hillu/go-yara

Question: Adding multiple Compiled YARA files to a single yara.Scanner or *yara.Rules

zdiff opened this issue · 1 comments

I have several compiled YARA files that I am able to load with yara.ReadRules(), but I'd like to use them all with a single instance of yara.NewScanner(). I do not have access to the original plaintext rules. Is it possible to combine several *yara.Rules so that I only have to create a single yara.Scanner? It is possible to create a []yara.Rule from a *yara.Rules type using rules.GetRules(); is it possible to do the opposite and convert a []yara.Rule to a *yara.Rules type?

Merging multiple yara.Rules objects (which are just thin wrappers around struct YR_RULES) is not possible, due to a limitation in YARA itself.