yaramod

yaramod is a library that provides parsing of YARA rules into AST and a C++ programming interface to build new YARA rulesets. This project is not associated with the YARA project.

yaramod also comes with Python bindings and this repository should be fully compatible with installation using pip.

Usage Example

See the wiki.

Requirements

• C++ compiler with C++17 support
  • On Windows, only Microsoft Visual C++ is supported (version >= Visual Studio 2017 version 15.7).
• CMake (version >= 3.6)
• Flex (version >= 2.6)
• Bison (version >= 3.0)

If you are also interested in Python bindings:

• GCC 5+ (for Linux/Unix, should remain the same for other compilers and platforms)
• Python 3+

Build and Installation

• Clone the repository:
  • git clone https://github.com/avast/yaramod.git
• Linux:
  • cd yaramod
  • mkdir build && cd build
  • cmake -DCMAKE_BUILD_TYPE=<Debug|Release> .. [OPTIONS...]
  • make -jN (N is the number of CPU cores to use for parallel build)
• Windows:
  • Open a command prompt (e.g. C:\msys64\msys2_shell.cmd from MSYS2)
  • cd yaramod
  • mkdir build && cd build
  • cmake -G<generator> .. [OPTIONS...]
    • -G<generator> is -G"Visual Studio 15 2017" for 32-bit build using Visual Studio 2017, or -G"Visual Studio 15 2017 Win64" for 64-bit build using Visual Studio 2017. Of course, any later version of Visual Studio may be used.
  • cmake --build . --config Release -- -m
  • Alternatively, you can open yaramod.sln generated by cmake in Visual Studio IDE.

Available options are:

• YARAMOD_DOC - provide build target doc for building documentation with Doxygen. (Default: OFF)
• YARAMOD_TESTS - build unit tests. (Default: OFF)
• YARAMOD_PYTHON - build python bindings. (Default: OFF)
• YARAMOD_EXAMPLES - build example binaries. (Default: OFF)

Python bindings

The easiest way to get Python bindings to work is through pip like this:

pip install git+https://github.com/avast/yaramod.git

or you can install latest stable version from PyPI like this:

pip install yaramod

If you want to clone and build the repository yourselves you can do so by following these steps:

• Setup virtual environment if you don't want to install yaramod into your system python:
  • ./setup_env.sh
  • source use_env.sh
• Run compilation and installation of python bindings:
  • python setup.py build OPTIONS
  • python setup.py install
• Allowed OPTIONS are:
  • --with-unit-tests - Build also C++ unit tests.
  • --debug - Build debug configuration.

To run python tests execute the following command:

pytest -v tests/python

API Documentation

You can generate the API documentation by yourself. Pass -DYARAMOD_DOC=ON to cmake and run make doc.

License

Copyright (c) 2017 Avast Software, licensed under the MIT license. See the LICENSE file for more details.

yaramod uses third-party libraries or other resources listed, along with their licenses, in the LICENSE-THIRD-PARTY file.

Contributing

See RetDec contribution guidelines.