With this library you can use YARA from your Python programs. It covers all YARA's features, from compiling, saving and loading rules to scanning files, strings and processes.
Here it goes a little example:
>>> import yara
>>> rule = yara.compile(source='rule foo: bar {strings: $a = "lmn" condition: $a}')
>>> matches = rule.match(data='abcdefgjiklmnoprstuvwxyz')
>>> print(matches)
[foo]
>>> print(matches[0].rule)
foo
>>> print(matches[0].tags)
['bar']
>>> print(matches[0].strings)
[(10L, '$a', 'lmn')]
The easiest way of installing YARA is by using pip
:
$ pip install yara-python
But you can also get the source from GitHub and compile it yourself:
$ git clone --recursive https://github.com/VirusTotal/yara-python
$ cd yara-python
$ python setup.py build
$ sudo python setup.py install
Notice the --recursive
option used with git
. This is important because
we need to download the yara
subproject containing the source code for
libyara
(the core YARA library). It's also important to note that the two
methods above link libyara
statically into yara-python. If you want to link
dynamically against a shared libyara
library use:
$ sudo python setup.py install --dynamic-linking
For this option to work you must build and install
YARA separately before installing
yara-python
.
Find more information about how to use yara-python at https://yara.readthedocs.org/en/latest/yarapython.html.