-
Notifications
You must be signed in to change notification settings - Fork 42
Open
Description
Hi,
I have a problem when wanna formatting my yara rules(rule.text remove my comments).
When we use parse_file() function it will create for us object from <class 'yaramod.YaraFile'>:
yara_file = yaramod.Yaramod().parse_file(in_path)
and when iterating over yara_file rules it will create <class 'yaramod.Rule'> object for us:
yara_file = yaramod.Yaramod().parse_file(in_path):
for rule in yara_file.rules:
.....
In my case, i create include file(include.yar) that contain multiple other yara file paths like below:
include "/path_to_rules/rule1.yar"
include "/path_to_rules/rule2.yar"
.....
When i use rule.text it will give me formatted rule content as i want but it remove all the comments!
yara_file = yaramod.Yaramod().parse_file(in_path):
for rule in yara_file.rules:
print(rule.text)
I need sth like text_formatted that we can use for yaramod.YaraFile object that don't remove yara rule comments when parsing.
I can't parse and use each yara file separately due to some rules use other rules and need to be included before.
nyx0