Home / Golang / Security

Go bindings for YARA

go-yara Go bindings for YARA, staying as close as sensible to the library's C-API while taking inspiration from the yara-python implementation. Installation Unix On a Unix system with libyara_ version
Information
Category: Golang / Security
Watchers: 22
Star: 262
Fork: 91
Last update: Jun 28, 2022
Resource links
https://github.com/hillu/go-yara

Logo

go-yara

GoDoc Travis Go Report Card

Go bindings for YARA, staying as close as sensible to the library's C-API while taking inspiration from the yara-python implementation.

Build/Installation

On a Unix system with libyara version 4, corresponding header files, and pkg-config installed, just do:

go get github.com/hillu/go-yara
go install github.com/hillu/go-yara

If libyara has been installed to a custom location, the PKG_CONFIG_PATH environment variable can be used to point pkg-config at the right yara.pc file.

For anything more complicated, refer to the "Build Tags" section below. Instructions for cross-building go-yara for different operating systems or architectures can be found in README.cross-building.md.

Build Tags

The build tag yara_static can be used to tell the Go toolchain to run pkg-config with the --static switch. This is not enough for a static build; the appropriate linker flags (e.g. -extldflags "-static") still need to be passed to the go tool.

The build tag yara_no_pkg_config can be used to tell the Go toolchain not to use pkg-config's output. In this case, any compiler or linker flags have to be set via the CGO_CFLAGS and CGO_LDFLAGS environment variables, e.g.:

export CGO_CFLAGS="-I${YARA_SRC}/libyara/include"
export CGO_LDFLAGS="-L${YARA_SRC}/libyara/.libs -lyara"
go install -tags yara_no_pkg_config github.com/hillu/go-yara

YARA 4.x vs. earlier versions

This version of go-yara can only be used with YARA 4.0 or later.

Versions of go-yara compatible with YARA 3.11 are available via the v3.x branch or tagged v3.* releases.

Versions of go-yara compatible with earlier 3.x versions of YARA are available via the v1.x branch or tagged v1.* releases.

License

BSD 2-clause, see LICENSE file in the source distribution.

Author

Hilko Bengen <[email protected]>

6 Open More issues
Closed

Assertion failed: r1.o != NULL, file exec.c, line 889

I am scanning files against a large collection of compiled yara rules. I am using yara-4.0.0

I am encountering this error when I try to run the cross-compiled version of the same go code on windows OS.

When I scan the same files with the same yara ruleset on linux, everything goes smoothly. I already searched a bit for this issue and I was hoping getting rid of the hash import in yara would solve the problem. Unfortunately it did not.

Any idea what might be causing this?

opened May 19, 2020 by lawiet47 24
Closed

Segfault with YARA 4.1.0 RC2

Is this compatible with YARA 4.1.0? When trying to build this with that version in Debian unstable, I get test failures due to segfaults on amd64:

github.com/hillu/go-yara
   dh_auto_test -O--buildsystem=golang
	cd obj-x86_64-linux-gnu && go test -vet=off -v -p 6 github.com/hillu/go-yara
=== RUN   TestBasic
    cbpool_test.go:25: Get: Got expected panic: Attempt to get nonexistent value from pool
    cbpool_test.go:43: Delete: Got expected panic: Attempt to delete nonexistent value from pool
    cbpool_test.go:57: full pool: Got expected panic: cbPool storage exhausted
--- PASS: TestBasic (0.00s)
=== RUN   TestCompiler
    compiler_test.go:21: expected error: syntax error
--- PASS: TestCompiler (0.00s)
=== RUN   TestPanic
    compiler_test.go:31: Everything ok, MustCompile panicked: syntax error
--- PASS: TestPanic (0.00s)
=== RUN   TestWarnings
    compiler_test.go:43: Recorded Errors=[]yara.CompilerMessage{yara.CompilerMessage{Filename:"", Line:1, Text:"syntax error"}}, Warnings=[]yara.CompilerMessage(nil)
--- PASS: TestWarnings (0.00s)
=== RUN   TestCompilerIncludeCallback
    compiler_test.go:52: Processing include "existing" (from ns="default", file="")
    compiler_test.go:52: Processing include "non-existing" (from ns="default", file="")
    compiler_test.go:73: Compiler returned error on attempt to include non-existing rule: callback failed to provide include resource: non-existing
--- PASS: TestCompilerIncludeCallback (0.00s)
=== RUN   TestIterator
fatal error: unexpected signal during runtime execution
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x0]

