psiYARA

pronounced: saiyara

• Just a simple poject to help me understand and write a YARA rules.

• YARA rules checker against provided binary for detection based on the rules.

• Contains simple C files that can be compiled and checked against the main program. (remove the mkfifo on windows, or write your own)

• WIP :)

TODO

• add multiple rules based detection

• add memory based detection

• weight system

---

Idea

dGhlIGlkZWEgaXMgdG8gbWFrZSBtdWx0aXBsZSBydWxlcywgd2l0aCBlYWNoIHJ1bGUgZ2V0dGlu
ZyBkZXRlY3RlZCwgZWFjaCBydWxlIHdpbGwgaGF2ZSBzb21lIHdlaWdodCBkZXBlbmRpbmcgdXBv
biB0aGUgY3JpdGljYWxpdHkgb2YgdGhlIGRldGVjdGlvbi4gQWZ0ZXIgZ29pbmcgdGhyb3VnaCBt
dWx0aXBsZSBkZXRlY3Rpb24sIHRoZSBmaW5hbCB3ZWllZ2h0IHdpbGwgYmUgc2Vlbi4gSWYgaXQg
aXMgbW9yZSB0aGFuIGEgc3RhbmRhcmQsIGxldHMgc2F5IG9uIGEgc2NhbGUgb2YgMC0xMDAsIHRo
ZSB2YWx1ZSBvZiA4MCwgdGhlbiB3ZSBmbGFnIGl0IGFzIG1hbGljaW91cywgcmVxdWlyaW5nIGZ1
cnRoZXIgcHJvY2Vzc2luZyBhbmQgd29yay4K