yara匹配引擎进阶语法指南

rule Base64Example1
{
    strings:
        $a = "This program cannot" base64

    condition:
        $a
}

VGhpcyBwcm9ncmFtIGNhbm5vd
RoaXMgcHJvZ3JhbSBjYW5ub3
UaGlzIHByb2dyYW0gY2Fubm90

rule Base64Example2
{
    strings:
        $a = "This program cannot" base64("!@#$%^&*(){}[].,|ABCDEFGHIJ\x09LMNOPQRSTUVWXYZabcdefghijklmnopqrstu")

    condition:
        $a
}

rule XorExample1
{
    strings:
        $xor_string = "This program cannot" xor

    condition:
        $xor_string
}

rule XorExample2
{
    strings:
        $xor_string_00 = "This program cannot"
        $xor_string_01 = "Uihr!qsnfs`l!b`oonu"  // xor 0x1 
        $xor_string_02 = "Vjkq\"rpmepco\"acllmv" // xor 0x2 
        // Repeat for every single byte XOR
    condition:
        any of them
}

rule XorExample5
{
    strings:
        $xor_string = "This program cannot" xor(0x01-0x3F)
    condition:
        $xor_string
}

rule CountExample
{
    strings:
        $a = "dummy1"
        $b = "dummy2"
    condition:
        #a == 6 and #b > 10
}

#a in (filesize-500..filesize) == 2

rule AtExample
{
    strings:
        $a = "dummy1"
        $b = "dummy2"
    condition:
        $a at 100 and $b at 200
}

rule InExample
{
    strings:
        $a = "dummy1"
        $b = "dummy2"
    condition:
        $a in (0..100) and $b in (100..filesize)
}

rule AtExample
{
    strings:
        $a = "dummy1"
        $b = "dummy2"
    condition:
        @a[3] == 100 
}

rule MatchLength{
	strings:
    $a = /fo*/
	condition:
  	!a[1] == 4 // 匹配 fooo
}

int8(<offset or virtual address>)
int16(<offset or virtual address>)
int32(<offset or virtual address>)
uint8(<offset or virtual address>)
uint16(<offset or virtual address>)
uint32(<offset or virtual address>)
int8be(<offset or virtual address>)
int16be(<offset or virtual address>)
int32be(<offset or virtual address>)
uint8be(<offset or virtual address>)
uint16be(<offset or virtual address>)
uint32be(<offset or virtual address>)

rule IsPE
{
    condition:
        // MZ signature at offset 0 and ...
        uint16(0) == 0x5A4D and
        // ... PE signature at offset stored in MZ header at 0x3C
        uint32(uint32(0x3C)) == 0x00004550
}

2 of ($a,$b,$c)
all of them       // all strings in the rule
any of them       // any string in the rule
all of ($a*)      // all strings whose identifier starts by $a
any of ($a,$b,$c) // any of $a, $b or $c
1 of ($*)         // same that "any of them"
none of ($b*)     // zero of the set of strings that start with "$b"


all of ($a*) in (filesize-500..filesize)
any of ($a*, $b*) in (1000..2000)

for expression of string_set : ( boolean_expression )

在集合string_set中，expression必须满足( boolean_expression )

例如：
for any of ($a,$b,$c) : ( $ at pe.entry_point )
布尔表达式中的 $ 符号不与任何特定字符串相关联，它将是 $a，然后是 $b，最后是 $c

any of ($a,$b,$c)
等价于
for any of ($a,$b,$c) : ( $ )

for all of them : ( # > 3 )
for all of ($a*) : ( @ > @b )

rule Occurrences
{
    strings:
        $a = "dummy1"
        $b = "dummy2"
    condition:
        for all i in (1,2,3) : ( @a[i] + 10 == @b[i] )
}

for all i in (1..3) : ( @a[i] + 10 == @b[i]

for all i in (1..#a) : ( @a[i] < 100 )   //#a 代表 $a 出现的次数

for 2 i in (1..#a) : ( @a[i] < 100 )

for any section in pe.sections : ( section.name == ".text"）

// 等价于
for any i in (0..pe.number_of_sections-1) : ( pe.sections[i].name == ".text" )

for any k,v in some_dict : ( k == "foo" and v == "bar" )

rule ExternalVariableExample1
{
    condition:
        ext_var == 10
}

rule ExternalVariableExample2
{
    condition:
        bool_ext_var or filesize < int_ext_var
}

rule ContainsExample
{
    condition:
        string_ext_var contains "text"
}
rule CaseInsensitiveContainsExample
{
    condition:
        string_ext_var icontains "text"
}
rule StartsWithExample
{
    condition:
        string_ext_var startswith "prefix"
}
rule EndsWithExample
{
    condition:
        string_ext_var endswith "suffix"
}
rule MatchesExample
{
    condition:
        string_ext_var matches /[a-z]+/is
}

math.to_number(SubRule1) * 60 + math.to_number(SubRule2) * 20 + math.to_number(SubRule3) * 70 > 80

for any section in pe.sections : ( 
section.name == ".text" 
and  math.in_range(math.entropy(section.raw_data_offset,section.raw_data_size),7.4,7.6))

pe.imports("kernel32.dll","VirtualAlloc") 
and 
pe.imports("kernel32.dll","CreateRemoteThread") 
and 
pe.imports("kernel32.dll","WriteProcessMemory") 
and 
pe.imports("kernel32.dll")  == 3

import "hash"
import "pe"

rule iconForge{

   condition:
    	for any res in pe.resources: (
          res.type == pe.RESOURCE_TYPE_ICON
            hash.md5( res.offset,res.length) == "xxxxx"
            ) 
        and 
            pe.number_of_signatures == 0
}

pe.pdb_path icontains "shellcode" or pe.pdb icontains "qianxin"