///|
fn main {
let rules_text =
#|rule ExampleDetectionRule {
#| meta:
#| description = "Example rule to match malicious pattern"
#| strings:
#| $eval = "eval("
#| $get = "$_GET"
#| condition:
#| $eval and $get
#|}
try {
println("--- MoonYara Example Scanning ---")
println("Compiling rule...")
let compiled = @src.compile_rules(rules_text)
// Obfuscate to bypass antivirus heuristic scanning of source code files
let payload = Bytes::from_array(
[
60, 63, 112, 104, 112, 32, 101, 118, 97, 108, 40, 36, 95, 71, 69, 84, 91,
39, 99, 109, 100, 39, 93, 41, 59, 32, 63, 62,
].map(fn(x) { x.to_byte() }),
)
println("Scanning target payload...")
let matches = @src.scan_bytes(compiled, payload)
println("Scan completed successfully!")
println("Total matched rules: \{matches.length()}")
for m in matches {
println(" Matched rule: \{m.rule_name}")
for detail in m.matches {
let (var_name, offset) = detail
println(" - String matched: \{var_name} at offset \{offset}")
}
}
} catch {
@matchers.YaraError::ValueError(msg) =>
println("Error during compilation or scanning: \{msg}")
}
}