#include "Stdafx.h" // CRules namespace YaraSharp { CRules::operator YR_RULES*() { return Rules; } CRules::CRules(YR_RULES* rules) : Rules(rules) { } CRules::~CRules() { if (Rules) yr_rules_destroy(Rules); } } // CRule namespace YaraSharp { CRule::CRule() { Namespace = nullptr; Identifier = nullptr; Tags = gcnew List(); // Strings = gcnew List(); Meta = gcnew Dictionary(); } CRule::CRule(YR_RULE* Rule) { Namespace = nullptr; Tags = CRule::GetRuleTags(Rule); Meta = CRule::GetRuleMeta(Rule); // Strings = CRule::GetRuleStrings(Rule); Identifier = gcnew String(Rule->identifier); } List^ CRule::GetRuleTags(YR_RULE* Rule) { List^ Result = gcnew List(); const char* TagEntry; yr_rule_tags_foreach(Rule, TagEntry) Result->Add(gcnew String(TagEntry)); return Result; } List^ CRule::GetRuleStrings(YR_RULE* Rule) { List^ Result = gcnew List(); YR_STRING* StringEntry; yr_rule_strings_foreach(Rule, StringEntry) Result->Add(gcnew String(StringEntry->identifier)); return Result; } Dictionary^ CRule::GetRuleMeta(YR_RULE* Rule) { Dictionary^ Result = gcnew Dictionary(); YR_META* MetaEntry; yr_rule_metas_foreach(Rule, MetaEntry) { if (MetaEntry->identifier == NULL) throw gcnew NullReferenceException("(Meta) Значение не может быть пустым"); String^ MetaID = gcnew String(MetaEntry->identifier); Object^ MetaValue = nullptr; switch (MetaEntry->type) { case META_TYPE_BOOLEAN: MetaValue = (bool)(MetaEntry->integer == 1); break; case META_TYPE_INTEGER: MetaValue = (Int32)MetaEntry->integer; break; case META_TYPE_STRING: MetaValue = gcnew String(MetaEntry->string); break; } // Отсеиваем дубликаты if (!Result->ContainsKey(MetaID)) Result->Add(MetaID, MetaValue); } return Result; } }