private string PopulateYaraInfo(List <YaraFilter> yaraFilters)
{
List <string> distinctRulesToRun =
yaraFilters
.SelectMany(yf => yf.ProcessRule(this))
.Distinct()
.OrderBy(s => s)
.ToList();
if (!distinctRulesToRun.Any())
{
distinctRulesToRun =
yaraFilters
.Where(yf => yf.FilterType == YaraFilterType.ElseNoMatch)
.SelectMany(yf => yf.OnMatchRules)
.Distinct()
.ToList();
}
if (!distinctRulesToRun.Any())
{
return(string.Empty);
}
_timingMetrics.Start(TimingMetric.YaraIndexBuilding);
string yaraIndexContents = YaraHelper.MakeYaraIndexFile(distinctRulesToRun);
string indexFileHash = Hash.ByteArray.Sha256(Encoding.UTF8.GetBytes(yaraIndexContents));
string yaraIndexFilename = Path.Combine(Path.GetTempPath(), $"{indexFileHash}-index.yar");
if (!File.Exists(yaraIndexFilename))
{
File.WriteAllText(yaraIndexFilename, yaraIndexContents);
}
_timingMetrics.Stop(TimingMetric.YaraIndexBuilding);
return(yaraIndexFilename);
}