dnYara.Interop 2.1.0

dotnet add package dnYara.Interop --version 2.1.0                
NuGet\Install-Package dnYara.Interop -Version 2.1.0                
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package.
<PackageReference Include="dnYara.Interop" Version="2.1.0" />                
For projects that support PackageReference, copy this XML node into the project file to reference the package.
paket add dnYara.Interop --version 2.1.0                
#r "nuget: dnYara.Interop, 2.1.0"                
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package.
// Install dnYara.Interop as a Cake Addin
#addin nuget:?package=dnYara.Interop&version=2.1.0

// Install dnYara.Interop as a Cake Tool
#tool nuget:?package=dnYara.Interop&version=2.1.0                

License NuGet

dnYara

     _                         
  __| |_ __/\_/\__ _ _ __ __ _ 
 / _` | '_ \_ _/ _` | '__/ _` |
| (_| | | | / \ (_| | | | (_| |
 \__,_|_| |_\_/\__,_|_|  \__,_|

dnYara is a .Net wrapper library for the native Yara library.

Why another .Net wrapper ?

Unlike other wrappers for .Net which are, for most, statically linked managed C++ wrapper, dnYara has been made in C# for .Net Standard 2.0, with the help of PInvoke. This way, it ensures interoperability and portability for various .Net application and OS (learn more).

About Yara project

YARA is an open-source tool, originally developed by Victor Alvarez, to help malware researchers quickly identify and classify malware samples. With YARA, you can create pattern-based rules to scan malwares.

With YARA, you can create malware family descriptions (or what you want to describe) based on text or binary patterns. In each description, or rule, a series of strings and a boolean statement are used to determine its logic.

Pre-requisite

dnYara works with the Yara library (libyara) compiled dynamically at his side, and with his exports.

It is important to make sure that you have Yara 4.0 ++ compiled beside it

  • libyara.dll for Windows OS
  • libyara.so for linux
  • libyara.dylib for macosx platform

Build YARA with CMake

The directory libs\cmake contains CMake files that can be used to build YARA with MSVC on Windows, or Makefile on Unix-based systems.

Windows

To create a Visual Studio 2019 project and build YARA on Windows:

mkdir build_yara
cd build_yara
cmake -G "Visual Studio 16 2019" ..\libs\cmake -DBUILD_SHARED_LIB=ON
cmake --build . --config [release|debug]

For earlier version of Visual Studio, please check your CMAKE_GENERATOR_PLATFORM variable:

  • Visual Studio 15 2017
  • Visual Studio 14 2015
  • etc.
Linux

To create a Makefile and build YARA on Linux:

mkdir build_yara
cd build_yara
cmake -G "Unix Makefiles"  ../libs/cmake -DBUILD_SHARED_LIB=ON
cmake --build . --config [release|debug]

By default the Yara modules are not included, but you can either :

  • select which you want to include: eg. -D yara_CUCKOO_MODULE
  • or include all of them: -D yara_ALL_MODULES=ON

More information : https://github.com/airbus-cert/yara/tree/cmake/cmake

Usage

dnYara is made of the following classes:

  • YaraContext
  • QuickScan
  • Rule
  • Compiler
  • CompiledRules
  • Scanner
  • ScanResult
  • Match

It also uses a dnYara.Interop library which is dedicated to provide unmanaged PInvokes / DLLImports to the Yara native library.

Limitations

  • Does not support external variables for now (TODO)
  • If an issue occurs on the native compiler side, it will crash when compiling rules: we are trying to handle the crash by operating with 2 compilers

Samples

Example

static void Main(string[] args)
{
    // Get list of yara rules
    string[] ruleFiles = Directory.GetFiles(@"e:\yara-db\rules\", "*.yara", SearchOption.AllDirectories).ToArray();

    // Get list of samples to check
    string[] samples = new[]
    {
        @"e:\malware-samples\",             // directory
        @"e:\speficic-samples\sample1.exe"  // file
    };

    // Initialize yara context
    using (YaraContext ctx = new YaraContext())
    {
        // Compile list of yara rules
        CompiledRules rules = null;
        using (var compiler = new Compiler())
        {
            foreach (var yara in ruleFiles)
            {
                compiler.AddRuleFile(yara);
            }

            rules = compiler.Compile();

            Console.WriteLine($"* Compiled");
        }

        if (rules != null)
        {
            // Initialize the scanner
            var scanner = new Scanner();

            // Go through all samples
            foreach (var sample in samples)
            {
                // If item is file, scan the file
                if (File.Exists(sample))
                {
                    ScanFile(scanner, sample, rules);
                }
                // If item is directory, scan the directory
                else
                {
                    if (Directory.Exists(sample))
                    {
                        DirectoryInfo dirInfo = new DirectoryInfo(sample);

                        foreach (FileInfo fi in dirInfo.EnumerateFiles("*", SearchOption.AllDirectories))
                            ScanFile(scanner, fi.FullName, rules);
                    }
                }
            }

        }
                
    }
}

public static void ScanFile(Scanner scanner, string filename, CompiledRules rules)
{
    List<ScanResult> scanResults = scanner.ScanFile(filename, rules);

    foreach (ScanResult scanResult in scanResults)
    {
        string id = scanResult.MatchingRule.Identifier;

        if (scanResult.Matches.Count == 1)
        {
            Console.WriteLine(
                $"* Match found : \"{filename}\" for rule \"{id}.{scanResult.Matches.First().Key}\"");
        }
        else
        {
            Console.WriteLine($"* Match found : \"{filename}\" for rule \"{id}\":");

            foreach (var vd in scanResult.Matches)
            {
                Console.WriteLine($"   > Rule : \"{vd.Key}\"");
            }
        }
    }
}

YaraInteractive sample

A Yara Interactive console is a sample of Yara CLI made with dnYara. It works under Windows as well as for Linux or macOS.