runtime stack:
runtime.throw(0x5985c8, 0x2a)
	/usr/lib/go-1.15/src/runtime/panic.go:1116 +0x72
runtime.sigpanic()
	/usr/lib/go-1.15/src/runtime/signal_unix.go:726 +0x4ac

goroutine 11 [syscall]:
runtime.cgocall(0x544e60, 0xc000058dd0, 0x1)
	/usr/lib/go-1.15/src/runtime/cgocall.go:133 +0x5b fp=0xc000058da0 sp=0xc000058d68 pc=0x407ffb
github.com/hillu/go-yara._Cfunc_yr_rules_scan_mem_blocks(0x79c630, 0xc0001003f0, 0x8, 0x5443b0, 0x76b838, 0xc000000000, 0xc000000000)
	_cgo_gotypes.go:1567 +0x4d fp=0xc000058dd0 sp=0xc000058da0 pc=0x5353ad
github.com/hillu/go-yara.(*Rules).ScanMemBlocks.func1(0xc000010098, 0xc0001003f0, 0x0, 0x5c2080, 0xc00000e200, 0x76b838, 0x0, 0x7f5a029ce108)
	/build/golang-github-hillu-go-yara-4.0.5/obj-x86_64-linux-gnu/src/github.com/hillu/go-yara/rules.go:182 +0x145 fp=0xc000058e30 sp=0xc000058dd0 pc=0x540625
github.com/hillu/go-yara.(*Rules).ScanMemBlocks(0xc000010098, 0x5c36c0, 0xc00000e220, 0x0, 0x0, 0x5c2080, 0xc00000e200, 0x0, 0x0)
	/build/golang-github-hillu-go-yara-4.0.5/obj-x86_64-linux-gnu/src/github.com/hillu/go-yara/rules.go:182 +0x285 fp=0xc000058ef0 sp=0xc000058e30 pc=0x53a545
github.com/hillu/go-yara.TestIterator(0xc000130480)
	/build/golang-github-hillu-go-yara-4.0.5/obj-x86_64-linux-gnu/src/github.com/hillu/go-yara/mem_blocks_test.go:54 +0xda fp=0xc000058f80 sp=0xc000058ef0 pc=0x52a4da
testing.tRunner(0xc000130480, 0x59c310)
	/usr/lib/go-1.15/src/testing/testing.go:1123 +0xef fp=0xc000058fd0 sp=0xc000058f80 pc=0x4e206f
runtime.goexit()
	/usr/lib/go-1.15/src/runtime/asm_amd64.s:1374 +0x1 fp=0xc000058fd8 sp=0xc000058fd0 pc=0x471541
created by testing.(*T).Run
	/usr/lib/go-1.15/src/testing/testing.go:1168 +0x2b3

goroutine 1 [chan receive]:
testing.(*T).Run(0xc000130480, 0x58fcf9, 0xc, 0x59c310, 0x489901)
	/usr/lib/go-1.15/src/testing/testing.go:1169 +0x2da
testing.runTests.func1(0xc000001980)
	/usr/lib/go-1.15/src/testing/testing.go:1439 +0x78
testing.tRunner(0xc000001980, 0xc000057cf0)
	/usr/lib/go-1.15/src/testing/testing.go:1123 +0xef
testing.runTests(0xc00000e0a0, 0x685300, 0x27, 0x27, 0xc01331720406f728, 0x8bb31abbc6, 0x69a980, 0xc000057db8)
	/usr/lib/go-1.15/src/testing/testing.go:1437 +0x2fe
testing.(*M).Run(0xc000122000, 0x0)
	/usr/lib/go-1.15/src/testing/testing.go:1345 +0x1eb
github.com/hillu/go-yara.TestMain(0xc000122000)
	/build/golang-github-hillu-go-yara-4.0.5/obj-x86_64-linux-gnu/src/github.com/hillu/go-yara/main_test.go:35 +0x1a5
main.main()
	_testmain.go:125 +0x165
FAIL	github.com/hillu/go-yara	0.024s
FAIL
opened Apr 6, 2021 by satta 19
Closed

Linux Process Scan Question

Hello, Thank you for the great work. I was able compile go-yara statically under Linux and Windows (using msys2) and it works.

