1"""
2 pygments.lexers.yara
3 ~~~~~~~~~~~~~~~~~~~~
4
5 Lexers for YARA.
6
7 :copyright: Copyright 2006-2025 by the Pygments team, see AUTHORS.
8 :license: BSD, see LICENSE for details.
9"""
10
11from pygments.lexer import RegexLexer, words
12from pygments.token import Comment, String, Name, Text, Punctuation, \
13 Operator, Keyword, Whitespace, Number
14
15__all__ = ['YaraLexer']
16
17
18class YaraLexer(RegexLexer):
19 """
20 For YARA rules
21 """
22
23 name = 'YARA'
24 url = 'https://virustotal.github.io/yara/'
25 aliases = ['yara', 'yar']
26 filenames = ['*.yar']
27 mimetypes = ['text/x-yara']
28 version_added = '2.16'
29
30 tokens = {
31 'root': [
32 (r'\s+', Whitespace),
33 (r'//.*?$', Comment.Single),
34 (r'\#.*?$', Comment.Single),
35 (r'/\*', Comment.Multiline, 'comment'),
36 (words(('rule', 'private', 'global', 'import', 'include'),
37 prefix=r'\b', suffix=r'\b'),
38 Keyword.Declaration),
39 (words(('strings', 'condition', 'meta'), prefix=r'\b', suffix=r'\b'),
40 Keyword),
41 (words(('ascii', 'at', 'base64', 'base64wide', 'condition',
42 'contains', 'endswith', 'entrypoint', 'filesize', 'for',
43 'fullword', 'icontains', 'iendswith', 'iequals', 'in',
44 'include', 'int16', 'int16be', 'int32', 'int32be', 'int8',
45 'int8be', 'istartswith', 'matches', 'meta', 'nocase',
46 'none', 'of', 'startswith', 'strings', 'them', 'uint16',
47 'uint16be', 'uint32', 'uint32be', 'uint8', 'uint8be',
48 'wide', 'xor', 'defined'),
49 prefix=r'\b', suffix=r'\b'),
50 Name.Builtin),
51 (r'(true|false)\b', Keyword.Constant),
52 (r'(and|or|not|any|all)\b', Operator.Word),
53 (r'(\$\w+)', Name.Variable),
54 (r'"[^"]*"', String.Double),
55 (r'\'[^\']*\'', String.Single),
56 (r'\{.*?\}$', Number.Hex),
57 (r'(/.*?/)', String.Regex),
58 (r'[a-z_]\w*', Name),
59 (r'[$(){}[\].?+*|]', Punctuation),
60 (r'[:=,;]', Punctuation),
61 (r'.', Text)
62 ],
63 'comment': [
64 (r'[^*/]+', Comment.Multiline),
65 (r'/\*', Comment.Multiline, '#push'),
66 (r'\*/', Comment.Multiline, '#pop'),
67 (r'[*/]', Comment.Multiline)
68 ]
69 }