codekingpro/portable-devtools

1"""2    pygments.lexers.yara3    ~~~~~~~~~~~~~~~~~~~~4 5    Lexers for YARA.6 7    :copyright: Copyright 2006-present by the Pygments team, see AUTHORS.8    :license: BSD, see LICENSE for details.9"""10 11from pygments.lexer import RegexLexer, words12from pygments.token import Comment, String, Name, Text, Punctuation, \13    Operator, Keyword, Whitespace, Number14 15__all__ = ['YaraLexer']16 17 18class YaraLexer(RegexLexer):19    """20    For YARA rules21    """22 23    name = 'YARA'24    url = 'https://virustotal.github.io/yara/'25    aliases = ['yara', 'yar']26    filenames = ['*.yar']27    mimetypes = ['text/x-yara']28    version_added = '2.16'29 30    tokens = {31        'root': [32            (r'\s+', Whitespace),33            (r'//.*?$', Comment.Single),34            (r'\#.*?$', Comment.Single),35            (r'/\*', Comment.Multiline, 'comment'),36            (words(('rule', 'private', 'global', 'import', 'include'),37                   prefix=r'\b', suffix=r'\b'),38             Keyword.Declaration),39            (words(('strings', 'condition', 'meta'), prefix=r'\b', suffix=r'\b'),40             Keyword),41            (words(('ascii', 'at', 'base64', 'base64wide', 'condition',42                    'contains', 'endswith', 'entrypoint', 'filesize', 'for',43                    'fullword', 'icontains', 'iendswith', 'iequals', 'in',44                    'include', 'int16', 'int16be', 'int32', 'int32be', 'int8',45                    'int8be', 'istartswith', 'matches', 'meta', 'nocase',46                    'none', 'of', 'startswith', 'strings', 'them', 'uint16',47                    'uint16be', 'uint32', 'uint32be', 'uint8', 'uint8be',48                    'wide', 'xor', 'defined'),49                   prefix=r'\b', suffix=r'\b'),50             Name.Builtin),51            (r'(true|false)\b', Keyword.Constant),52            (r'(and|or|not|any|all)\b', Operator.Word),53            (r'(\$\w+)', Name.Variable),54            (r'"[^"]*"', String.Double),55            (r'\'[^\']*\'', String.Single),56            (r'\{.*?\}$', Number.Hex),57            (r'(/.*?/)', String.Regex),58            (r'[a-z_]\w*', Name),59            (r'[$(){}[\].?+*|]', Punctuation),60            (r'[:=,;]', Punctuation),61            (r'.', Text)62        ],63        'comment': [64            (r'[^*/]+', Comment.Multiline),65            (r'/\*', Comment.Multiline, '#push'),66            (r'\*/', Comment.Multiline, '#pop'),67            (r'[*/]', Comment.Multiline)68        ]69    }70