I am new to yara and my question is about scanning process(es) using yara executable or go-yara. Both Scanner.ScanProc or yr_scanner_scan_proc show same behavior on my laptop, Ubuntu 18.04 amd64. The scanned (target) process's RSS memory increases almost up to VSS memory. This becomes impossible when I want to scan all the available processes due to memory, I ran out of memory. Besides, I use the simplest yara rule just to search for a string existence.

What I see from yara Windows code, it does not scan uncommited memory pages of a process but under Linux story is different.

I really need a guidance to scan all processes without crashing the Linux OSes. One can try to scan chrome/firefox/Xorg processes and watch with top/htop to see how their memory usage changes.

opened Mar 5, 2021 by ozanh 18
Closed

lib installation on Windows

Hi,

I'm trying to use your library on Windows. I'm not familiar with C/C++ and linker/compilation problems but i've searched a lot before posting here. Maybe you could help me. First, i've installed mingw64 and also the latest version of visual studio. I've cloned the official yara repository and successfuly compiled libyara with visual studio. I saw that i've got the following folders:

  • C:\YARA\windows\libyara (with a lot of *.obj files)
  • C:\YARA\libyara (with a lot of *.c files)
  • C:\YARA\libyara\include (with *.h files)
  • C:\YARA\windows\vs2017\libyara\Release (with a 22MB libyara64.lib)

I didn't understood what i need to put in CGO_LDFLAGS and CGO_CFLAGS env vars or if i need additional compilations to successfully go get github.com/hillu/go-yara.

Actually it just return the following error:

# runtime/cgo
C:/mingw64/mingw64/bin/../lib/gcc/x86_64-w64-mingw32/8.1.0/../../../../x86_64-w64-mingw32/bin/ld.exe: cannot find -lyara

Any help would be appreciated :)

opened Nov 28, 2020 by codeyourweb 15
Closed

Compiling for Windows instructions

I have been struggling to get this compiled for windows using MinGW.

It would be good to have more instructions on how to proper compile the Yara project and generate libyara for windows 32 and 64bit. Even thought Yara has the Visual Studio solutions and I can easily generate libyara32.lib and libyara64.lib.... Not sure if these are compatible with MinGW and CGO

And how to have this package use these libs with CGO.

opened Jan 25, 2017 by mcastilho 15
Closed

cgo pointer rules break ScanMem [go 1.6]

When scanning a byte slice with ScanMem go panics with:

panic: runtime error: cgo argument has Go pointer to Go pointer

goroutine 7 [running]:
panic(0x5fbd00, 0xc82000e8b0)
    /usr/lib/go/src/runtime/panic.go:481 +0x3e6
github.com/hillu/go-yara._cgoCheckPointer0(0x5a9be0, 0xc820016fe4, 0x0, 0x0, 0x0, 0x54417e)
    ??:0 +0x4d
github.com/hillu/go-yara.addString(0xc82000e888, 0x11b3dd4, 0x0, 0xc820016fe4, 0xc800000030)
    /home/tom/src/github.com/hillu/go-yara/rules.go:117 +0xce
github.com/hillu/go-yara._cgoexpwrap_f3bc5924bb1c_addString(0xc82000e888, 0x11b3dd4, 0x0, 0xc820016fe4, 0xc800000030)
    ??:0 +0x47
github.com/hillu/go-yara._Cfunc_yr_rules_scan_mem(0x12360e0, 0xc820016fe4, 0x3b, 0x1, 0x58a900, 0xc82000e888, 0x1, 0x0)
    ??:0 +0x44
github.com/hillu/go-yara.(*Rules).ScanMem(0xc82002c068, 0xc820016fe4, 0x3b, 0x40, 0x1, 0x3b9aca00, 0x0, 0x0, 0x0, 0x0, ...)
    /home/tom/src/github.com/hillu/go-yara/rules.go:147 +0x23d

