#include #include // Define the callback function int callback(int message, void* message_data, void* user_data) { // Implement your callback logic here if (message == CALLBACK_MSG_RULE_MATCHING) { // A rule matching event occurred YR_RULE* rule = (YR_RULE*)message_data; printf("Match found for rule: %s\n", rule->identifier); } else { // Print other callback messages printf("Callback: Message received with code %d\n", message); } return CALLBACK_CONTINUE; } int main() { printf("Initializing libyara...\n"); // Initialize libyara if (yr_initialize() != 0) { // Handle initialization error printf("Error: Failed to initialize libyara\n"); return 1; } printf("Libyara initialized successfully\n"); printf("Loading compiled rules from file...\n"); // Load the compiled rules from a file YR_RULES* rules; if (yr_rules_load("./compiled_rules_file.yac", &rules) != 0) { // Handle rules loading error printf("Error: Failed to load rules from file\n"); yr_finalize(); // Finalize libyara before exiting return 1; } printf("Rules loaded successfully\n"); printf("Creating a scanner...\n"); // Create a scanner YR_SCANNER* scanner; if (yr_scanner_create(rules, &scanner) != 0) { // Handle scanner creation error printf("Error: Failed to create scanner\n"); yr_rules_destroy(rules); // Destroy the rules before exiting yr_finalize(); // Finalize libyara before exiting return 1; } printf("Scanner created successfully\n"); printf("Setting up callback...\n"); // Set up the callback function yr_scanner_set_callback(scanner, (YR_CALLBACK_FUNC)callback, NULL); printf("Scanning a file...\n"); // Scan a file int scan_result = yr_scanner_scan_file(scanner, "./file.txt"); if (scan_result != 0) { // Handle scanning error printf("Error: Failed to scan file. Error code: %d\n", scan_result); YR_RULE* last_error_rule = yr_scanner_last_error_rule(scanner); if (last_error_rule != NULL) { printf("Last error rule: %s\n", last_error_rule->identifier); } YR_STRING* last_error_string = yr_scanner_last_error_string(scanner); if (last_error_string != NULL) { printf("Last error string: %s\n", last_error_string->identifier); } yr_scanner_destroy(scanner); // Destroy the scanner before exiting yr_rules_destroy(rules); // Destroy the rules before exiting yr_finalize(); // Finalize libyara before exiting return 1; } printf("File scanned successfully\n"); // Destroy scanner and rules, and finalize libyara yr_scanner_destroy(scanner); yr_rules_destroy(rules); yr_finalize(); printf("Libyara finalized successfully\n"); return 0; }