YaraSharp

C# wrapper around the Yara pattern matching library.

Use signatures form Loki or Yara.

Nuget package is available

Usage

//  All API calls happens here
YaraSharp.CYaraSharp YSInstance = new CYaraSharp();
        
//  Declare external variables (could be null)
Dictionary<string, object> Externals = new Dictionary<string, object>()
{
    { "filename", string.Empty },
    { "filepath", string.Empty },
    { "extension", string.Empty }
};

//  Errors occured during rule compilation: ignored_file : List<reasons>
Dictionary<string, List<string>> Errors = new Dictionary<string, List<string>>();

//  Context is where yara is initialized
//  From yr_initialize() to yr_finalize()
using (YaraSharp.CContext YSContext = new YaraSharp.CContext())
{
	//	Compiling rules
	using (YaraSharp.CRules YSRules = YSInstance.CompileFromFiles(RuleFilenames, Externals, out Errors))
	{
		//  Some file to test yara rules
		//	Here comes long filenames
		string Filename = "\\?\<some_file>";

		//  Get matches
		List<YaraSharp.CMatches> Matches = YSInstance.ScanFile(Filename, YSRules, 
				new Dictionary<string, object>()
				{
					{ "filename", Alphaleonis.Win32.Filesystem.Path.GetFileName(Filename) },
					{ "filepath", Alphaleonis.Win32.Filesystem.Path.GetFullPath(Filename) },
					{ "extension", Alphaleonis.Win32.Filesystem.Path.GetExtension(Filename) }
				}, 
				0);

		//  Iterate over matches
		foreach (YaraSharp.CMatches Match in Matches)
		{
			//...
		}
	}
	//  Log errors
}

For async scanning use must call destroy methods:

YaraSharp.CYaraSharp YSInstance = new CYaraSharp();
YaraSharp.CContext YSContext = new YaraSharp.CContext();
YaraSharp.CRules YSRules = YSInstance.CompileFromFiles(RuleFilenames, null, out Errors);

//  Async here

YSRules.Destroy();
YSContext.Destroy();

Reference

Libyara C API documentation for a general overview on how to use libyara.

Features and limitations

• Metadata supported
• Externals supported
• Async scanning supported
• It seems (through debug sessions) that modules are supported, but i haven't had cases that certanly used them. So this question is opened

Note

Soultion contains 2 projects:

• yara-master - where you can update yara sources for a new version
• YaraSharp - where you can modify sources in order to add / repair wrapper features

Other

Build in vs 2017

Compiled with yara 3.8.1

Yara patched to support unicode paths

You can use or modify the sources however you want

Special thanks to kallanreed