radare2/doc/yara.md

Yara plugin

Preliminary documentation on yara can be found here: Yara User's Manual

The following is 'YARA in a nutshell' from this document:

YARA is a tool aimed at helping malware researchers to identify and classify malware families. With YARA you can create descriptions of malware families based on textual or binary information contained on samples of those families. These descriptions, a.k.a rules, consist patterns and a boolean expression which determines its logic. Rules can be applied to files or running processes in order to determine if it belongs to the described malware family.

Requirements

You can either install libyara with your prefered package manager, or you can execute r2pm -i yara3-lib and r2pm -i yara3 in order to retrieve latest source, compile, and install the library.

Yara in radare2

radare2 provides several commands, allowing the user, to add or remove rules, scan a file, and list or use rules tags.

You can list the yara commands with the following r2 command yara3 [help].

Rules

By default, radare2 ships with some common crypto and packers rules that you can find in /usr/local/share/radare2/last/yara/ if you installed it r2 or radare2/shlr/yara/ in the git repo. They are loaded as soon as you start using the yara plugin. So you can issue yara scan and automatically see if your binary is packed with a known packer.

Example

Load a rule file on the fly, and then scan the currently opened file:

yara3 add /home/name/rules/malware.rules
yara3 scan

Yara versions

Because radare2 has support for both yara versions currently, depending from the version/plugin you've loaded, you need to use the proper versioned command. E.g. yara2 or yara3. For example yara3 scan.