File Coverage

blib/lib/Metabrik/String/Yara.pm

Criterion	Covered	Total	%
statement	9	31	29.0
branch	0	10	0.0
condition			n/a
subroutine	3	6	50.0
pod	1	3	33.3
total	13	50	26.0

#
# $Id$
#
# string::yara Brik
#
package Metabrik::String::Yara;
use strict;
use warnings;

use base qw(Metabrik);

sub brik_properties {
   return {
      revision => '$Revision$',
      tags => [ qw(unstable encode decode) ],
      author => 'GomoR ',
      license => 'http://opensource.org/licenses/BSD-3-Clause',
      commands => {
         encode => [ qw($data_hash) ],
         decode => [ qw($data_string) ],
      },
      require_modules => {
         'Parse::YARA' => [ ],
      },
   };
}

# Takes a hash and return a YARA string
sub encode {
   my $self = shift;
   my ($data) = @_;

   $self->brik_help_run_undef_arg('encode', $data) or return;
   $self->brik_help_run_invalid_arg('encode', $data, 'HASH') or return;

   my $encoded = '';
   eval {
      $encoded = Parse::YARA->new(rulehash => $data, disable_includes => 0, verbose => 0);
   };
   if ($@) {
      chomp($@);
      return $self->log->error("encode: unable to encode YARA: $@");
   }

   return $encoded->as_string;
}

# Takes a YARA string and return a hash
sub decode {
   my $self = shift;
   my ($data) = @_;

   $self->brik_help_run_undef_arg('decode', $data) or return;

   my $decoded = '';
   eval {
      $decoded = Parse::YARA->new(rule => $data, disable_includes => 0, verbose => 0);
   };
   if ($@) {
      chomp($@);
      return $self->log->error("decode: unable to decode YARA: $@");
   }

   return $decoded->{rules};
}

1;

__END__