yara-grep 0.3.0

CLI tool for rapid Yara rule prototyping

ygrep

<<<<<<< HEAD CLI tool for rapid Yara rule testing.

CLI tool for rapid Yara rule prototyping.

Installation

pip install yara-grep

Usage

2ef6932 (Initial commit)

usage: ygrep.py [-h] [-l] [-n] [-a] [-m MODIFIER] [-b BYTES] [-s STRING] [path]

yara grep - cmdline string/byte search

positional arguments:
  path                  search path (default: **)

optional arguments:
  -h, --help            show this help message and exit
  -l, --quiet           list matching filenames only (suppress normal output)
  -n, --dry-run         do not scan, compile rule only
  -a, --any             set condition to 'any of them' (default: 'all of them')
  -m MODIFIER, --modifier MODIFIER
                        modifier for string patterns - e.g. ascii,wide,nocase,xor,base64,base64wide
  -b BYTES, --bytes BYTES
                        bytes to grep
  -s STRING, --string STRING
                        string to grep

<<<<<<< HEAD

Example:

=======

Example

2ef6932 (Initial commit)

>>> ygrep -s "InternetConnectA" -s "WinHttpConnect" -a -m "xor"
rule x {
    strings:
        $s0 = "InternetConnectA" xor
        $s1 = "WinHttpConnect" xor
    condition:
        any of them
}

extracted\api.VirtualAlloc.0x504000.mem
--------  -------------------  -----------------------------------------------
0x229d5c  b'InternetConnectA'  49 6e 74 65 72 6e 65 74 43 6f 6e 6e 65 63 74 41
0x22ab1a  b'WinHttpConnect'    57 69 6e 48 74 74 70 43 6f 6e 6e 65 63 74
--------  -------------------  -----------------------------------------------
extracted\api.VirtualAlloc.0x85000.mem
-------  -------------------  -----------------------------------------------
0x28dcc  b'InternetConnectA'  49 6e 74 65 72 6e 65 74 43 6f 6e 6e 65 63 74 41
-------  -------------------  -----------------------------------------------
sdfmsdofpd
---  ----------------------------  -----------------------------------------------
0x8  b"\x1c;!0';0!\x16:;;06!\x14"  1c 3b 21 30 27 3b 30 21 16 3a 3b 3b 30 36 21 14
---  ----------------------------  -----------------------------------------------

<<<<<<< HEAD


=======
>>>>>>> 2ef6932 (Initial commit)
>>> ygrep -b "AA ?? AA ?? BB" -s "kernel32"

rule x {
    strings:
        $s0 = "kernel32" ascii wide nocase
        $b0 = { AA ?? AA ?? BB }
    condition:
        all of them
}

samples\tmp7v4jjmpn
---------  -----------------------  -----------------------
0x52f8     b'kernel32'              6b 65 72 6e 65 6c 33 32
0xe554     b'kernel32'              6b 65 72 6e 65 6c 33 32
0x27a08    b'kernel32'              6b 65 72 6e 65 6c 33 32
0x27c46    b'kernel32'              6b 65 72 6e 65 6c 33 32
0x27d34    b'kernel32'              6b 65 72 6e 65 6c 33 32
0x28578    b'kernel32'              6b 65 72 6e 65 6c 33 32
0x5a91c    b'KERNEL32'              4b 45 52 4e 45 4c 33 32
0xa5224    b'KERNEL32'              4b 45 52 4e 45 4c 33 32
0xf50ac    b'KERNEL32'              4b 45 52 4e 45 4c 33 32
0x102a00   b'KERNEL32'              4b 45 52 4e 45 4c 33 32
0x1137bf0  b'\xaa\xb4\xaa\xa3\xbb'  aa b4 aa a3 bb
0x151c6a2  b'\xaa\x7f\xaa\xfe\xbb'  aa 7f aa fe bb
---------  -----------------------  -----------------------