Run yara-x rules against small blocks of sbufs#487

Draft

jonstewart wants to merge 6 commits intomainfrom

Commits on Mar 21, 2025

configure should check for existence of yara_x_capi and link against it if enabled and present
jonstewart
committed
create a stub scanner for scan_yarax, with the config symbol being HAVE_YARAX
jonstewart
committed

Commits on Mar 22, 2025

basic scanning of sbufs with yara_x implemented. This uses a hard-coded rule that is unlikely to generate matches and it also does not use feature-recorders to record any matches. But it does get c…
jonstewart
committed
Create a yara-x feature recorder and write the names of matching rules with the block/forensic path of the data block that triggered the rule.
jonstewart
committed

Commits on Mar 23, 2025

Report on the block size offset (4KB-aligned) of a rule match, not just the much larger bulk_extractor page offset (typically 16MB).
jonstewart
committed

Commits on Mar 26, 2025

Added a new --yara_x_rules CLI option for specifying a directory of .yar files containing rules to be loaded. Uses these for scanning 4KB chunks at a time. Added a semi-duplicative second scanning …
jonstewart
committed