Includes a new command to scan streams and objects using Yara rules.

[7h3rAm]

This command can be used to scan raw object, streams and files. Here is an example for reference:

PPDF> yara_scan

Usage: yara_scan object|rawobject|stream|rawstream $object_id [$version]
Usage: yara_scan raw $offset $num_bytes
Usage: yara_scan file $file_name
Usage: yara_scan variable $var_name
Usage: yara_scan object $object_id
Usage: yara_scan rawobject $object_id
Usage: yara_scan stream $stream_id
Usage: yara_scan rawstream $stream_id

Scan raw|file|variable|object|rawobject|stream|rawstream using Yara

PPDF> 
PPDF> yara_scan file /media/sf_Shared/dragons.pdf
Rule dummy matched!
dummy: Meta: {}
dummy: Namespace: default
dummy: Strings: [(3183911L, '$a', 'Dragon')]
dummy: Tags: ['foo', 'bar']
PPDF> 

It has hard dependency on yara-python. Yara rules are fetched from _rules.yara_ file which is expected to be in peepdf's root directory.