Yaramod is a C++ library with Python bindings capable of parsing, building, formatting and also modifying YARA rules; hence the main four parts of Yaramod are:
- Parser of YARA rules
The main parser class is the
ParserDriverclass declared in the header file
parser_driver.hand defined in source file
parser_driver.cpp. The parser is based on POG and its grammar and tokens are defined in methods
ParserDriverclass. Detailed wiki page on how to use yaramod to parse YARA rules can be found in this section.
- Builder of YARA rules
The builder machinery is declared within the builder folder. The
YaraExpressionBuildercreates expressions so that YARA rules conditions can be created. The
YaraHexStringBuilderis a tool for easy creation of hexadecimal strings. The
YaraRuleBuilderhelps to create YARA rules and the
YaraFileBuilderis there to construct YARA files from rules and module imports. More on the construction of YARA files is written here.
- YARA rules formatting
The main component taking care of proper formatting of YARA files is the
TokenStreamdefined in file
YaraFileinstance holds a
TokenStreaminstance in which all Tokens that the
YaraFilerefers to are stored. The
TokenStream::getTextmethod prints the tokens formatted in the desired format. The
YaraFile::getTextFormattedmethod simply calls the
getTextmethod of the TokenStream that it owns. Please see wiki page for more on formatting.
- YARA rules modifying visitor
ModifyingVisitoris defined in modifying_visitor.h and serves as the base class for our custom visitors designed to modify specific parts of visited conditions. See section Modifying Rulesets for more information and examples.
Run it locally¶
See Installation section.