fox-it / mkyara

Generating YARA rules based on binary code

mkYARA

Writing YARA rules based on executable code within malware can be a tedious task. An analyst cannot simply copy and paste raw executable code into a YARA rule, because this code contains variable values, such as memory addresses and offsets. The analyst has to disassemble the code and wildcard all the pieces in the code that can change between samples. mkYARA aims to automate this part of writing rules by generating executable code signatures that wildcard all these little pieces of executable code that are not static.

Installation

Installation is as easy as installing the pip package.

pip install mkyara

Usage

import codecs
from capstone import CS_ARCH_X86, CS_MODE_32
from mkyara import YaraGenerator

gen = YaraGenerator("normal", CS_ARCH_X86, CS_MODE_32)
gen.add_chunk(b"\x90\x90\x90", offset=1000)
gen.add_chunk(codecs.decode("6830800000E896FEFFFFC3", "hex"), offset=0x100)
gen.add_chunk(b"\x90\x90\x90\xFF\xD7", is_data=True)
rule = gen.generate_rule()
rule_str = rule.get_rule_string()
print(rule_str)

Standalone Tool

mkYARA comes with a standalone tool that is cross platform, as in, it can create signatures for Windows binaries running under Linux.

usage: mkyara [-h] [-i {x86}] [-a {32,64,x86,x64}] -f FILE_PATH [-n RULENAME]
              -o OFFSET -s SIZE [-m {loose,normal,strict}] [-r RESULT] [-v]

Generate a Yara rule based on disassembled code

optional arguments:
  -h, --help            show this help message and exit
  -i {x86}, --instruction_set {x86}
                        Instruction set
  -a {32,64,x86,x64}, --instruction_mode {32,64,x86,x64}
                        Instruction mode
  -f FILE_PATH, --file_path FILE_PATH
                        Sample file path
  -n RULENAME, --rulename RULENAME
                        Generated rule name
  -o OFFSET, --offset OFFSET
                        File offset for signature
  -s SIZE, --size SIZE  Size of desired signature
  -m {loose,normal,strict}, --mode {loose,normal,strict}
                        Wildcard mode for yara rule generation
                        loose = wildcard all operands
                        normal = wildcard only displacement operands
                        strict = wildcard only jmp/call addresses
  -r RESULT, --result RESULT
                        Output file
  -v, --verbose         Increase verbosity

IDA Plugin

mkYARA comes with a IDA plugin to easily create YARA signatures by selecting a set of instructions and choosing one of the mkYARA -> Generate YARA rule options. Installation is as easy as installing the pip package and copying the mkyara_plugin.py to your IDA plugin directory.

mkyara's Issues

ida 7.7 compatibility

IDA plugin is crashing during run in the 7.7 version of the IDA

Further work is not possible and IDA will close.
Would you like to create a crash dump for a bug report?

IDA has encountered a problem.
It is recommended to save your work and restart IDA.
A mini dump file has been created in 'ida-20220111-194417-24272.dmp'
Please send it to <[email protected]>```

How install PyQt5

i want install PyQt5 in Window x86
ida python just use python 2.x but PyQt5 supposed in python 3.x.
i already try everything. :(

- s command

For Mkyara standalone What Does the -s command does in terms of size. It changes the code chunk from which it makes Yara rule....???? and by what unit for example Id I have defined -s 80 will it take 80 bytes of code. Is there any kind of documentation for that and also I want to understand how does the program does it.

Thanks

Possible bug for escaping instructions starting with zero byte ("00", add X, X)

Hi!

I was working on my disassembler's instruction wildcarding and also had a look at how you have been doing it with mkYARA.
While revisiting capstone's internals, I noticed that you use instruction.opcode to determine the number of opcode bytes.
Please note that there are at least two cases, where you may possibly calculate too few opcode bytes:

1. Instructions starting with "00" (add ...)
2. Instructions starting with "0F00" (sldt/lldt/ltr/str/verr/verw ...)

Iterating over capstones instruction.opcode will here give you a 0 for these respective bytes in position 0 and 1, despite that one byte being an opcode byte.
Since these are very rare instructions, the impact imho is negligible but I thought you might be interested to know about it. :)

Here's how I decided to handle these special cases now (64bit aware, in case we have a REX prefix):

        opcode_length = 0
        if cap_ins.rex:
            # we need to add one, because we are apparently in 64bit mode and have a REX prefix
            opcode_length += 1
        if (cap_ins.rex and cleaned[2:].startswith("00")) or cleaned.startswith("00"):
            # this can only be ADD PTR, REG with exactly one opcode bytes 
            opcode_length += 1
        elif (cap_ins.rex and cleaned[2:].startswith("0f00")) or cleaned.startswith("0f00"):
            # this can only be *LDT/*TR/VER* with exactly two opcode bytes 
            opcode_length += 2
        else:
            for field in cap_ins.opcode:
                if field != 0:
                    opcode_length += 1

https://github.com/danielplohmann/smda/blob/4d2f5e4f47436ff2383347d9b303ec189136b3b8/smda/intel/IntelInstructionEscaper.py#L269-L282

Failed to generate rule by DATA with Python3

Just took sample code from README.md

import codecs
from capstone import CS_ARCH_X86, CS_MODE_32
from mkyara import YaraGenerator

gen = YaraGenerator("normal", CS_ARCH_X86, CS_MODE_32)
gen.add_chunk(b"\x90\x90\x90", offset=1000)
gen.add_chunk(codecs.decode("6830800000E896FEFFFFC3", "hex"), offset=0x100)
gen.add_chunk(b"\x90\x90\x90\xFF\xD7", is_data=True)
rule = gen.generate_rule()
rule_str = rule.get_rule_string()
print(rule_str)

And got exception

File "/lib/python3.9/site-packages/mkyara/gen.py", line 149, in generate_rule
    rule_part = self.format_hex(chunk.data.encode("hex"))
AttributeError: 'bytes' object has no attribute 'encode'

IDA plugin is failing to generate the complete rule on IDA Version 7.4.191011 Windows x64 (32-bit address size)

It is not generating the IDA rule on the mentioned IDA version. When "generate Yara rule" is clicked only meta-data is shown in the dialogue box.

rule generated_rule
{
	meta:
		generated_by = "mkYARA - By Jelle Vergeer"
		date = "2020-04-06 12:17"
		version = "1.0"
	hash = "5B834EAED711D5C4BC19D7E75FCAF46

MAC ida error - arm32 sample

  File "/Users/xx/Library/Python/3.9/lib/python/site-packages/capstone/__init__.py", line 941, in __init__
    status = _cs.cs_open(arch, mode, ctypes.byref(self.csh))
ctypes.ArgumentError: argument 1: <class 'TypeError'>: wrong type