I'm trying to implement scanning that stops after the first pattern match is found, similar to classic YARA's -f (fast scan) option. After reviewing the documentation, I cannot find this functionality in YARA-X's Rust API.

Current Understanding

Based on the official documentation at yara_x - Rust, the Scanner struct only provides:

• scanner.scan_file(file_path)

Neither method appears to accept parameters for early termination or fast scanning.

Specific Questions

1. Does YARA-X currently support any equivalent to classic YARA's fast scan mode?
2. Are there any undocumented scanner configuration options for early termination?
3. Is there a callback mechanism or alternative API that allows stopping scan on first match?
4. If not available, are there plans to implement this functionality?

1 post - 1 participant

Read full topic