mirror of
https://github.com/stellarbear/YaraSharp
synced 2026-06-08 17:36:09 +00:00
stellarbear
97 lines
2.8 KiB
Markdown
97 lines
2.8 KiB
Markdown
# YaraSharp
|
|
C# wrapper around the [Yara pattern matching library](https://github.com/VirusTotal/yara).
|
|
|
|
Use signatures form [Loki](https://github.com/Neo23x0/signature-base/tree/master/yara) or [Yara](https://github.com/Yara-Rules/rules).
|
|
|
|
Nuget package is [available](https://www.nuget.org/packages/YaraSharp)
|
|
## Usage
|
|
```C#
|
|
// All API calls happens here
|
|
YSInstance YSInstance = new YSInstance();
|
|
|
|
// Declare external variables (could be null)
|
|
Dictionary<string, object> externals = new Dictionary<string, object>()
|
|
{
|
|
{ "filename", string.Empty },
|
|
{ "filepath", string.Empty },
|
|
{ "extension", string.Empty }
|
|
};
|
|
|
|
// Get list of YARA rules
|
|
List<string> ruleFilenames = Directory.GetFiles(@"D:\Test\yara", "*.yar", SearchOption.AllDirectories).ToList();
|
|
|
|
// Context is where yara is initialized
|
|
// From yr_initialize() to yr_finalize()
|
|
using (YSContext context = new YSContext())
|
|
{
|
|
// Compiling rules
|
|
using (YSCompiler compiler = instance.CompileFromFiles(ruleFilenames, externals))
|
|
{
|
|
// Get compiled rules
|
|
YSRules rules = compiler.GetRules();
|
|
|
|
// Get errors
|
|
YSReport errors = compiler.GetErrors();
|
|
// Get warnings
|
|
YSReport warnings = compiler.GetWarnings();
|
|
|
|
|
|
// Some file to test yara rules
|
|
string Filename = @"";
|
|
|
|
// Get matches
|
|
List<YSMatches> Matches = instance.ScanFile(Filename, rules,
|
|
new Dictionary<string, object>()
|
|
{
|
|
{ "filename", Alphaleonis.Win32.Filesystem.Path.GetFileName(Filename) },
|
|
{ "filepath", Alphaleonis.Win32.Filesystem.Path.GetFullPath(Filename) },
|
|
{ "extension", Alphaleonis.Win32.Filesystem.Path.GetExtension(Filename) }
|
|
},
|
|
0);
|
|
|
|
// Iterate over matches
|
|
foreach (YSMatches Match in Matches)
|
|
{
|
|
//...
|
|
}
|
|
}
|
|
// Log errors
|
|
}
|
|
```
|
|
For async scanning use **must** call destroy methods:
|
|
```C#
|
|
YaraSharp.CYaraSharp YSInstance = new CYaraSharp();
|
|
YaraSharp.CContext YSContext = new YaraSharp.CContext();
|
|
YaraSharp.CRules YSRules = YSInstance.CompileFromFiles(RuleFilenames, null, out Errors);
|
|
|
|
// Async here
|
|
|
|
YSRules.Destroy();
|
|
YSContext.Destroy();
|
|
```
|
|
## Reference
|
|
[Libyara C API documentation](http://yara.readthedocs.io/en/v3.7.0/capi.html) for a general overview on how to use libyara.
|
|
|
|
## Features and limitations
|
|
|
|
* Metadata supported
|
|
* Externals supported
|
|
* Async scanning supported
|
|
* It seems (through debug sessions) that modules are supported, but i haven't had cases that certanly used them. So this question is opened
|
|
|
|
## Note
|
|
Soultion contains 2 projects:
|
|
- yara-master - where you *can* update yara sources for a new version
|
|
- YaraSharp - where you *can* modify sources in order to add / repair wrapper features
|
|
|
|
## Other
|
|
Build in vs 2017
|
|
|
|
Compiled with yara 3.8.1
|
|
|
|
Yara patched to support unicode paths
|
|
|
|
You can use or modify the sources however you want
|
|
|
|
Special thanks to [kallanreed](https://github.com/kallanreed/libyara.NET)
|