feat: implemented the string module

yara-x/Cargo.toml

@@ -24,6 +24,11 @@ test_proto3-module = []
 text-module = [
     "dep:lingua"
 ]
+# The Time module allows you to retrieve epoch in seconds that can
+# be used in conditions of a rule to check againts other epoch time.
+time-module = []
+# The Strings Module
+string-module = []
 
 # Features that are enabled by default.
 default = [
@@ -62,7 +67,6 @@ yara-x-proto = { workspace = true }
 
 lingua = { version = "1.4.0", optional = true, default-features = false, features = ["english", "german", "french", "spanish"] }
 
-
 [build-dependencies]
 protobuf = { workspace = true }
 protobuf-codegen = { workspace = true }

yara-x/src/modules/modules.rs

@@ -1,7 +1,11 @@
 // File generated automatically by build.rs. Do not edit.
+#[cfg(feature = "string-module")]
+pub mod string;
 #[cfg(feature = "text-module")]
 pub mod text;
 #[cfg(feature = "test_proto2-module")]
 pub mod test_proto2;
+#[cfg(feature = "time-module")]
+pub mod time;
 #[cfg(feature = "test_proto3-module")]
 pub mod test_proto3;

yara-x/src/modules/protos/string.proto

@@ -0,0 +1,13 @@
+syntax = "proto2";
+
+import "yara.proto";
+
+option (yara.module_options) = {
+  name : "string"
+  root_message: "String"
+  rust_module: "string"
+};
+
+message String {
+  // This module contains only exported functions, and doesn't return any data
+}

yara-x/src/modules/protos/time.proto

@@ -0,0 +1,13 @@
+syntax = "proto2";
+
+import "yara.proto";
+
+option (yara.module_options) = {
+  name : "time"
+  root_message: "Time"
+  rust_module: "time"
+};
+
+message Time {
+  // This module contains only exported functions, and doesn't return any data
+}

yara-x/src/modules/string.rs

@@ -0,0 +1,72 @@
+use crate::modules::prelude::*;
+use crate::modules::protos::string::*;
+
+#[module_main]
+fn main(_ctx: &ScanContext) -> String {
+    // Nothing to do, but we have to return our protobuf
+    String::new()
+}
+
+#[module_export]
+fn to_int(ctx: &ScanContext, string: RuntimeString) -> Option<i64> {
+    let string = string.to_str(ctx).ok()?;
+    string.parse::<i64>().ok()
+}
+
+#[module_export(name = "to_int")]
+fn to_int_base(
+    ctx: &ScanContext,
+    string: RuntimeString,
+    base: i64,
+) -> Option<i64> {
+    let base: u32 = base.try_into().ok()?;
+    if !(2..=36).contains(&base) {
+        return None;
+    }
+    let string = string.as_bstr(ctx).to_str().ok()?;
+    i64::from_str_radix(string, base).ok()
+}
+
+#[module_export]
+fn length(ctx: &ScanContext, string: RuntimeString) -> Option<i64> {
+    Some(string.as_bstr(ctx).len().try_into().unwrap())
+}
+
+#[cfg(test)]
+mod tests {
+    #[test]
+    fn end2end() {
+        let rules = crate::compiler::Compiler::new()
+            .add_source(
+                r#"import "string"
+                // True
+                rule rule_1 { condition: string.length("AXsx00ERS") == 9 }
+                rule rule_2 { condition: string.length("AXsx00ERS") == 9 }
+                // False
+                rule rule_3 { condition: string.length("AXsx00ERS") > 9 }
+                rule rule_4 { condition: string.length("AXsx00ERS") < 9 }
+
+
+                // True
+                rule rule_5 { condition: string.to_int("1234") == 1234 }
+                rule rule_6 { condition: string.to_int("-10") == -10 }
+                // False
+                rule rule_7 { condition: string.to_int("-10") == -8 }
+
+
+                // True
+                rule rule_8 { condition: string.to_int("A", 16) == 10 }
+                rule rule_9 { condition: string.to_int("011", 8) == 9 }
+                // False
+                rule rule_10 { condition: string.to_int("-011", 0) == -9 }
+                "#,
+            )
+            .unwrap()
+            .build()
+            .unwrap();
+
+        let mut scanner = crate::scanner::Scanner::new(&rules);
+
+        assert_eq!(scanner.scan(&[]).num_matching_rules(), 6);
+    }
+}

yara-x/src/modules/time.rs

@@ -0,0 +1,41 @@
+use crate::modules::prelude::*;
+use crate::modules::protos::time::*;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+#[module_main]
+fn main(_ctx: &ScanContext) -> Time {
+    // Nothing to do, but we have to return our protobuf
+    let time_proto = Time::new();
+    time_proto
+}
+
+#[module_export]
+fn now(ctx: &ScanContext) -> Option<i64> {
+    match SystemTime::now().duration_since(UNIX_EPOCH) {
+        Ok(n) => return Some(n.as_secs() as i64),
+        Err(_) => return None,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    #[test]
+    fn end2end() {
+        let rules = crate::compiler::Compiler::new()
+            .add_source(
+                r#"import "time"
+                rule rule_1 { condition: time.now() >= 0 }
+                rule rule_2 { condition: time.now() <= 0 }
+                rule rule_3 { condition: time.now() != 0 }
+                rule rule_4 { condition: time.now() == 0 }
+                "#,
+            )
+            .unwrap()
+            .build()
+            .unwrap();
+
+        let mut scanner = crate::scanner::Scanner::new(&rules);
+
+        assert_eq!(scanner.scan(&[]).num_matching_rules(), 2);
+    }
+}