YR_API int yr_compiler_get_rules( YR_COMPILER* compiler, YR_RULES** rules) { YR_RULES* yara_rules; YARA_RULES_FILE_HEADER* rules_file_header; *rules = NULL; if (compiler->compiled_rules_arena == NULL) FAIL_ON_ERROR(_yr_compiler_compile_rules(compiler)); yara_rules = (YR_RULES*) yr_malloc(sizeof(YR_RULES)); if (yara_rules == NULL) return ERROR_INSUFICIENT_MEMORY; FAIL_ON_ERROR_WITH_CLEANUP( yr_arena_duplicate(compiler->compiled_rules_arena, &yara_rules->arena), yr_free(yara_rules)); rules_file_header = (YARA_RULES_FILE_HEADER*) yr_arena_base_address( yara_rules->arena); yara_rules->externals_list_head = rules_file_header->externals_list_head; yara_rules->rules_list_head = rules_file_header->rules_list_head; yara_rules->match_table = rules_file_header->match_table; yara_rules->transition_table = rules_file_header->transition_table; yara_rules->code_start = rules_file_header->code_start; yara_rules->tidx_mask = 0; FAIL_ON_ERROR_WITH_CLEANUP( yr_mutex_create(&yara_rules->mutex), // cleanup yr_arena_destroy(yara_rules->arena); yr_free(yara_rules)); *rules = yara_rules; return ERROR_SUCCESS; }
int yr_compiler_get_rules( YR_COMPILER* compiler, YR_RULES** rules) { YR_RULES* yara_rules; YARA_RULES_FILE_HEADER* rules_file_header; *rules = NULL; if (compiler->compiled_rules_arena == NULL) FAIL_ON_ERROR(_yr_compiler_compile_rules(compiler)); yara_rules = yr_malloc(sizeof(YR_RULES)); if (yara_rules == NULL) return ERROR_INSUFICIENT_MEMORY; FAIL_ON_ERROR_WITH_CLEANUP( yr_arena_duplicate(compiler->compiled_rules_arena, &yara_rules->arena), yr_free(yara_rules)); rules_file_header = (YARA_RULES_FILE_HEADER*) yr_arena_base_address( yara_rules->arena); yara_rules->externals_list_head = rules_file_header->externals_list_head; yara_rules->rules_list_head = rules_file_header->rules_list_head; yara_rules->automaton = rules_file_header->automaton; yara_rules->code_start = rules_file_header->code_start; yara_rules->tidx_mask = 0; #if _WIN32 yara_rules->mutex = CreateMutex(NULL, FALSE, NULL); #else pthread_mutex_init(&yara_rules->mutex, NULL); #endif *rules = yara_rules; return ERROR_SUCCESS; }