Skip to main content

Compile YARA rules to test against files or strings

Project description

What is yara-ctypes:

  • A powerful python wrapper for yara-project’s libyara v1.6.

  • Supports thread safe matching of YARA rules.

  • namespace management to allow easy loading of multiple YARA rules into a single libyara context.

  • Comes with a scan module which exposes a user CLI and demonstrates a pattern for executing match jobs across a thread pool.

Why:

  • ctypes releases the GIL on system function calls… Run your PC to its true potential.

  • No more building the PyC extension…

  • I found a few bugs and memory leaks and wanted to make my life simple.

As a reference and guide to yara-ctypes see: yara-ctypes documentation

For additional tips / tricks with this wrapper feel free to post a question at the github yara-ctypes/issues page.

Project hosting provided by github.com.

[mjdorma+yara-ctypes@gmail.com]

Install and run

Simply run the following:

> python setup.py install
> python setup.py test
> python -m yara.scan -h

or PyPi:

> pip install yara
> python -m yara.scan -h

Compatability

yara-ctypes is implemented to be compatible with Python 2.6+ and Python 3.x. It has been tested against the following Python implementations:

Ubuntu 12.04:

  • CPython 2.7 (32bit, 64bit)

  • CPython 3.2 (32bit, 64bit)

Ubuntu 11.10 build_status:

  • CPython 2.6 (32bit)

  • CPython 2.7 (32bit)

  • CPython 3.2 (32bit)

  • PyPy 1.9.0 (32bit)

Windows 7:

  • CPython 2.6 (32bit, 64bit)

  • CPython 3.2 (32bit, 64bit)

OS X Mountain Lion

  • CPython 2.7 (64bit)

Continuous integration testing is provided by Travis CI.

Issues

Source code for yara-ctypes is hosted on GitHub. Please file bug reports with GitHub’s issues system.

Change log

version 1.6.3 (08/03/2013)

  • bug fix to yara.py (callback callable check)

version 1.6.2 (28/02/2013)

  • support for OS X Mountain Lion

version 1.6.1 (06/09/2012)

  • Support for 64bit Windows

  • Bug fixes

  • Added documentation

version 1.6.0 (01/09/2012)

  • Initial release

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

yara-1.6.3.zip (376.9 kB view details)

Uploaded Source

File details

Details for the file yara-1.6.3.zip.

File metadata

  • Download URL: yara-1.6.3.zip
  • Upload date:
  • Size: 376.9 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No

File hashes

Hashes for yara-1.6.3.zip
Algorithm Hash digest
SHA256 228d6648f5a22c37ee40aabba15740e1d6f1bf4cb1327d7c2ebee35121dfb140
MD5 abf385938a8802b27315bfadb98e1dfe
BLAKE2b-256 21eb0221e1e9178359feec59d443731454c6944caa85f3a60c0cc2b4a4b75d60

See more details on using hashes here.

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page