Wesley Shields
37bee583c2
Add a --with-debug-verbose option to the configure script which takes a number
greater than 0 as an argument. This gives us the flexibility to make verbosity
of this useful debugging information greater than it's current maximum (2)
without needing to modify the configure script.
Currently the maximum is 2, which gets you a lot of useful runtime debugging
information. A value of 1 is only used in tests. It may be worth it to consider
reworking this system so the numbers describe how much information you want.
For example, 1 could just be function entry and exit, 2 could add arguments to
it. I'll leave changing that up to a future diff if it is desired.
While here, fix a warning in the scanner from using an incorrect format string:
scan.c:644:7: warning: format specifies type 'long long' but the argument has type 'size_t' (aka 'unsigned long') [-Wformat]
match_offset,
^~~~~~~~~~~~~
./include/yara/globals.h:100:29: note: expanded from macro 'YR_DEBUG_FPRINTF'
fprintf(STREAM, FORMAT, __VA_ARGS__); \
~~~~~~ ^~~~~~~~~~~
1 warning generated.
YARA in a nutshell
YARA is a tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families (or whatever you want to describe) based on textual or binary patterns. Each description, a.k.a. rule, consists of a set of strings and a boolean expression which determine its logic. Let's see an example:
rule silent_banker : banker
{
meta:
description = "This is just an example"
threat_level = 3
in_the_wild = true
strings:
$a = {6A 40 68 00 30 00 00 6A 14 8D 91}
$b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9}
$c = "UVODFRYSIHLNWPEJXQZAKCBGMT"
condition:
$a or $b or $c
}
The above rule is telling YARA that any file containing one of the three strings must be reported as silent_banker. This is just a simple example, more complex and powerful rules can be created by using wild-cards, case-insensitive strings, regular expressions, special operators and many other features that you'll find explained in YARA's documentation.
YARA is multi-platform, running on Windows, Linux and Mac OS X, and can be used through its command-line interface or from your own Python scripts with the yara-python extension.
Additional resources
Do you use GitHub for storing your YARA rules? YARA-CI may be a useful addition to your toolbelt. This is GitHub application that provides continuous testing for your rules, helping you to identify common mistakes and false positives.
If you plan to use YARA to scan compressed files (.zip, .tar, etc) you should take a look at yextend, a very helpful extension to YARA developed and open-sourced by Bayshore Networks.
Additionally, the guys from InQuest have curated an awesome list of YARA-related stuff.
Who's using YARA
- ActiveCanopy
- Adlice
- AlienVault
- Avast
- BAE Systems
- Bayshore Networks, Inc.
- BinaryAlert
- Blue Coat
- Blueliv
- Cisco Talos Intelligence Group
- Claroty
- Cofense
- Conix
- CounterCraft
- CrowdStrike FMS
- Cuckoo Sandbox
- Cyber Triage
- Cybereason
- Digita Security
- Dragos Platform
- Dtex Systems
- ESET
- ESTsecurity
- Fidelis XPS
- FireEye, Inc.
- Forcepoint
- Fox-IT
- FSF
- Guidance Software
- Heroku
- Hornetsecurity
- InQuest
- JASK
- Joe Security
- jsunpack-n
- Kaspersky Lab
- KnowBe4
- Koodous
- Laika BOSS
- Lastline, Inc.
- LimaCharlie
- McAfee Advanced Threat Defense
- Metaflows
- NBS System
- Nextron Systems
- Nozomi Networks
- osquery
- Payload Security
- PhishMe
- Picus Security
- Radare2
- Raytheon Cyber Products, Inc.
- RedSocks Security
- ReversingLabs
- root9B
- RSA ECAT
- Scanii
- SecondWrite
- SonicWall
- SpamStopsHere
- stoQ
- Symantec
- Tanium
- Tenable Network Security
- The DigiTrust Group
- ThreatConnect
- ThreatStream, Inc.
- Thug
- TouchWeb
- Trend Micro
- VirusTotal Intelligence
- VMRay
- We Watch Your Website
- x64dbg
- YALIH
Are you using it? Want to see your site listed here?