Using a bytes.Buffer in rules_test.go/TestReader seems to trigger the above error

diff --git a/rules_test.go b/rules_test.go
index ca59966..83b912d 100644
--- a/rules_test.go
+++ b/rules_test.go
@@ -109,7 +109,10 @@ func TestReader(t *testing.T) {
        if err != nil {
                t.Fatalf("ReadRules: %+v", err)
        }
-       m, err := r.ScanMem([]byte(" abc "), 0, 0)
+
+       buf := &bytes.Buffer{}
+       buf.Write([]byte(" abc "))
+       m, err := r.ScanMem(buf.Bytes(), 0, 0)
        if err != nil {
                t.Errorf("ScanMem: %s", err)
        }
opened Aug 8, 2016 by sprungknoedl 14
Open

Is there a code sample or a tutorial for beginners somewhere?

I can't simply use go-yara like I can with yara-python，Is there a code sample or a tutorial for beginners somewhere?

opened Jun 17, 2022 by b1tkeeper 3
Open

WASM support

This is probably "just" a matter of documentation, though here's the idea:

For an analysis tool running in a web browser based on Go and WASM, libyara would need to support that compile target.

There is already libyara-wasm and wasmer-go. Now the question is what exactly needs to be done such that I can write a Go function to be called from JavaScript through WASM.

So far, I have been using webpack-golang-wasm-async-loader in Fiedka (branch to replace main somewhat soon).

My overall goal is to get https://github.com/Mimoja/MFT-AnalyserV2 in as a package, so I'm dealing with multiple modules and transitive dependencies, for which I do have forks and branches, especially https://github.com/orangecms/MFT-AnalyserV2/tree/fiedka. Anyhow, every little hint would be highly appreciated. :bow:

opened Sep 19, 2021 by orangecms 1
Open

Relative paths in include statements

Hi!

Can't seem to load files that has include statements like this:

include "subdir/SomeGreatYaraRules.yar"

I load these files with err := compiler.AddFile(f, "ns")

opened Dec 11, 2019 by uggwar 7
Open

Add tags to public struct fields

This is for people using your awesome library that want to send the results as JSON somewhere else like a DB etc etc.

opened Jan 5, 2019 by blacktop 1
Open

Errors cross compiling go-yara

I am trying to cross compile go-yara for x86 and x64 and I am getting some errors. The tool set for cross compiling is xgo.

I can cross compile correctly for darwin or windows, but I am unable to do it for linux.

x64

/usr/local/lib/libyara.a(math.o): In function `string_entropy':
math.c:(.text+0xecc): undefined reference to `log2'
/usr/local/lib/libyara.a(math.o): In function `data_entropy':
math.c:(.text+0x1150): undefined reference to `log2'
collect2: error: ld returned 1 exit status

x86

/usr/bin/ld: skipping incompatible /usr/local/lib/libyara.a when searching for -lyara
/usr/bin/ld: skipping incompatible //usr/local/lib/libyara.a when searching for -lyara
/usr/bin/ld: cannot find -lyara
collect2: error: ld returned 1 exit status

I am not sure that the errors came either from go-yara or yara itself.

If you need more datils, please ask them.

opened Feb 17, 2018 by Xumeiquer 7
Open

Add link to GoDoc Documentation

It turns out that the repo doesn't contain much in the way of documentation, so I think a prominent link to the docs would be awesome. Adding some examples wouldn't be bad either (I'll add a PR for that later if I get some time).

