using System; using System.Collections.Generic; using System.IO; using System.Linq; using YaraSharp; namespace YaraTest { class Program { static void Main(string[] args) { // Get Version Version DllVersion = YSInstance.GetVersion(); // All API calls happens here YSInstance instance = new YSInstance(); // Get list of YARA rules List ruleFilenames = Directory.GetFiles(@"D:\Test\yara", "*.yar", SearchOption.AllDirectories).ToList(); // Declare external variables (could be null) Dictionary externals = new Dictionary() { { "filename", string.Empty }, { "filepath", string.Empty }, { "extension", string.Empty } }; // Context is where yara is initialized // From yr_initialize() to yr_finalize() using (YSContext context = new YSContext()) { // Compiling rules using (YSCompiler compiler = instance.CompileFromFiles(ruleFilenames, externals)) { // Get compiled rules YSRules rules = compiler.GetRules(); // Get errors YSReport errors = compiler.GetErrors(); // Get warnings YSReport warnings = compiler.GetWarnings(); // Some file to test yara rules string Filename = @""; // Get matches List Matches = instance.ScanFile(Filename, rules, new Dictionary() { { "filename", Alphaleonis.Win32.Filesystem.Path.GetFileName(Filename) }, { "filepath", Alphaleonis.Win32.Filesystem.Path.GetFullPath(Filename) }, { "extension", Alphaleonis.Win32.Filesystem.Path.GetExtension(Filename) } }, 0); // Iterate over matches foreach (YSMatches Match in Matches) { //... } } // Log errors } } } }