Author: David Zimmer
Date: 12.17.19 - 2:56am
Releasing a new tool today to help you develop and test Yara Signatures.
Yara Workbench is a full IDE with syntax highlighting, code completion, bench marking, match offsets, and in depth match details.
Since the initial video I had added in a couple more bonuses such as:
I also added two new functions to the pe module. pe.dbg(string) and pe.dbg(int). These can be used as a simple way to get some insight into how yara is running.
This can come in handy for example in the following scenario:
This could also be useful if a uint32() read was not returning what you expected, and wanted an easy way to see some debug output.
The dbg function will always return 1 so it can be used in the condition section without error.
Another useful example would be using it to get yara to dump pe section entropy:
I hacked it into an existing module since the built in functions like uint32() get compiled into rules as binary opcodes and it just wasnt worth the fuss to add a native dbg() function at this point. Adding new functions to modules was quite easy below are the basic mods I used: