Home

Awesome

YarG for Yara

Yet another rule generator for Yara

IDAPython plugin for generating whole yara rules/ patterns from x86/x86-64 code. Operation called 'parameterization' applyes to selected code/function. This operation finds alternatives for any possible operands and create pattern based on that information.

Example rule you can found in examples folder.

Tested on IDA 7.5+

example gif

Installation

Copy plugin to your IDA_HOME/plugins folder and install dependencies.

    pip install capstone tabulate plyara

How it work ?

According to intel manual a instruction have the following structure

Instruction prefixOpcodeMod R/MSIBDisplacementImmediate value

Let's consider that parts.

Instruction prefix

Currently only the REX prefix parameterized as 4?.

Mod R/M

ModRegR/M
2bit3bit3bit

For every instruction contained Mod R/M byte the plugin creates a list of candidates on ModR/M positions uses following rules

So, 4 generation available

Besides, you can choose particular registers for parameterization

Scale/Index/Base

SIB byte parametersized the same way as Mod R/M byte but Scale fixed instead Mod

ScaleIndexBase
2bit3bit3bit

Displacement and Immediate value

If Displacement/Immediate value is an address or offset special trick are used. Because actual code placed in small range of addresses, some bytes can be fixed (last 2 or 1 byte).

References