Skip to content

Instantly share code, notes, and snippets.

@tlansec
Created February 21, 2022 10:08
Show Gist options
  • Save tlansec/e4bcd7f65c21acddec848fca14cab978 to your computer and use it in GitHub Desktop.
Save tlansec/e4bcd7f65c21acddec848fca14cab978 to your computer and use it in GitHub Desktop.
Simple script to demo use of yara-python + externals
# Simple script to demo use of yara-python + externals
# think of all the externals you could define!
import os
import sys
import yara
example_rule = '''
rule demo_externals
{
condition:
filename == "target.dat"
}
'''
target_file = sys.argv[1]
with open(target_file, 'rb') as infile:
data = infile.read()
externals_init = {
'filename' : ""
}
compiled_rules = yara.compile(source=example_rule, externals=externals_init)
match = compiled_rules.match(
data=data,
externals={
'filename': os.path.basename(sys.argv[1])
}
)
print(match)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment