Created
March 11, 2018 20:33
-
-
Save TcM1911/af9806a1fb6b3b750eec4803b9a3894c to your computer and use it in GitHub Desktop.
Generate hex string yara condition for a function using Radare2
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# zig2yar | |
# Copyright (C) 2018 Joakim Kennedy | |
# This program is free software: you can redistribute it and/or modify | |
# it under the terms of the GNU General Public License as published by | |
# the Free Software Foundation, either version 3 of the License, or | |
# (at your option) any later version. | |
# This program is distributed in the hope that it will be useful, | |
# but WITHOUT ANY WARRANTY; without even the implied warranty of | |
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
# GNU General Public License for more details. | |
# You should have received a copy of the GNU General Public License | |
# along with this program. If not, see <http://www.gnu.org/licenses/>. | |
# Install r2pipe with `r2pm -i r2pipe-py` | |
# Add "$zig2yar=#!pipe python /path/to/zig2yar.py" to .config/radare2/radare2rc | |
# Run $zig2yar to get a yara signature of the current function. | |
import r2pipe | |
r2 = r2pipe.open() | |
get_offset = str('s') | |
offset = r2.cmd(get_offset) | |
fname = r2.cmdj('pdfj @ ' + offset)['name'] | |
zigname = 'zig2yar-' + fname | |
# Create zignature of the function. | |
r2.cmd('zaf ' + fname + ' ' + zigname) | |
zigs = r2.cmdj('zj') | |
r2.cmd('z-' + zigname) | |
byte_zig = '' | |
for zig in zigs: | |
if zig['name'] == zigname: | |
byte_zig = zig['bytes'] | |
break | |
# Convert to yara format | |
yara = ' '.join([byte_zig[i:i+2] for i in range(0, len(byte_zig), 2)]) | |
print('{ ' + yara.replace('.', '?') + ' }') |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment