hyuunnn / hyara

Yara rule making tool (IDA Pro & Binary Ninja & Cutter & Ghidra Plugin)

Hyara

Hyara is plugin that provides convenience when writing yararule.

The plugin is currently undergoing a major revision!

• Demo video

• IDA Plugin Contest 2018

Instructions

Start Screen and Options

• When you run Hyara, it docks itself to the right and docks the output window to the left.
• After specifying the address, press the Make button to show the specified hexadecimal or strings as a result.
• The results are saved in the table below when you click Save.
• If you double-click the table, you can clear the rule.
• You can modify the values to wildcards by right clicking after dragging.

• Export Yara Rule
  • Exports the previously created yara rules.

• Right Click
  • You can select either start address or end address. (IDA Pro, Cutter)

• Comment Option
  • Annotates the instructions next to the condition rule(s).
• Rich Header and imphash
  • Adds rich header and imphash matching to the rule.
• String option
  • This option extracts strings within the range specified.

Installation

IDA Pro & BinaryNinja

• IDA Pro

  pip install -r requirements.txt

  • copy Hyara_IDA.py and hyara_lib folder to $ida_dir/plugins
  • Activate via Edit -> Plugins -> Hyara (or CTRL+SHIFT+Y)

• BinaryNinja

  • Just use the plugin manager!
  • Activate via View -> Other Docks -> Show Hyara

Cutter

• Windows

Check the python version installed in the cutter and install it.

C:\\Users\\User\\AppData\\Local\\Programs\\Python\\Python3X\\python.exe -m pip install -I -t $cutter_dir/python3X/site-packages -r requirements.txt

copy __init__.py, Hyara_Cutter.py and hyara_lib folder to $cutter_dir/plugins/python/Hyara

• Linux

cp -r /tmp/.mount_Cutter5o3a5G/usr /root

Check the python version installed in the cutter and install it.

pip3.X install -I -t /root/usr/lib/python3.X/site-packages -r /root/Hyara/requirements.txt
./Cutter-v2.0.3-x64.Linux.AppImage --pythonhome /root/usr

copy __init__.py, Hyara_Cutter.py and hyara_lib folder to /root/.local/share/rizin/cutter/plugins/python/Hyara

Activate via Windows -> Plugins -> Hyara

Ghidra (WIP)

Install Ghidrathon (Installation Guide) to use Hyara Plugin.

pip install PySide2 or pip install PySide6

• Windows

copy Hyara_Ghidra.py and hyara_lib folder to C:\\Users\\User\\.ghidra\\.ghidra.X.X.X\\Extensions\\Ghidrathon-X.X.X\\data\\python\\

# Window -> Ghidrathon
import Hyara_Ghidra
Hyara_Ghidra.run()

Features

• GUI-based
• Supports IDA, BinaryNinja, Cutter and Ghidra.
• YaraChecker
  • Tests the yararule on the fly.
  • 
• YaraDetector
  • Shows which part is detected in the sample loaded to disassembler, and when "Address" is clicked, it moves to the corresponding address on the disassembler view.
  • 
• YaraIcon
  • Creates yara rules for icon resources embedded in the PE.
  • 

Author

👤 hyuunnn

• Github: @hyuunnn

Special Thanks

• Twitter: kjkwak12
• Github: gaasedelen - Link
• Github: ITAYC0HEN - Link
• Github: psifertex - Link

Link

• Florian Roth's Twitter
• MalpediaFLOSSed - Twitter
• Automatic Generation of code-based YARA-Signatures
• Improving YARA-Signator for effective Generation of code-based YARA-Signatures

hyara's Issues

Add Supprt for python3 and IDA pro 7.5

Hyara fails to work with IDA pro 7.5 and python3. As Python 2 is no longer supported, it would be worth a update to Hyara.

Can IDA support a dark theme?

Just realized that this is my own theme question.

