Skip to main content

Parse YARA rules.

Project description

Build Status Documentation Status Code Health Test Coverage PyPi Version

Parse YARA rules into a dictionary representation.

Plyara is a script and library that lexes and parses a file consisting of one more YARA rules into a python dictionary representation. The goal of this tool is to make it easier to perform bulk operations or transformations of large sets of YARA rules, such as extracting indicators, updating attributes, and analyzing a corpus. Other applications include linters and dependency checkers.

Plyara leverages the Python module PLY for lexing YARA rules.

This is a community-maintained fork of the original plyara by 8u1a. The “plyara” trademark is used with permission.

Installation

Install with pip:

pip install plyara

Usage

Use the plyara Python library in your own applications:

>>> import plyara
>>> parser = plyara.Plyara()
>>> mylist = parser.parse_string('rule MyRule { strings: $a="1" \n condition: false }')
>>>
>>> import pprint
>>> pprint.pprint(mylist)
[{'condition_terms': ['false'],
  'raw_condition': 'condition: false',
  'raw_strings': 'strings: $a="1" \n',
  'rule_name': 'MyRule',
  'start_line': 1,
  'stop_line': 2,
  'strings': [{'name': '$a', 'value': '"1"'}]}]
>>>

Or, use the included plyara script from the command line:

$ plyara -h
usage: plyara.py [-h] [--log] FILE

Parse YARA rules into a dictionary representation.

positional arguments:
  FILE        File containing YARA rules to parse.

optional arguments:
  -h, --help  show this help message and exit
  --log       Enable debug logging to the console.

The command-line tool will print valid JSON output when parsing rules:

$ cat example.yar
rule silent_banker : banker
{
    meta:
        description = "This is just an example"
        thread_level = 3
        in_the_wild = true
    strings:
        $a = {6A 40 68 00 30 00 00 6A 14 8D 91}
        $b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9}
        $c = "UVODFRYSIHLNWPEJXQZAKCBGMT"
    condition:
        $a or $b or $c
}

$ plyara example.yar
[
    {
        "condition_terms": [
            "$a",
            "or",
            "$b",
            "or",
            "$c"
        ],
        "metadata": {
            "description": "This is just an example",
            "in_the_wild": "true",
            "thread_level": "3"
        },
        "raw_condition": "condition:\n        $a or $b or $c\n",
        "raw_meta": "meta:\n        description = \"This is just an example\"\n        thread_level = 3\n        in_the_wild = true\n    ",
        "raw_strings": "strings:\n        $a = {6A 40 68 00 30 00 00 6A 14 8D 91}\n        $b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9}\n        $c = \"UVODFRYSIHLNWPEJXQZAKCBGMT\"\n    ",
        "rule_name": "silent_banker",
        "start_line": 1,
        "stop_line": 13,
        "strings": [
            {
                "name": "$a",
                "value": "{6A 40 68 00 30 00 00 6A 14 8D 91}"
            },
            {
                "name": "$b",
                "value": "{8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9}"
            },
            {
                "name": "$c",
                "value": "\"UVODFRYSIHLNWPEJXQZAKCBGMT\""
            }
        ],
        "tags": [
            "banker"
        ]
    }
]

Migration

If you used an older version of plyara, and want to migrate to this version, there will be some changes required. Most importantly, the parser object instantiation has changed. It was:

# Old style - don't do this!
import plyara.interp as interp
rules_list = interp.parseString(open('myfile.yar').read())

But is now:

# New style - do this instead!
import plyara
parser = plyara.Plyara()
rules_list = parser.parse_string(open('myfile.yar').read())

The existing parsed keys have stayed the same, and new ones have been added.

When reusing a parser for multiple rules and/or files, be aware that imports are now shared across all rules - if one rule has an import, that import will be added to all rules in your parser object.

Contributing

  • If you find a bug, or would like to see a new feature, Pull Requests and Issues are always welcome.

  • By submitting changes, you agree to release those changes under the terms of the LICENSE.

  • Writing passing unit tests for your changes, while not required, is highly encouraged and appreciated.

Discussion

  • You may join our IRC channel on irc.freenode.net #plyara

  • Additionally, project developers can join our slack http://plyara.slack.com (If you need an invite, please ask in the IRC channel.)

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

plyara-1.3.2.tar.gz (12.7 kB view details)

Uploaded Source

Built Distribution

plyara-1.3.2-py2.py3-none-any.whl (15.5 kB view details)

Uploaded Python 2 Python 3

File details

Details for the file plyara-1.3.2.tar.gz.

File metadata

  • Download URL: plyara-1.3.2.tar.gz
  • Upload date:
  • Size: 12.7 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/1.11.0 pkginfo/1.4.2 requests/2.18.4 setuptools/38.5.1 requests-toolbelt/0.8.0 tqdm/4.22.0 CPython/2.7.14

File hashes

Hashes for plyara-1.3.2.tar.gz
Algorithm Hash digest
SHA256 635619b6b53ac60370e074359e851e6836315b7a3e69eae3992be8fa4255a456
MD5 d1f30ada7033a40f98b6e53d64d54ed2
BLAKE2b-256 85bdd6d774f8bd9d580a4e29f7d8611be41374f80a273b99b2f950f08b8ae53e

See more details on using hashes here.

File details

Details for the file plyara-1.3.2-py2.py3-none-any.whl.

File metadata

  • Download URL: plyara-1.3.2-py2.py3-none-any.whl
  • Upload date:
  • Size: 15.5 kB
  • Tags: Python 2, Python 3
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/1.11.0 pkginfo/1.4.2 requests/2.18.4 setuptools/38.5.1 requests-toolbelt/0.8.0 tqdm/4.22.0 CPython/2.7.14

File hashes

Hashes for plyara-1.3.2-py2.py3-none-any.whl
Algorithm Hash digest
SHA256 d8e384d020aec5ee6c8ef2794fa86be39e22f32002debddb1faf0299968a36d0
MD5 4b4aadbfdc25e9144e986429e6506017
BLAKE2b-256 8f63f9821cf9751c8e85d1d6844ebbc55e1985773188559a26d7ca798de49d64

See more details on using hashes here.

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page