hello, seccamp2017で作ったyaraのソースコードです。
アルゴリズムを変えたので、test3.cというのはクイックサーチアルゴリズムのプログラムです。 なんか色々ごちゃごちゃありますが、そのうち整理します笑 解説に関しては以下の通りです! 基本的なyaraの使い方も下にかいてあります!
test
when I have attended security-camp 2017, I have made to use Quick-Search yara program.
it was adopt Qucik-Search algorithm.
Computational Complexity
To be keyword length:n, string length:s
Native way :best O(n), bad(nk)
Automaton way : best and bad O(n)
Quick Search way: best O(n/k), bad O(nk)
test3.c is quick-search algorithm.
this github is very disoder....lol
I will be arrenement butifully ...someday
so if you have occurred the question, please give me the e-mail
mail: [email protected]
thank you for all
YARA is a tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families (or whatever you want to describe) based on textual or binary patterns. Each description, a.k.a rule, consists of a set of strings and a boolean expression which determine its logic. Let's see an example:
rule silent_banker : banker
{
meta:
description = "This is just an example"
threat_level = 3
in_the_wild = true
strings:
$a = {6A 40 68 00 30 00 00 6A 14 8D 91}
$b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9}
$c = "UVODFRYSIHLNWPEJXQZAKCBGMT"
condition:
$a or $b or $c
}
The above rule is telling YARA that any file containing one of the three strings must be reported as silent_banker. This is just a simple example, more complex and powerful rules can be created by using wild-cards, case-insensitive strings, regular expressions, special operators and many other features that you'll find explained in YARA's documentation.
YARA is multi-platform, running on Windows, Linux and Mac OS X, and can be used through its command-line interface or from your own Python scripts with the yara-python extension.
If you plan to use YARA to scan compressed files (.zip, .tar, etc) you should take a look at yextend, a very helpful extension to YARA developed and open-sourced by Bayshore Networks.
- ActiveCanopy
- Adlice
- BAE Systems
- Bayshore Networks, Inc.
- Blue Coat
- Blueliv
- CrowdStrike FMS
- Cuckoo Sandbox
- ESET
- Fidelis XPS
- FireEye, Inc.
- Fox-IT
- FSF
- Guidance Software
- Heroku
- JASK
- jsunpack-n
- Kaspersky Lab
- Koodous
- Laika BOSS
- Lastline, Inc.
- McAfee Advanced Threat Defense
- Metaflows
- NBS System
- osquery
- Payload Security
- PhishMe
- Picus Security
- Radare2
- Raytheon Cyber Products, Inc.
- ReversingLabs
- root9B
- RSA ECAT
- SpamStopsHere
- stoQ
- Symantec
- Tanium
- Tenable Network Security
- The DigiTrust Group
- ThreatConnect
- ThreatStream, Inc.
- Thug
- Trend Micro
- VirusTotal Intelligence
- VMRay
- We Watch Your Website
- Websense
- x64dbg
- YALIH
- Scanii
Are you using it? Want to see your site listed here?sl