mirror of
https://github.com/Neo23x0/signature-base
synced 2026-06-08 12:00:26 +00:00
RuneBot14
9a2db7816d
Add automated syntax checking for YARA rules: - tests/syntax/check.sh: Script to validate all .yar files - .github/workflows/syntax-check.yml: CI pipeline for PRs - Makefile: 'make test-syntax' for local testing Features: - Tests compilation of all YARA rules - Skips rules with external variables (known limitation) - Runs on Ubuntu with YARA 4.5+ - Reports pass/skip/fail counts Part of Phase 1 quality checks for signature-base repository.
49 lines
1.4 KiB
Makefile
49 lines
1.4 KiB
Makefile
YARA=3.8.1
|
|
CUR_DIR=${PWD}
|
|
YARA_DIR=$(CUR_DIR)/yara
|
|
BUILD_DIR=$(CUR_DIR)/build
|
|
3RD_PARTY=$(CUR_DIR)/3rdparty
|
|
MJOLNIR_DIR=$(CUR_DIR)/../mjolnir
|
|
|
|
YAR_COMP_VARS=-d filename="XXX" -d filepath="XXX" -d extension="XXX" -d filetype="XXX" -d filemode="0" -d md5="XXX" -d id="1" -d owner="XXX" -d group="XXX" -d unpack_parent="" -d unpack_source=""
|
|
YAR_SIGS=$(wildcard ./yara/*.yar)
|
|
|
|
all: clean prereq build
|
|
sigs: cleanbuild build
|
|
|
|
clean: cleanbuild
|
|
rm -rf $(3RD_PARTY)
|
|
|
|
cleanbuild:
|
|
rm -rf $(BUILD_DIR)
|
|
|
|
extractinfo:
|
|
python3 $(MJOLNIR_DIR)/mjolnir.py -d ./yara --metaexport -o sig-base-rules.temp
|
|
cat sig-base-rules.temp | sort > sig-base-rules.csv
|
|
rm -f sig-base-rules.temp
|
|
|
|
prereq:
|
|
mkdir -p $(3RD_PARTY)/src
|
|
wget -P $(3RD_PARTY)/src https://github.com/VirusTotal/yara/archive/v$(YARA).tar.gz
|
|
tar -xvzf $(3RD_PARTY)/src/*.tar.gz -C $(3RD_PARTY)/src
|
|
cd $(3RD_PARTY)/src/yara-$(YARA) ; \
|
|
./bootstrap.sh ; \
|
|
./configure --disable-shared --disable-magic --disable-cuckoo --prefix=$(3RD_PARTY)/yara ; \
|
|
make ; \
|
|
make install
|
|
|
|
build:
|
|
mkdir -p $(BUILD_DIR)/yara
|
|
for yarsig in $(YAR_SIGS) ; do \
|
|
echo "Compiling $(BUILD_DIR)/$(notdir $$yarsig) ..." ; \
|
|
$(3RD_PARTY)/yara/bin/yarac $(YAR_COMP_VARS) $(notdir $$yarsig) $(BUILD_DIR)/$(notdir $$yarsig).compiled ; \
|
|
done
|
|
|
|
# Test targets
|
|
test-syntax:
|
|
@echo "Running YARA syntax check..."
|
|
@./tests/syntax/check.sh ./yara
|
|
|
|
test: test-syntax
|
|
.PHONY: test test-syntax
|