YARA-X

YARA-X is a re-incarnation of YARA, a pattern matching tool designed with malware researchers in mind. This new incarnation intends to be faster, safer and more user-friendly than its predecessor. The ultimate goal of YARA-X is to serve as the future replacement for YARA.

News are coming, stay tuned!

lib.rs:

Serializes a Protocol Buffer (protobuf) message to YAML.

This crates serializes arbitrary protobuf messages to YAML format, producing YAML that is user-friendly, customizable and colorful. Some aspects of the produced YAML can be customized by using specific options in your .proto files. Let's use the following protobuf message definition as an example:

import "yaml.proto";

message MyMessage {
optional int32 some_field = 1 [(yaml.field).fmt = "x"];
}

The first think to note is the import "yaml.proto" statement before the message definition. The yaml.proto file defines the existing YAML formatting options, so you must include it in your own .proto file in order to be able to use the such options.

The [(yaml.field).fmt = "x"] modifier, when applied to some field, indicates that values of that field must be rendered in hexadecimal form. The list of supported format modifiers is:

• x: Serializes the value an hexadecimal number. Only valid for integer fields.
• t: Serializes the field as a timestamp. The value itself is rendered as a decimal integer, but a comment is added with the timestamp in a human-friendly format. Only valid for integer fields.

Examples

Protobuf definition:

import "yaml.proto";

message MyMessage {
optional int32 some_field = 1 [(yaml.field).fmt = "x"];
optional int64 some_timestamp = 2 [(yaml.field).fmt = "t"];
}

YAML output:

some_field: 0x8b1;
timestamp: 999999999 # 2001-09-09 01:46:39 UTC