALUES = 
            new Dictionary<string, object>()
                {
                    { "filename", string.Empty },
                    { "filepath", string.Empty },
                    { "extension", string.Empty }
                };

//	Get list of YARA rules
List<string> ruleFilenames = 
                    Directory.GetFiles(@"F:\Configuration\Yara", "*.yara", SearchOption.AllDirectories).ToList();

YSRules reviewRules = null;

using (YSContext context = new YSContext())
{
    //	Compiling rules
    using (YSCompiler compiler = YSInstance.CompileFromFiles(ruleFilenames, CONST_YS_EXTERNAL_VALUES))
    {
        //  Get compiled rules
        reviewRules = compiler.GetRules();

        YSReport errors = compiler.GetErrors();
        YSReport warnings = compiler.GetWarnings();
    }
}

string[] list = new string[] { "Flare", "Something", "blah blah", "offensive" };
foreach (var TmpVal in list)
{
    byte[] commTextBytes = ASCIIEncoding.ASCII.GetBytes(TmpVal);

    List<YSMatches> Matches =
        YSInstance.ScanMemory(commTextBytes,
                                                  poReviewRules,
                                                  CONST_YS_EXTERNAL_VALUES,
                                                  1000);
}

	List<YSMatches^>^ YSInstance::ScanProcess(int pID, YSRules^ rules, Dictionary<String^, Object^>^ externalVariables, int timeout)
	{
		YSScanner^ PScanner = gcnew YSScanner(rules, externalVariables, timeout);
		try{
			List<YSMatches^>^ results = PScanner->ScanProcess(pID);
			return results;
		}
		catch (System::Exception^ e){
			throw e;
		}
		finally{
			delete PScanner;
		}

	}