ezyara 0.4.1

Python bindings for YARA-X

The official Python library for YARA-X. Supports Python 3.8+ in Linux, MacOS and Windows.

import ezyara

rules = ezyara.compile('''
  rule test { 
    strings: 
      $a = "foobar" 
    condition: 
      $a
  }''')

results = rules.scan(b"foobar")

assert results.matching_rules[0].identifier == "test"
assert results.matching_rules[0].patterns[0].identifier == "$a"
assert results.matching_rules[0].patterns[0].matches[0].offset == 0
assert results.matching_rules[0].patterns[0].matches[0].length == 6

For more information about how to use this library, please check the documentation.