Start using bitmap for tracking rule matches.

libyara/compiler.c

@@ -693,6 +693,9 @@ static int _yr_compiler_compile_rules(
 
   if (result == ERROR_SUCCESS)
   {
+    rules_file_header->num_rules = compiler->current_rule_idx;
+    rules_file_header->num_strings = compiler->current_string_idx;
+
     rules_file_header->rules_list_head = (YR_RULE*) \
         yr_arena2_get_ptr(compiler->arena, YR_RULES_TABLE, 0);
 
@@ -824,6 +827,8 @@ YR_API int yr_compiler_get_rules(
   rules_file_header = (YARA_RULES_FILE_HEADER*) yr_arena_base_address(
       yara_rules->arena);
 
+  yara_rules->num_rules = rules_file_header->num_rules;
+  yara_rules->num_strings = rules_file_header->num_strings;
   yara_rules->externals_list_head = rules_file_header->externals_list_head;
   yara_rules->rules_list_head = rules_file_header->rules_list_head;
   yara_rules->ac_match_table = rules_file_header->ac_match_table;

libyara/exec.c

@@ -777,9 +777,16 @@ int yr_execute_code(
         rule = &context->rules->rules_list_head[r1.i];
 
         if (RULE_IS_DISABLED(rule))
+        {
           r2.i = UNDEFINED;
+        }
         else
-          r2.i = rule->t_flags[tidx] & RULE_TFLAGS_MATCH ? 1 : 0;
+        {
+          if yr_bitmask_isset(context->rule_matches_flags, r1.i)
+            r2.i = 1;
+          else
+            r2.i = 0;
+        }
 
         push(r2);
         break;
@@ -813,7 +820,7 @@ int yr_execute_code(
         #endif
 
         if (!is_undef(r1) && r1.i)
-          rule->t_flags[tidx] |= RULE_TFLAGS_MATCH;
+          yr_bitmask_set(context->rule_matches_flags, r2.i);
         else if (RULE_IS_GLOBAL(rule))
           rule->ns->t_flags[tidx] |= NAMESPACE_TFLAGS_UNSATISFIED_GLOBAL;
 

libyara/include/yara/types.h

@@ -403,6 +403,9 @@ typedef uint32_t  YR_AC_TRANSITION;
 
 typedef struct YARA_RULES_FILE_HEADER
 {
+  uint32_t num_rules;
+  uint32_t num_strings;
+
   DECLARE_REFERENCE(YR_RULE*, rules_list_head);
   DECLARE_REFERENCE(YR_EXTERNAL_VARIABLE*, externals_list_head);
   DECLARE_REFERENCE(const uint8_t*, code_start);
@@ -585,6 +588,9 @@ struct YR_RULES
   YR_AC_MATCH* ac_match_pool;
   uint32_t* ac_match_table;
 
+  uint32_t num_rules;
+  uint32_t num_strings;
+
   // Size of ac_match_table and ac_transition_table in number of items (both
   // tables have the same number of items).
   uint32_t ac_tables_size;
@@ -719,6 +725,10 @@ struct YR_SCAN_CONTEXT
 
   // Fiber pool used by yr_re_exec.
   RE_FIBER_POOL re_fiber_pool;
+
+  // A bitmap with one bit per rule, bit N is set when the rule with index N
+  // has matched.
+  YR_BITMASK* rule_matches_flags;
 };
 
 

libyara/scanner.c

@@ -196,6 +196,9 @@ YR_API int yr_scanner_create(
   new_scanner->entry_point = UNDEFINED;
   new_scanner->canary = rand();
 
+  new_scanner->rule_matches_flags = yr_calloc(
+      sizeof(YR_BITMASK), YR_BITMASK_SIZE(rules->num_rules));
+
   external = rules->externals_list_head;
 
   while (!EXTERNAL_VARIABLE_IS_NULL(external))
@@ -249,6 +252,7 @@ YR_API void yr_scanner_destroy(
         (YR_HASH_TABLE_FREE_VALUE_FUNC) yr_object_destroy);
   }
 
+  yr_free(scanner->rule_matches_flags);
   yr_free(scanner);
 }
 
@@ -356,6 +360,7 @@ YR_API int yr_scanner_scan_mem_blocks(
   YR_RULE* rule;
   YR_MEMORY_BLOCK* block;
 
+  int i;
   int tidx = 0;
   int result = ERROR_SUCCESS;
 
@@ -460,11 +465,11 @@ YR_API int yr_scanner_scan_mem_blocks(
   if (result != ERROR_SUCCESS)
     goto _exit;
 
-  yr_rules_foreach(rules, rule)
+  for (i = 0, rule = rules->rules_list_head; !RULE_IS_NULL(rule); i++, rule++)
   {
     int message;
 
-    if (rule->t_flags[tidx] & RULE_TFLAGS_MATCH &&
+    if (yr_bitmask_isset(scanner->rule_matches_flags, i) &&
         !(rule->ns->t_flags[tidx] & NAMESPACE_TFLAGS_UNSATISFIED_GLOBAL))
     {
       message = CALLBACK_MSG_RULE_MATCHING;

tests/test-alignment.c

@@ -107,13 +107,13 @@ int main (int argc, char **argv)
   CHECK_OFFSET(YR_AC_MATCH, 16, forward_code);
   CHECK_OFFSET(YR_AC_MATCH, 24, backward_code);
   CHECK_OFFSET(YR_AC_MATCH, 32, next);
-  CHECK_SIZE(YARA_RULES_FILE_HEADER, 56);
-  CHECK_OFFSET(YARA_RULES_FILE_HEADER, 0, rules_list_head);
-  CHECK_OFFSET(YARA_RULES_FILE_HEADER, 8, externals_list_head);
-  CHECK_OFFSET(YARA_RULES_FILE_HEADER, 16, code_start);
-  CHECK_OFFSET(YARA_RULES_FILE_HEADER, 24, ac_match_pool);
-  CHECK_OFFSET(YARA_RULES_FILE_HEADER, 32, ac_match_table);
-  CHECK_OFFSET(YARA_RULES_FILE_HEADER, 40, ac_transition_table);
+  CHECK_SIZE(YARA_RULES_FILE_HEADER, 64);
+  CHECK_OFFSET(YARA_RULES_FILE_HEADER, 8, rules_list_head);
+  CHECK_OFFSET(YARA_RULES_FILE_HEADER, 16, externals_list_head);
+  CHECK_OFFSET(YARA_RULES_FILE_HEADER, 24, code_start);
+  CHECK_OFFSET(YARA_RULES_FILE_HEADER, 32, ac_match_pool);
+  CHECK_OFFSET(YARA_RULES_FILE_HEADER, 40, ac_match_table);
+  CHECK_OFFSET(YARA_RULES_FILE_HEADER, 48, ac_transition_table);
 
   CHECK_SIZE(SIZED_STRING, 12);
   CHECK_OFFSET(SIZED_STRING, 4, flags);