From db3072630a3fe6e42882a13d16f97ea8e69a0573 Mon Sep 17 00:00:00 2001 From: WerWolv Date: Fri, 28 Oct 2022 14:32:56 +0200 Subject: [PATCH] feat: Allow multiple yara rules to be applied after each otherr --- .../source/content/views/view_yara.cpp | 26 ++++++++++++++++--- plugins/builtin/source/lang/de_DE.cpp | 1 + plugins/builtin/source/lang/en_US.cpp | 1 + plugins/builtin/source/lang/it_IT.cpp | 1 + plugins/builtin/source/lang/ja_JP.cpp | 1 + plugins/builtin/source/lang/ko_KR.cpp | 1 + plugins/builtin/source/lang/pt_BR.cpp | 1 + 7 files changed, 29 insertions(+), 3 deletions(-) diff --git a/plugins/builtin/source/content/views/view_yara.cpp b/plugins/builtin/source/content/views/view_yara.cpp index 00dd99eef..fde275dac 100644 --- a/plugins/builtin/source/content/views/view_yara.cpp +++ b/plugins/builtin/source/content/views/view_yara.cpp @@ -59,7 +59,13 @@ namespace hex::plugin::builtin { } ImGui::SameLine(); if (ImGui::Button("hex.builtin.view.yara.reload"_lang)) this->reloadRules(); + + ImGui::NewLine(); if (ImGui::Button("hex.builtin.view.yara.match"_lang)) this->applyRules(); + ImGui::SameLine(); + ImGui::BeginDisabled(this->m_matches.empty()); + if (ImGui::Button("hex.builtin.view.yara.reset"_lang)) this->clearResult(); + ImGui::EndDisabled(); } ImGui::EndDisabled(); @@ -171,8 +177,6 @@ namespace hex::plugin::builtin { } void ViewYara::applyRules() { - this->clearResult(); - this->m_matcherTask = TaskManager::createTask("hex.builtin.view.yara.matching", 0, [this](auto &task) { if (!ImHexApi::Provider::isValid()) return; @@ -334,9 +338,25 @@ namespace hex::plugin::builtin { TaskManager::doLater([this, resultContext] { - this->m_matches = resultContext.newMatches; + for (const auto &match : this->m_matches) { + ImHexApi::HexEditor::removeBackgroundHighlight(match.highlightId); + ImHexApi::HexEditor::removeTooltip(match.tooltipId); + } + this->m_consoleMessages = resultContext.consoleMessages; + std::move(resultContext.newMatches.begin(), resultContext.newMatches.end(), std::back_inserter(this->m_matches)); + + auto uniques = std::set(this->m_matches.begin(), this->m_matches.end(), [](const auto &l, const auto &r) { + return l.address < r.address && + l.size < r.size && + l.wholeDataMatch < r.wholeDataMatch && + l.identifier < r.identifier && + l.variable < r.variable; + }); + this->m_matches.clear(); + std::move(uniques.begin(), uniques.end(), std::back_inserter(this->m_matches)); + constexpr static color_t YaraColor = 0x70B4771F; for (auto &match : this->m_matches) { match.highlightId = ImHexApi::HexEditor::addBackgroundHighlight({ match.address, match.size }, YaraColor); diff --git a/plugins/builtin/source/lang/de_DE.cpp b/plugins/builtin/source/lang/de_DE.cpp index 0362fee2e..658396c89 100644 --- a/plugins/builtin/source/lang/de_DE.cpp +++ b/plugins/builtin/source/lang/de_DE.cpp @@ -407,6 +407,7 @@ namespace hex::plugin::builtin { { "hex.builtin.view.yara.header.rules", "Regeln" }, { "hex.builtin.view.yara.reload", "Neu laden" }, { "hex.builtin.view.yara.match", "Regeln anwenden" }, + { "hex.builtin.view.yara.reset", "Zurücksetzen" }, { "hex.builtin.view.yara.matching", "Anwenden..." }, { "hex.builtin.view.yara.error", "Yara