YaraSharp

YaraSharp

C# wrapper around the Yara pattern matching library.

Use signatures form Loki or Yara.

Nuget package is available

Usage

//  All API calls happens here
YSInstance YSInstance = new YSInstance();
        
//  Declare external variables (could be null)
Dictionary<string, object> externals = new Dictionary<string, object>()
{
    { "filename", string.Empty },
    { "filepath", string.Empty },
    { "extension", string.Empty }
};

//	Get list of YARA rules
List<string> ruleFilenames = Directory.GetFiles(@"D:Testyara", "*.yar", SearchOption.AllDirectories).ToList();

//  Context is where yara is initialized
//  From yr_initialize() to yr_finalize()
using (YSContext context = new YSContext())
{
    //	Compiling rules
    using (YSCompiler compiler = instance.CompileFromFiles(ruleFilenames, externals))
    {
        //  Get compiled rules
        YSRules rules = compiler.GetRules();

        //  Get errors
        YSReport errors = compiler.GetErrors();
        //  Get warnings
        YSReport warnings = compiler.GetWarnings();


        //  Some file to test yara rules
        string Filename = @"";

		//  Get matches
		List<YSMatches> Matches = instance.ScanFile(Filename, rules,
				new Dictionary<string, object>()
				{
					{ "filename", Alphaleonis.Win32.Filesystem.Path.GetFileName(Filename) },
					{ "filepath", Alphaleonis.Win32.Filesystem.Path.GetFullPath(Filename) },
					{ "extension", Alphaleonis.Win32.Filesystem.Path.GetExtension(Filename) }
				}, 
				0);

		//  Iterate over matches
		foreach (YSMatches Match in Matches)
		{
			//...
		}
	}
	//  Log errors
}

For async scanning use must call destroy methods:

YaraSharp.CYaraSharp YSInstance = new CYaraSharp();
YaraSharp.CContext YSContext = new YaraSharp.CContext();
YaraSharp.CRules YSRules = YSInstance.CompileFromFiles(RuleFilenames, null, out Errors);

//  Async here

YSRules.Destroy();
YSContext.Destroy();

Reference

Libyara C API documentation for a general overview on how to use libyara.

Features and limitations

• Metadata supported
• Externals supported
• Async scanning supported
• It seems (through debug sessions) that modules are supported, but i haven't had cases that certanly used them. So this question is opened

Note

Soultion contains 2 projects:

• yara-master - where you can update yara sources for a new version
• YaraSharp - where you can modify sources in order to add / repair wrapper features

Other

Build in vs 2017

Compiled with yara 3.8.1

Yara patched to support unicode paths

You can use or modify the sources however you want

Special thanks to kallanreed