It allows the user to add samples & rules to a context of analysis, and then run a scan:

YaraInteractive

Supported commands:

  • yadd <rules_path>: Add a rule or rule directory to context.
  • sadd <samples_path>: Add a sample or sample directory to context.
  • ycompile: Compile rules added to context (must be done after yadd and before run commands)
  • run: Run detection for the current context.
  • clear: Clear the current context display.
  • exit: Quit.

Credits

  • This project is under copyright of the Airbus Computer Emergency Response Team (CERT) and distributed under the Apache 2.0 license
Product Compatible and additional computed target framework versions.
.NET net5.0 was computed.  net5.0-windows was computed.  net6.0 was computed.  net6.0-android was computed.  net6.0-ios was computed.  net6.0-maccatalyst was computed.  net6.0-macos was computed.  net6.0-tvos was computed.  net6.0-windows was computed.  net7.0 was computed.  net7.0-android was computed.  net7.0-ios was computed.  net7.0-maccatalyst was computed.  net7.0-macos was computed.  net7.0-tvos was computed.  net7.0-windows was computed.  net8.0 was computed.  net8.0-android was computed.  net8.0-browser was computed.  net8.0-ios was computed.  net8.0-maccatalyst was computed.  net8.0-macos was computed.  net8.0-tvos was computed.  net8.0-windows was computed. 
.NET Core netcoreapp1.0 was computed.  netcoreapp1.1 was computed.  netcoreapp2.0 was computed.  netcoreapp2.1 was computed.  netcoreapp2.2 was computed.  netcoreapp3.0 was computed.  netcoreapp3.1 was computed. 
.NET Standard netstandard1.1 is compatible.  netstandard1.2 was computed.  netstandard1.3 was computed.  netstandard1.4 was computed.  netstandard1.5 was computed.  netstandard1.6 was computed.  netstandard2.0 was computed.  netstandard2.1 was computed. 
.NET Framework net45 was computed.  net451 was computed.  net452 was computed.  net46 was computed.  net461 was computed.  net462 was computed.  net463 was computed.  net47 was computed.  net471 was computed.  net472 was computed.  net48 was computed.  net481 was computed. 
MonoAndroid monoandroid was computed. 
MonoMac monomac was computed. 
MonoTouch monotouch was computed. 
Tizen tizen30 was computed.  tizen40 was computed.  tizen60 was computed. 
Universal Windows Platform uap was computed.  uap10.0 was computed. 
Windows Phone wpa81 was computed. 
Windows Store netcore was computed.  netcore45 was computed.  netcore451 was computed. 
Xamarin.iOS xamarinios was computed. 
Xamarin.Mac xamarinmac was computed. 
Xamarin.TVOS xamarintvos was computed. 
Xamarin.WatchOS xamarinwatchos was computed. 
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.

NuGet packages (3)

Showing the top 3 NuGet packages that depend on dnYara.Interop:

Package Downloads
dnYara

dnYara (for Yara v4.0.0 to v4.1.1) is a .Net Standard wrapper for the native Yara library. It lets you use all the features of Yara that the native C library exposes ! It is built in C# / .Net Standard to ensure compatibility with a maximum of .Net frameworks, and to be cross-platform. The compiled libyara shared library for Windows can be provided by dnYara.NativePack. You can also compile the library yourself for your platform with cmake (instruction at https://github.com/airbus-cert/dnYara).

dnYara-ForkFire

dnYara (for Yara v4.0.0 to v4.1.1) is a .Net Standard wrapper for the native Yara library. It lets you use all the features of Yara that the native C library exposes ! It is built in C# / .Net Standard to ensure compatibility with a maximum of .Net frameworks, and to be cross-platform. The compiled libyara shared library for Windows can be provided by dnYara.NativePack. You can also compile the library yourself for your platform with cmake (instruction at https://github.com/airbus-cert/dnYara).

Ardin.dnYara

Ardin.dnYara (for Yara v4.0.0 to v4.1.1) is a .Net Standard wrapper for the native Yara library. It lets you use all the features of Yara that the native C library exposes ! It is built in C# / .Net Standard to ensure compatibility with a maximum of .Net frameworks, and to be cross-platform. The compiled libyara shared library for Windows can be provided by dnYara.NativePack. You can also compile the library yourself for your platform with cmake (instruction at https://github.com/mvardin/dnYara).

GitHub repositories

This package is not used by any popular GitHub repositories.

Version Downloads Last updated
2.1.0 943 1/5/2022
2.0.0 538 1/4/2022
1.1.0 363 1/4/2022
1.0.3.4 783 1/7/2020
1.0.3.3 600 1/6/2020
1.0.3.2 608 12/18/2019
1.0.3.1 560 12/18/2019
1.0.1 1,129 4/30/2019