#pragma once #include #include #include #include namespace hex::plugin::yara { class YaraRule { public: YaraRule() = default; explicit YaraRule(const std::string& content); explicit YaraRule(const std::fs::path& path); static void init(); static void cleanup(); struct Match { std::string variable; Region region; bool wholeDataMatch; }; struct Rule { std::string identifier; std::map metadata; std::vector tags; std::vector matches; }; struct Result { std::vector matchedRules; std::vector consoleMessages; }; struct Error { enum class Type { CompileError, RuntimeError, Interrupted } type; std::string message; }; wolv::util::Expected match(prv::Provider *provider, Region region); void interrupt(); [[nodiscard]] bool isInterrupted() const; private: std::string m_content; std::fs::path m_filePath; std::atomic m_interrupted = false; }; }