Skip to content

Instantly share code, notes, and snippets.


Wesley Shields wxsBSD

View GitHub Profile
View gist:6ba82bcb8f658ed71b84

With the release of YARA 3.2.0 I wanted to show people how to utilize some of the new features. In particular I'll show an example for rich_signatures, import hashing and Authenticode signatures.

You'll need both of these for obvious reasons. :)

import "pe"
import "hash"
View gist:4d5d7677578f80cdf82a

Someone recently asked me if it is possible to test if a string is in a section or not in YARA. This is my attempt at an answer, and please note that some of the capabilities are still pending a merge to master.

// Make sure the string is in the .rsrc section.
rule test_in {
    $a = { DE AD BE EF 00 00 DE AD BE EF }
    $a in ((pe.sections[pe.section_index(".rsrc")].raw_data_offset)..(pe.sections[pe.section_index(".rsrc")].raw_data_offset + pe.sections[pe.section_index(".rsrc")].raw_data_size))
View gist:476c652a772465075d46

Here's what I was thinking of doing...

  // Description of the YARA rules to use. Each key is a group name used in additional_monitoring
  // or in scheduled_queries if you want.
  "yara": {
    "sig_group_1": [ "foo.sig", "bar.sig" ],
    "sig_group_2": [ "baz.sig" ]
View gist:8c92d10dfad9d4b38b04

I was recently asked how to check the entropy of a given section in YARA, and because the person who asked is clearly looking to learn how to fish instead of just being given fish I went into some detail on the explanation. With his permission I am sharing my response here.

It's a combination of a number of things:

math.in_range(test, lower, upper):

Given a test value, check to see if it is in range of the lower and upper bounds. This is an inclusive test.

math.entropy(offset, length):

View gist:2936585412fd57f039fd7ecd7b24cd1b
* fmtid + 24 == number of property identifiers and offsets
* fmtid + 28 == start of property identifier and offsets (4 bytes each)
rule test {
//$fmtid = { 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae }
$fmtid = { e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 }
$redacted_author = "REDACTED AUTHOR"
wxsBSD / gist:6d5e777afc31b3cf46d0
Last active Jul 14, 2018
Inferring contents of SSL sessions
View gist:6d5e777afc31b3cf46d0


Everything I'm talking about below is not new, but I thought it was an interesting idea and realized I already had the majority of pieces in place to play with it. I want to share what I learned. If you are at all interested in exploring this topic further a good paper on it is here. Also, a few years ago IOActive published a blog post on the technique which is also a good read. Finally, the last two paragraphs in section 6 of RFC5246 clearly document the problem the best I've been able to find:

Any protocol designed for use over TLS must be carefully designed to
deal with all possible attacks against it.  As a practical matter,
this means that the protocol designer must be aware of what security
properties TLS does and does not provide and cannot safely rely on
the latter.

YARA Loop Optimization Details

Let's look at the bytecode without my optimizations. Before we do that let's set some terminology, because I find it easier to use names compared YARA VM memory locations. These are the names I've mostly borrowed from the comments in the grammar:

  • memory 0: lower bound
  • memory 1: boolean_expression accumulator
  • memory 2: iteration counter
  • memory 3: upper bound

We'll be using this rule for the first example:


Keybase proof

I hereby claim:

  • I am wxsbsd on github.
  • I am wxs ( on keybase.
  • I have a public key whose fingerprint is 96D1 2E6B F61C 2F3D 83EF 8F0B BE54 310C 17F0 AA37

To claim this, I am signing this object:

wxsBSD / gist:019740e83faa7a7206f4
Last active May 11, 2019
YARA, now with more Math(TM)! (Thanks @alexcpsec)
View gist:019740e83faa7a7206f4


I'd like to explain some of the new things I've added to YARA which will be in the next release. This is in addition to the stuff I've written about here, which are already in 3.2.0. If you have not read that I suggest you start there as it will tie in nicely with some of the things I'm going to mention here. Lastly, some of these things are not yet merged into master but I expect them to be very soon.

Math Module

There is a new module in YARA called math. The intention of this module is to expose some functions which you can use in your rules to calculate specific properties.


In particular it provides these functions for calculating different values:

  • entropy

I've been working on optimizing the YARA compiler to generate better bytecode for loops. The goal is to skip as much of loops as possible by not iterating further once the loop condition is met. Here's the rule I'm using. Completely contrived and excessive, but it's to show the performance improvement:

wxs@wxs-mbp yara % cat rules/test.yara
rule a {
    for any i in (0..100000000): (i == 1)
wxs@wxs-mbp yara %
You can’t perform that action at this time.