Malware Rule Scanner

A utility that loads malware detection rules from a file and scans target data to identify matches.

Capabilities

Rule Loading

• It loads rules from a YARA rule file @test
• It raises an error when the rule file does not exist @test
• It raises an error when the rule file has syntax errors @test

Data Scanning

• It scans binary data and returns matching rule names @test
• It scans data with multiple rules and returns all matches @test
• It returns an empty list when no rules match @test

Implementation

@generates

API

def load_rules(filepath: str):
    """
    Load YARA rules from a file.

    Args:
        filepath: Path to the YARA rules file

    Returns:
        A compiled rules object

    Raises:
        FileNotFoundError: If the rule file does not exist
        SyntaxError: If the rule file contains invalid syntax
    """
    pass

def scan_data(rules, data: bytes) -> list[str]:
    """
    Scan binary data using compiled rules.

    Args:
        rules: Compiled rules object returned by load_rules()
        data: Binary data to scan

    Returns:
        List of rule names that matched (empty list if no matches)
    """
    pass

Dependencies { .dependencies }

yara-python { .dependency }

Provides YARA pattern matching capabilities for malware detection.