Kompilerfehler: " }, { "hex.builtin.view.yara.header.matches", "Funde" }, diff --git a/plugins/builtin/source/lang/en_US.cpp b/plugins/builtin/source/lang/en_US.cpp index 3aead816b..ab6f21bb0 100644 --- a/plugins/builtin/source/lang/en_US.cpp +++ b/plugins/builtin/source/lang/en_US.cpp @@ -410,6 +410,7 @@ namespace hex::plugin::builtin { { "hex.builtin.view.yara.header.rules", "Rules" }, { "hex.builtin.view.yara.reload", "Reload" }, { "hex.builtin.view.yara.match", "Match Rules" }, + { "hex.builtin.view.yara.reset", "Reset" }, { "hex.builtin.view.yara.matching", "Matching..." }, { "hex.builtin.view.yara.error", "Yara Compiler error: " }, { "hex.builtin.view.yara.header.matches", "Matches" }, diff --git a/plugins/builtin/source/lang/it_IT.cpp b/plugins/builtin/source/lang/it_IT.cpp index e87e7aa48..786dfdba3 100644 --- a/plugins/builtin/source/lang/it_IT.cpp +++ b/plugins/builtin/source/lang/it_IT.cpp @@ -413,6 +413,7 @@ namespace hex::plugin::builtin { { "hex.builtin.view.yara.header.rules", "Regola" }, { "hex.builtin.view.yara.reload", "Ricarica" }, { "hex.builtin.view.yara.match", "Abbina Regole" }, + //{ "hex.builtin.view.yara.reset", "Reset" }, { "hex.builtin.view.yara.matching", "Abbinamento..." }, { "hex.builtin.view.yara.error", "Errore compilazione Yara: " }, { "hex.builtin.view.yara.header.matches", "Abbinamenti" }, diff --git a/plugins/builtin/source/lang/ja_JP.cpp b/plugins/builtin/source/lang/ja_JP.cpp index 2f58fe32a..94b2673bd 100644 --- a/plugins/builtin/source/lang/ja_JP.cpp +++ b/plugins/builtin/source/lang/ja_JP.cpp @@ -412,6 +412,7 @@ namespace hex::plugin::builtin { { "hex.builtin.view.yara.header.rules", "ルール" }, { "hex.builtin.view.yara.reload", "リロード" }, { "hex.builtin.view.yara.match", "検出" }, + //{ "hex.builtin.view.yara.reset", "Reset" }, { "hex.builtin.view.yara.matching", "マッチ中…" }, { "hex.builtin.view.yara.error", "Yaraコンパイルエラー: " }, { "hex.builtin.view.yara.header.matches", "マッチ結果" }, diff --git a/plugins/builtin/source/lang/ko_KR.cpp b/plugins/builtin/source/lang/ko_KR.cpp index 9a035e5cd..a1e82998c 100644 --- a/plugins/builtin/source/lang/ko_KR.cpp +++ b/plugins/builtin/source/lang/ko_KR.cpp @@ -409,6 +409,7 @@ namespace hex::plugin::builtin { { "hex.builtin.view.yara.header.rules", "규칙" }, { "hex.builtin.view.yara.reload", "재검사" }, { "hex.builtin.view.yara.match", "일치하는 규칙" }, + //{ "hex.builtin.view.yara.reset", "Reset" }, { "hex.builtin.view.yara.matching", "검색 중..." }, { "hex.builtin.view.yara.error", "Yara 컴파일러 에러: " }, { "hex.builtin.view.yara.header.matches", "규칙" }, diff --git a/plugins/builtin/source/lang/pt_BR.cpp b/plugins/builtin/source/lang/pt_BR.cpp index 7880e9951..7cd41ea5e 100644 --- a/plugins/builtin/source/lang/pt_BR.cpp +++ b/plugins/builtin/source/lang/pt_BR.cpp @@ -409,6 +409,7 @@ namespace hex::plugin::builtin { { "hex.builtin.view.yara.header.rules", "Regras" }, { "hex.builtin.view.yara.reload", "Recarregar" }, { "hex.builtin.view.yara.match", "Combinar Regras" }, + //{ "hex.builtin.view.yara.reset", "Reset" }, { "hex.builtin.view.yara.matching", "Combinando..." }, { "hex.builtin.view.yara.error", "Erro do compilador Yara: " }, { "hex.builtin.view.yara.header.matches", "Combinações" },