diff --git a/ghost-core/src/detection.rs b/ghost-core/src/detection.rs index 65c6a7e..50dfd82 100644 --- a/ghost-core/src/detection.rs +++ b/ghost-core/src/detection.rs @@ -108,7 +108,7 @@ impl DetectionEngine { // Initialize YARA engine with default rules directory let yara_engine = match DynamicYaraEngine::new(Some("rules")) { - Ok(mut engine) => { + Ok(engine) => { if engine.is_compiled() { log::info!( "YARA engine initialized with {} rules", @@ -262,17 +262,16 @@ impl DetectionEngine { // YARA rule scanning if let Some(yara_engine) = &self.yara_engine { - if let Ok(yara_result) = tokio::runtime::Handle::try_current() - .and_then(|handle| { - handle - .block_on(async { yara_engine.scan_process(process, memory_regions).await }) - }) - .or_else(|_| { + let yara_result = match tokio::runtime::Handle::try_current() { + Ok(handle) => handle.block_on(async { yara_engine.scan_process(process, memory_regions).await }), + Err(_) => { tokio::runtime::Runtime::new() .unwrap() .block_on(async { yara_engine.scan_process(process, memory_regions).await }) - }) - { + } + }; + + if let Ok(yara_result) = yara_result { if !yara_result.matches.is_empty() { log::info!( "YARA scan found {} matches in {} ms", diff --git a/ghost-core/src/yara_engine.rs b/ghost-core/src/yara_engine.rs index 4b7c090..bb2e962 100644 --- a/ghost-core/src/yara_engine.rs +++ b/ghost-core/src/yara_engine.rs @@ -126,10 +126,12 @@ impl DynamicYaraEngine { })?; if !rules_dir.exists() { - return Err(GhostError::ConfigurationError(format!( - "Rules directory does not exist: {}", - rules_dir.display() - ))); + return Err(GhostError::Configuration { + message: format!( + "Rules directory does not exist: {}", + rules_dir.display() + ), + }); } let mut compiler = Compiler::new().map_err(|e| GhostError::Configuration { @@ -175,9 +177,9 @@ impl DynamicYaraEngine { } if rule_count == 0 { - return Err(GhostError::ConfigurationError( - "No YARA rules were successfully compiled".to_string(), - )); + return Err(GhostError::Configuration { + message: "No YARA rules were successfully compiled".to_string(), + }); } self.compiled_rules = @@ -298,11 +300,7 @@ impl DynamicYaraEngine { data: &[u8], base_address: usize, ) -> Result, GhostError> { - let mut scanner = Scanner::new(rules).map_err(|e| GhostError::Detection { - message: format!("Scanner creation failed: {}", e), - })?; - - let scan_results = scanner.scan_mem(data).map_err(|e| GhostError::Detection { + let scan_results = rules.scan_mem(data, 300).map_err(|e| GhostError::Detection { message: format!("Scan failed: {}", e), })?; @@ -317,7 +315,7 @@ impl DynamicYaraEngine { for meta in rule.metadatas { let value = match meta.value { yara::MetadataValue::Integer(i) => i.to_string(), - yara::MetadataValue::String(ref s) => s.clone(), + yara::MetadataValue::String(ref s) => s.to_string(), yara::MetadataValue::Boolean(b) => b.to_string(), }; metadata.insert(meta.identifier.to_string(), value);