A quick nim script to convert ClamAV hashes to Yara rules

clam_hashes_to_yara.nim

# Compile: nim c --opt:speed clam_hashes_to_yara.nim
import strutils

const
  clam_db_path = "/home/dmknght/Desktop/performance_comparison/main.hdb"
  yr_converted_rule = "/home/dmknght/Desktop/performance_comparison/clam_hashes.yara"


type
  HashSig = object
    checksum: string
    fsize: string
    signame: string



proc parse_hash_sig(line: string): HashSig =
  let
    tmp_line = line.split(":")
    sig_data = HashSig(
      checksum: tmp_line[0],
      fsize: tmp_line[1],
      signame: tmp_line[2]
    )
  return sig_data


proc sig_to_rule(sig: HashSig): string =
  let
    rule_name = sig.signame.replace("-", "_").replace(".", "_").replace("/", "_")

  result = "rule " & rule_name & "{\n"
  result &= "  meta:\n"
  result &= "    description = \"Checksum signature of " & sig.signame & "\"\n"
  result &= "  condition:\n"
  result &= "    filesize == " & sig.fsize & " and hash.md5(0, " & sig.fsize & ") == \"" & sig.checksum & "\"\n}\n"

var f = open(yr_converted_rule, fmWrite)
f.write("import \"hash\"\n\n")

for line in lines(clam_db_path):
  let
    sig = parse_hash_sig(line)
    rule_data = sig_to_rule(sig)
  f.write(rule_data)

f.close()