yara规则初识

sudo apt install libmagic-dev libssl-dev
sudo apt install yara
sudo pip3 install --global-option="build" --global-option="--enable-magic" yara-python==4.2.3 -i Https://pypi.tuna.tsinghua.edu.cn/simple/

root@node1:/home/zqtest# yara --help
YARA 3.7.1, the pattern matching swiss army knife.
Usage: yara [OPTION]... [NAMESPACE:]RULES_FILE... FILE | DIR | PID
Mandatory arguments to long options are mandatory for short options too.
 
  -t,  --tag=TAG                       打印标记为TAG的规则，并忽略其他规则
  -i,  --identifier=IDENTIFIER          print only rules named IDENTIFIER
  -c,  --count                          print only number of matches
  -n,  --negate                         打印不满足的规则
  -D,  --print-module-data              打印模块数据
  -g,  --print-tags                     打印标签
  -m,  --print-meta                     打印元数据
  -s,  --print-strings                  print matching strings
  -L,  --print-string-length            打印匹配字符串的长度
  -e,  --print-namespace                打印规则的名称空间
  -p,  --threads=NUMBER                 使用指定的线程数number扫描目录
  -l,  --max-rules=NUMBER               匹配多个规则后终止扫描
  -d VAR=VALUE                          define external variable
  -x MODULE=FILE                        将文件内容作为额外数据传递给模块
  -a,  --timeout=SECONDS                扫描x秒后终止
  -k,  --stack-size=SLOTS               set maximum stack size (default=16384)
       --max-strings-per-rule=NUMBER    设置每个规则的最大字符串数 (default=10000)
  -r,  --recursive                      递归搜索目录
  -f,  --fast-scan                      fast matching mode
  -w,  --no-warnings                    禁用警告
       --fail-on-warnings               fail on warnings
  -v,  --version                        显示版本信息
  -h,  --help                           show this help and exit
 
Send bug reports and suggestions to: vmalvarez@virustotal.com.

使用举例：

# default, compiled from a file path
rules = yara.compile(filepath='/foo/bar/myrules')
 
# compile your rules from a file object
fh = open('/foo/bar/myrules')
rules = yara.compile(file=fh)
fh.close()
 
# compile them directly from a Python string
rules = yara.compile(source='rule dummy { condition: true }')
 
# compile a group of files or strings, you can do it by using the filepaths or sources named arguments
rules = yara.compile(filepaths={
    'namespace1': '/my/path/rules1',
    'namespace2': '/my/path/rules2'
})
 
rules = yara.compile(sources={
    'namespace1': 'rule dummy { condition: true }',
    'namespace2': 'rule dummy { condition: false }'
})

rules.save('/foo/bar/my_compiled_rules')

rules = yara.load('/foo/bar/my_compiled_rules')

matches = rules.match('/foo/bar/test_file')
 
# 当然规则也可用于Python string
with open('/foo/bar/my_file', 'rb') as f:
    matches = rules.match(data=f.read())
   
# 或者到一个正在运行的进程
matches = rules.match(pid=1234) # match 方法返回 yara.Match 类的实例列表
 
print(matches)
print(matches[0])
print(matches[0].rule)
print(matches[0].tag)
print(matches[0].string)

import yara
def modules_callback(data):
    print(data)
    return yara.CALLBACK_CONTINUE
matches = rules.match('/foo/bar/my_file', modules_callback=modules_callback)

import yara
def warnings_callback(warning_type, message):
    if warning_type == yara.CALLBACK_TOO_MANY_MATCHES:
        print(f"namespace:'{message.namespace}' rule:'{message.rule}' string:'{message.string}'")
    return yara.CALLBACK_CONTINUE
matches = rules.match('/foo/bar/my_file', warnings_callback=warnings_callback)

六、参考