Does YARA-X Support Fast Scan Mode or Alternative Early Stop Mechanisms?

⚓ Rust    📅 2025-08-26    👤 surdeus    👁️ 15      

surdeus

Warning

This post was published 99 days ago. The information described in this article may have changed.

I'm trying to implement scanning that stops after the first pattern match is found, similar to classic YARA's -f (fast scan) option. After reviewing the documentation, I cannot find this functionality in YARA-X's Rust API.

Current Understanding

Based on the official documentation at yara_x - Rust, the Scanner struct only provides:

  • scanner.scan_file(file_path)

Neither method appears to accept parameters for early termination or fast scanning.

Specific Questions

  1. Does YARA-X currently support any equivalent to classic YARA's fast scan mode?
  2. Are there any undocumented scanner configuration options for early termination?
  3. Is there a callback mechanism or alternative API that allows stopping scan on first match?
  4. If not available, are there plans to implement this functionality?

1 post - 1 participant

Read full topic

🏷️ Rust_feed