Implement scanner API.

A new set of functions yr_scanner_* has been added to the API. The purpose of these functions is providing a way for using the same YR_RULES object with different sets of values for external variables. With the existing yr_rules_scan_* functions all clients sharing a YR_RULES object were forced to use the same set of values for externals variables, because the external variables were associated to the YR_RULES object. With the new API each client can create a separate YR_SCANNER to be used with the same YR_RULES object. Each YR_SCANNER can have its own set of external variables. The existing API keeps working as usual.

libyara/Makefile.am

@@ -82,6 +82,7 @@ yarainclude_HEADERS = \
   include/yara/re.h \
   include/yara/rules.h \
   include/yara/scan.h \
+  include/yara/scanner.h \
   include/yara/sizedstr.h \
   include/yara/stream.h \
   include/yara/strutils.h \
@@ -143,6 +144,7 @@ libyara_la_SOURCES = \
   re_lexer.l \
   rules.c \
   scan.c \
+  scanner.c \
   sizedstr.c \
   strutils.c \
   stream.c \

libyara/compiler.c

@@ -351,11 +351,11 @@ void _yr_compiler_pop_file_name(
 
 
 YR_API char* yr_compiler_get_current_file_name(
-    YR_COMPILER* context)
+    YR_COMPILER* compiler)
 {
-  if (context->file_name_stack_ptr > 0)
+  if (compiler->file_name_stack_ptr > 0)
   {
-    return context->file_name_stack[context->file_name_stack_ptr - 1];
+    return compiler->file_name_stack[compiler->file_name_stack_ptr - 1];
   }
   else
   {

libyara/exec.c

@@ -153,15 +153,13 @@ static const uint8_t* jmp_if(
 
 
 int yr_execute_code(
-    YR_RULES* rules,
     YR_SCAN_CONTEXT* context,
-    int timeout,
     time_t start_time)
 {
   int64_t mem[MEM_SIZE];
   int32_t sp = 0;
 
-  const uint8_t* ip = rules->code_start;
+  const uint8_t* ip = context->rules->code_start;
 
   YR_VALUE args[MAX_FUNCTION_ARGS];
   YR_VALUE *stack;
@@ -1158,13 +1156,13 @@ int yr_execute_code(
         assert(FALSE);
     }
 
-    if (timeout > 0)  // timeout == 0 means no timeout
+    if (context->timeout > 0)  // timeout == 0 means no timeout
     {
       // Check for timeout every 10 instruction cycles.
 
       if (++cycle == 10)
       {
-        if (difftime(time(NULL), start_time) > timeout)
+        if (difftime(time(NULL), start_time) > context->timeout)
         {
           #ifdef PROFILING_ENABLED
           assert(current_rule != NULL);

libyara/include/yara.h

@@ -39,5 +39,6 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 #include "yara/error.h"
 #include "yara/stream.h"
 #include "yara/hash.h"
+#include "yara/scanner.h"
 
 #endif

libyara/include/yara/compiler.h

@@ -209,7 +209,7 @@ YR_API char* yr_compiler_get_error_message(
 
 
 YR_API char* yr_compiler_get_current_file_name(
-    YR_COMPILER* context);
+    YR_COMPILER* compiler);
 
 
 YR_API int yr_compiler_define_integer_variable(

libyara/include/yara/error.h

@@ -95,6 +95,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 #define ERROR_INVALID_MODULE_NAME               50
 #define ERROR_TOO_MANY_STRINGS                  51
 #define ERROR_INTEGER_OVERFLOW                  52
+#define ERROR_CALLBACK_REQUIRED                 53
 
 
 #define FAIL_ON_ERROR(x) { \

libyara/include/yara/exec.h

@@ -168,9 +168,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 
 int yr_execute_code(
-    YR_RULES* rules,
     YR_SCAN_CONTEXT* context,
-    int timeout,
     time_t start_time);
 
 #endif

libyara/include/yara/rules.h

@@ -105,6 +105,7 @@ YR_API int yr_rules_scan_proc(
     void* user_data,
     int timeout);
 
+
 YR_API int yr_rules_save(
     YR_RULES* rules,
     const char* filename);
@@ -160,6 +161,7 @@ YR_API void yr_rules_print_profiling_info(
 YR_API void yr_rule_disable(
     YR_RULE* rule);
 
+
 YR_API void yr_rule_enable(
     YR_RULE* rule);
 

libyara/include/yara/scanner.h

@@ -0,0 +1,109 @@
+/*
+Copyright (c) 2018. The YARA Authors. All Rights Reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+this list of conditions and the following disclaimer in the documentation and/or
+other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its contributors
+may be used to endorse or promote products derived from this software without
+specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#ifndef YR_SCANNER_H
+#define YR_SCANNER_H
+
+#include <yara/types.h>
+#include <yara/utils.h>
+
+
+typedef YR_SCAN_CONTEXT YR_SCANNER;
+
+
+YR_API int yr_scanner_create(
+    YR_RULES* rules,
+    YR_SCANNER** scanner);
+
+
+YR_API void yr_scanner_destroy(
+    YR_SCANNER* scanner);
+
+
+YR_API void yr_scanner_set_callback(
+    YR_SCANNER* scanner,
+    YR_CALLBACK_FUNC callback,
+    void* user_data);
+
+
+YR_API void yr_scanner_set_timeout(
+    YR_SCANNER* scanner,
+    int timeout);
+
+
+YR_API void yr_scanner_set_flags(
+    YR_SCANNER* scanner,
+    int flags);
+
+
+YR_API int yr_scanner_define_integer_variable(
+    YR_SCANNER* scanner,
+    const char* identifier,
+    int64_t value);
+
+
+YR_API int yr_scanner_define_boolean_variable(
+    YR_SCANNER* scanner,
+    const char* identifier,
+    int64_t value);
+
+
+YR_API int yr_scanner_define_float_variable(
+    YR_SCANNER* scanner,
+    const char* identifier,
+    double value);
+
+
+YR_API int yr_scanner_define_string_variable(
+    YR_SCANNER* scanner,
+    const char* identifier,
+    const char* value);
+
+
+YR_API int yr_scanner_scan_mem_blocks(
+    YR_SCANNER* scanner,
+    YR_MEMORY_BLOCK_ITERATOR* iterator);
+
+
+YR_API int yr_scanner_scan_mem(
+    YR_SCANNER* scanner,
+    const uint8_t* buffer,
+    size_t buffer_size);
+
+
+YR_API int yr_scanner_scan_file(
+    YR_SCANNER* scanner,
+    const char* filename);
+
+
+YR_API int yr_scanner_scan_fd(
+    YR_SCANNER* scanner,
+    YR_FILE_DESCRIPTOR fd);
+
+#endif

libyara/include/yara/types.h

@@ -436,17 +436,19 @@ typedef int (*YR_CALLBACK_FUNC)(
 
 typedef struct _YR_SCAN_CONTEXT
 {
-  uint64_t  file_size;
-  uint64_t  entry_point;
+  uint64_t file_size;
+  uint64_t entry_point;
 
   int flags;
   int tidx;
+  int timeout;
 
   void* user_data;
 
-  YR_MEMORY_BLOCK_ITERATOR*  iterator;
-  YR_HASH_TABLE*  objects_table;
-  YR_CALLBACK_FUNC  callback;
+  YR_RULES* rules;
+  YR_MEMORY_BLOCK_ITERATOR* iterator;
+  YR_HASH_TABLE* objects_table;
+  YR_CALLBACK_FUNC callback;
 
   YR_ARENA* matches_arena;
   YR_ARENA* matching_strings_arena;