Wesley Shields

Victor just released v1.14.0 - improvements in macho module, tighter code generation in the compiler and the new “deps” command.

Congratulations to everyone involved!

github.com/VirusTotal/y...

Spent some time yesterday cleaning up my dependency graphing code for yara-x. No longer outputs graphviz. Instead it dumps an ascii tree. You can try it with “yr deps” in the next release.

Threats to the Defense Industrial Base | Google Cloud Blog The defense sector faces a relentless barrage of operations conducted by state-sponsored actors and criminal groups.

Some of the analysis I've done over the past few years is referenced in various places in this overview. I might be most happy that my sneaky reference to the time a half-dozen of us ate a Vermonster in a single attempt made it into the report. cloud.google.com/blog/topics/...

Haha! My son and I were just saying how this has been an insanely boring first half.

Release v1.13.0 · VirusTotal/yara-x Add crx and dex modules to Python invoke API (#534). Add Python API for specifying the metadata that should be passed to modules (6bebe34): Output filenames that needs reformatting when using yr fm...

github.com/VirusTotal/y... - Once again, new release with some good bug fixes and nice improvements.

Release v1.12.0 · VirusTotal/yara-x Improvements in the parser to produce better Concrete Syntax Trees (#531, c46b3bd). BUGFIX: avoid panic when parsing some regular expressions (136ab9f).

YARA-X 1.12.0 is out. Some small bug fixes but still worth upgrading! Once again, congrats to Victor and the contributors as the project keeps getting better.

github.com/VirusTotal/y...

Release v1.11.0 · VirusTotal/yara-x Make the parser stricter (#502). Implement dex module (#458). Implement C api console log (#515). Implement permhash for the crx module (#510). Implement the imports() method for the Rules object i...

github.com/VirusTotal/y... - 1.11.0 is out! Lots of new features, modules and bug fixes. Read the release notes and congrats to Victor and the contributors!

a man and a woman are standing next to each other and the woman is wearing a skeleton tank top . ALT: a man and a woman are standing next to each other and the woman is wearing a skeleton tank top .

I like that the rage amount is a constant 11 for a single laptop or a fleet of them.

Yeah, could be done.

To do what? Have the ability to write JS UDF?

One wheel Jesus was at the Christmas parade again. All praise be to one wheel Jesus and his crew.

I’m not judging (I am) but pantscon5 is the ideal situation.

Also, using this scale to describe level of formality for meetings at work (I already use it for non-work) is on my OKRs.

Please describe your requirement for the level of fancy using the pantscon scale: pantscon5.com

feat: More constraints on hashes by wxsBSD · Pull Request #509 · VirusTotal/yara-x The imphash implementation always returns a lowercase md5. This commit switches the type of the returned value so that it can be used to generate warnings. Warnings are now generated if you use an ...

Quality of life improvement for yara-x:

I realized the functions that output hash values do not have constraints on them like the hash module functions do. See virustotal.github.io/yara-x/blog/... for details on why this is useful to extend everywhere.

PR that fixes it: github.com/VirusTotal/y...

Release v1.10.0 · VirusTotal/yara-x New yr fix warnings command (#493). Generate more efficient WASM code for some expressions, reducing the size of compiled rules (5efc214, a865681). Improve the API for traversing the AST in DFS ord...

Yara-x 1.10.0 released today! It can now automatically fix some warnings, and some improvements in code generation. This is another great step forward for the project.

github.com/VirusTotal/y...

Yeah, same basic idea between us. Mine was the first thing that popped into my head with no actual optimizations to avoid “counting” - great minds think alike!

That will "count" printable bytes starting at "offset" and going for at most 100 bytes or until it hits a non-printable. I can easily make it stop at just a 0x00 if you really want.

Do you want it to output ONLY the length? Is "counting" acceptable? If so:

import "console"

rule a {
condition:
with offset = 0: (
for all i in (0..100): (
with b = uint8(offset + i): (
b >= 0x20 and b <= 0x7e and console.log(i)
)
)
)
}

Don't ask why but you may now refer to me as "Sir Wesley, robot, esq." (thanks @gabagool.ing for that one) and gemini thinks this is what I look like. It may have had some help with the Pikachu hoodie and hot dogs. You're welcome for this visual.

Please do! Would love to know how it works for you!

Finally put this up for review in a PR (github.com/VirusTotal/y...) - it's now in it's own command and has been tested on some pretty gnarly graphs of rules. If you have huge dependency graphs the output gets messy, but it works well otherwise.

GitHub - wxsBSD/yara-x at deps Experimenting with YARA and Rust. Contribute to wxsBSD/yara-x development by creating an account on GitHub.

If you're interested in my dependency querying code for yara rules check out my deps branch: github.com/wxsBSD/yara-...

You can build it with "cargo build --features=debug-cmd" and use it like "yr debug deps -h". My TODO list for this is basically:

- Write tests

- Move to it's own command

@pdub5.bsky.social does great work! If you’re going to be at the conference go see his talk and maybe heckle him for me.

Once I get this landed upstream I'd like to expose this in the python bindings as it's the easiest language for people to walk an AST and find the things they are interested in, but that may take a bit. For now, I think just having an option to see output in JSON or graphviz is fine.

Second, it also lets you have a system that will include only the necessary import statements for those exported rules. Duplicate import statements are only a warning in yara-x (and just silently ignored in C yara) but it's still nice to use what you import rather than just importing everything.

First it lets you find dependencies in large rule sets. Imagine you have 10k rules and you want to share one specific one but it depends upon another rule, so you have to include that other rule in your export. This lets you identify only the minimum necessary rules easily.

As you can see, it correctly knows when to ignore things that might look like a module usage (pe identifier) when it is used in a with declaration or a for variable.

Why is this useful you might ask? Well, it lets you do two things...

wxs@mbp yara-x % cat rules/test.yara
rule a { condition: with pe = 1 + 1: (pe == time.now()) }
rule b { condition: a }
wxs@mbp yara-x % ./target/debug/yr debug deps rules/test.yara
Deps: {"a": [], "b": ["a"]}
Modules: {"a": ["time"]}
wxs@mbp yara-x %

I've got something built on Victor's new DFSIter for yara-x AST that takes a set of rules and outputs the dependencies and modules used (based upon the compiled list of modules). Ultimately I want to make it output a graphviz file for visualization but for now it's dumping them to stdout...