Yara Scan Memory

yara_scan_mem.c

INT ToReportOrNotToReportThatIsTheQuestion( YR_SCAN_CONTEXT* Context,
  INT Message,
	PVOID pMessageData,
	PVOID pUserData
)
{
	if (Message == CALLBACK_MSG_RULE_MATCHING)
	{
		(*(int*)pUserData) = 1;
	}

	if (Message == CALLBACK_MSG_RULE_NOT_MATCHING)
	{
		(*(int*)pUserData) = 0;
	}

	return CALLBACK_CONTINUE;
}

YRRulesScanMem(yrRules, (uint8_t*)StringBuffer, strlen(StringBuffer), 0, ToReportOrNotToReportThatIsTheQuestion, &dwReport, 0);

if (dwReport == 0)
{
  if (strstr(StringBuffer, PIPE_NAME) == NULL)
  {
    DoOriginalEtwCallback(EventRecord);
  }
}