Question: Adding multiple Compiled YARA files to a single yara.Scanner or *yara.Rules
zdiff opened this issue · 1 comments
zdiff commented
I have several compiled YARA files that I am able to load with yara.ReadRules()
, but I'd like to use them all with a single instance of yara.NewScanner()
. I do not have access to the original plaintext rules. Is it possible to combine several *yara.Rules
so that I only have to create a single yara.Scanner
? It is possible to create a []yara.Rule
from a *yara.Rules
type using rules.GetRules()
; is it possible to do the opposite and convert a []yara.Rule
to a *yara.Rules
type?
hillu commented
Merging multiple yara.Rules
objects (which are just thin wrappers around struct YR_RULES
) is not possible, due to a limitation in YARA itself.