Refactoring & Unit Testing

Add support for radare2 and Cutter

Radare2 is a highly-portable crossplatform reverse engineering framework and a toolkit without dependencies. It has support for analyzing binaries, disassembling code, debugging programs, attaching to remote GDB/LLDB, WinDbg servers, rich plugin system (see r2pm), and integration with various decompilers. It is actively developed and can be easily integrated in various open source and commercial products. I believe, it will be highly beneficial to support these and provide a package for install from r2pm, see the package repository here: https://github.com/radareorg/radare2-pm

For documentation on writing plugins for radare2 see Scripting and Plugins Radare2 Book chapters. Radare2 already has a Yara plugins:

• r2pm install r2yara for installing Yara with r2 plugin inside
• r2pm install yara-r2 for installing Yara plugin for radare2 itself.
• pcy command of radare2 to print the data in the Yara format.

Cutter is a crossplatform Qt/C++ GUI frontend to radare2:

For documentation on writing plugins for Cutter see the official tutorial and the curated list of various popular plugins.

YaraIcon - Icon view Issue

https://github.com/jlu5/icoextract/
https://www.angusj.com/resourcehacker/

apple silicon, macos, yara-python

Be aware that for now yara-python can't automatically install from PIP on macos in some configurations (likely homebrew related) until a new release is triggered:

VirusTotal/yara-python#239

The work-around described at the end of the issue works for me. To adapt to the runtime environment of BN, copy/paste the log and add the appropriate environment variabels (assuming a homebrew python). Something like:

CFLAGS="-I/opt/homebrew/opt/openssl/include" LDFLAGS="-L/opt/homebrew/opt/openssl/lib" pip install \\
yara-python /opt/homebrew/Cellar/[email protected]/3.11.6/Frameworks/Python.framework/Versions/3.11/bin/python3.11 \\
-m pip --isolated --disable-pip-version-check install --upgrade --upgrade-strategy only-if-needed --target \\
/Users/jwiens/Library/Application Support/Binary Ninja/python311/site-packages yara-python>=4.3.0

Using python format function

https://github.com/hyuunnn/Hyara/blob/master/hyara_lib/ui/settings.py#L200
https://github.com/hyuunnn/Hyara/blob/master/hyara_lib/ui/settings.py#L267
https://github.com/hyuunnn/Hyara/blob/master/hyara_lib/ui/settings.py#L273
https://github.com/hyuunnn/Hyara/blob/master/hyara_lib/ui/settings.py#L276

Support for Ghidra

It will be developed in Java. (using Swing)

Can the detector window be made as a tab inside IDA instead of being independent?

Because when this window is present, I cannot operate my original IDA window, it will have focus on the detector window.

IDA Plugin: Module Imports are inconsistent

First: thank you for writing Hyara, it's a pretty useful tool.

Maybe I did something wrong, but the plugin didn't run after cloning from master, because of missing imports.
After looking into the source, I noticed that the imports of IDA functionality was mixed wildcard imports and pure module imports, which results in inconsistent code. I think it's probably a good idea to import module-wise and call it explicitly as a module function. In my opinion, the code becomes more readable and maintainable this way.

I started to convert it, fixed the missing imports and will open a pull request.

Running problem due to cutter, BinaryNinja api

Error in Yara Checker: 'yara.StringMatch' object is not subscriptable

Using yara-python-4.3.1 on IDA 8.3
Yara Checker raise 'yara.StringMatch' object is not subscriptable error.
This is probably because yara-python reports matches has changed between versions 4.2.3 and version 4.3.0.
In version 4.2.3 matches the yara.Match object contained an attribute strings which was a list of Tuples. In version 4.3.0 (and presumably any future version) the match object contains an attribute strings which is a list of yara.StringMatchInstance values.

Similar issue: volatilityfoundation/volatility3#932

Issues with wildcarding

Both comment and wildcard option are checked but the wildcard option is not working with the new version of Hyara.

don't overwrite old releases please

if you keep updating your old release but keeping the version number the same Binary Ninja users who use the plugin manager won't get any updates they need to update their plugin. You need to actually increment the plugin version number so that the plugin manager knows to update.

You might find this tool helpful for automating that:

https://github.com/vector35/release_helper

String Option Error

It works fine.

Bug

Update for Binary Ninja plugin manager

Can you split out the Binary Ninja plugin as a sub module so that it can be directly added to the plugin manager?

See: https://binary.ninja/2019/07/04/plugin-manager-2.0.html for more information.