Yara Workbench Automation


Author: David Zimmer
Date: 12.29.23 - 1:23pm



in previous posts we have talked about how to get yara workbench to spit out some analysis results using the pe.dbg feature (now the console.log class in public release yara).
rule sect_entropy
{
	condition:
        pe.dbg("sect_entropy") and 
        for all i in (0 .. pe.number_of_sections -1):(
            pe.dbg( 
                pe.sections[i].name,
                math.entropy(
                    pe.sections[i].raw_data_offset, 
                    pe.sections[i].raw_data_size
                )
            )
        )

		
}
When I updated the yara engine to 4.3.1 I also added in a javascript automation feature. There are a couple sample automation scripts to get you started (along with a object browser and basic intellisense). Below is a quick script I used the other day to extract the seed values used in a sample set of api hashers.

if(!main.curResults) throw( new Error("No Results yet") )

hashs = {}

for(i=1; i <= main.curResults.count() ; i++){
    yf = main.curResults(i) //YaraFile class
    tmp = []
    tb.fopen(yf.file)
    tmp.push(fso.filenamefrompath(yf.file))
    
    for(j=1; j <= yf.TotalMatches();j++){
        ym = yf.matches(j ) //YaraMatch
        mr = ym.results(1) //known only one result no need to loop
        off = mr.offset //MatchResult
        seed = "0x" + tb.h(tb.uint32(off+15))
        cnt = hashs[seed]
        hashs[seed] = cnt == undefined ? 1 : cnt + 1
        tmp.push(tb.h(off))
        tmp.push(seed)
        tb.t(tmp.join(","))
    }
    
    tb.fclose()

}

//tb.t("
Seed hit counts: ")
//for(var propt in hashs){tb.t(propt + ': ' + hashs[propt]);}


Another one: (note my blog is eats some slash chars you will have to tweak)

rule = "rule test{
    strings: $keys = {8B C683 E0 030F B6 CA0F B6 80}
    condition:$keys
}"

//file = "D:\_ftp_root_3lob4_03A41000.mem"
file = dlg.opendialog("D:\_ftp_root_3")

main.doScan(file,rule)

if(!main.curResults) throw( new Error("No Results yet") )

tmp = []
try{
    for(i=1; i <= main.curResults.count() ; i++){
        yf = main.curResults(i) //YaraFile class
        tb.fopen(yf.file)
        for(j=1; j <= yf.TotalMatches();j++){
            ym = yf.matches(j) //YaraMatch
            for(k=1;k<=ym.results.count();k++){
                mr = ym.results(k)  
                off = mr.offset //MatchResult
                key = "0x" + tb.h(tb.uint32(off+11))
                //tmp.push(tb.h(off))
                tmp.push(key)
            }
        }
        tb.fclose()
    }
}catch(e){}

tb.t(tmp.join(","))


Still need to test some of the stuff but handy addition anyway...




Comments: (0)

 
Leave Comment:
Name:
Email: (not shown)
Message: (Required)
Math Question: 10 + 17 = ? followed by the letter: W 



About Me
More Blogs
Main Site
Posts: (All)
2023 (4)
     Yara Workbench Automation
     VS linker versions
     IDA decompiler comments
     DispCallFunc
2022 (5)
     VB6 Implements
     VB6 Stubs BS
     VB6 TypeInfo
     VB6 VTable Layout
     Yara isPCode rule
2021 (2)
     rtcTypeName
     VB6 Gosub
2020 (5)
     AutoIT versions
     IDA JScript 2
     Using VB6 Obj files from C
     Yara Corrupt Imports
     Yara Undefined values
2019 ( 6 )
2017 ( 5 )
2016 ( 4 )
2015 ( 5 )
2014 ( 5 )
2013 ( 9 )
2012 ( 13 )
2011 ( 19 )
2010 ( 11 )
2009 ( 1 )