opened Nov 2, 2017 by sroberts 0

Contents

    VirusTotal The pattern matching swiss knife
    alexander-hanel A python script that can be used to scan data within in an IDB using Yara.
    fox-it Generating YARA rules based on binary code
    white-oak qml - Safe QML bindings for Rust
    tmattio High-quality JavaScript bindings for OCaml
    webview Tiny cross-platform webview library for C/C++/Golang. Uses WebKit (Gtk/Cocoa) and Edge (Windows)
    White-Oak qml-rust — QML bindings.
    botherder Cross-platform Yara scanner written in Go
    immortalp0ny Yet another rule generator for Yara
    AlienVault-OTX A Yara rule generator for finding related samples and hunting
    CERT-Polska YARA malware query accelerator (web frontend)
    imp0rtp3 Yara Based Detection Engine for web browsers
    Neo23x0 A guide on how to write fast and memory friendly YARA rules
    Neo23x0 A YARA Rule Performance Measurement Tool
    target Automatically create YARA rules from malicious documents.
    3c7 A simple program to manage your yara ruleset in a (sqlite) database.
    rpgeeganage Audit Node Module folder with YARA rules to identify possible malicious packages hiding in node_moudles
    jas502n check cs yara rules
    hejelylab C# Desktop GUI application that either performs YARA scan locally or prepares the scan in Active Directory domain environment with a few clicks.
    teh-cmc Up-to-date Go bindings for SFML, the Simple and Fast Multimedia Library.
    hynek Low-level Python CFFI Bindings for Argon2
    Share this repo

    Related Repos


    Security
    285
    The SSH directory ✨
    charmbracelet Wishlist The SSH directory ✨ With Wishlist you can have a single entrypoint for multiple SSH endpoints, whether they are Wish apps or not. As a server
     
    Security
    2.3k
    Make your ssh client smarter
    moul A transparent wrapper that adds support for regex, aliases, gateways, dynamic hostnames, graphviz, json output, yaml configuration, and more to SSH.
     
    Security
    1.2k
    Jump host/Jump server without the jump, a.k.a Transparent SSH bastion
    moul sshportal Jump host/Jump server without the jump, a.k.a Transparent SSH bastion Features include: independence of users and hosts, convenient user inv
     
    Security
    1.8k
    A ssh server that knows who you are. $ ssh whoami.filippo.io
    FiloSottile whoami.filippo.io An ssh server that knows who you are. Try it (it's harmless) ssh whoami.filippo.io ED25519 key fingerprint is SHA256:qGAqPqtlvFBCt4
     
    Security
    265
    Programmable SSH frontend
    gliderlabs sshfront A lightweight SSH server frontend where authentication and connections are controlled with command handlers / shell scripts. Using sshfront U
     
    Security
    889
    Run SSH and HTTP(S) on the same port
    jamescun Switcher Switcher is a proxy server which accepts connections and proxies based on which protocol is detected. Currently implemented is: SSH The use c
     
    Security
    162
    SSH over QUIC
    moul quicssh 😄 quicssh is a QUIC proxy that allows to use QUIC to connect to an SSH server without needing to patch the client or the server. Architecture
     
    Security
    562
    The missing reverse proxy for ssh scp
    tg123 SSH Piper SSH Piper works as a proxy-like ware, and route connections by username, src ip , etc. +---------+ +------------------+
     
    Security
    193
    Easy creation of secure SSH configuration for your GitHub account(s)
    dolmen NAME github-keygen - bootstrap your GitHub SSH configuration SYNOPSIS Unix/Linux/MacOS X: git clone https://github.com/dolmen/github-keygen.git cd git
     
    Security
    58
    bring your .bashrc, .vimrc, etc. with you when you ssh
    danrabinowitz Installation Ubuntu (12.04 and 14.04 only): $ sudo add-apt-repository ppa:russell-s-stewart/ppa $ sudo apt-get update $ sudo apt-get install sshrc Ev
     
    Security
    5
    🔧 Golang SSH Keys manipulation library
    moul 🔧 Golang SSH Keys manipulation library
     
    Security
    1.8k
    A curated list of SSH apps, libraries and resources.
    moul Awesome SSH A curated list of SSH apps, libraries and resources. Inspired by the awesome list thing. Please read the contribution guidelines if you wa
     
    Security
    2k
    rtop is an interactive, remote system monitoring tool based on SSH
    rapidloop rtop rtop is a remote system monitor. It connects over SSH to a remote system and displays vital system metrics (CPU, disk, memory, network). No speci
     
    Security
    10
    A teaching mainnet
    notional-labs seahorse seahorse is 369 or so males pumping out 2000 or so young per batch and a teaching project for new validators. We don't have a cla or anything
     
    Security
    16
    Check, exploit, obfuscate, TLS, ACME about log4j2 vulnerability in one Go program.
    For-ACGN Log4Shell Check, exploit, obfuscate, TLS, ACME about log4j2 vulnerability in one Go program. Feature Only one program and easy deployment Support comm