Simpler rules entry
Closed this issue · 1 comments
gwillem commented
Challenges with current system:
- Lots of Yara rules syntax is boilerplate and not very dense, we almost exclusively use
any of them
and either string or regex match. - It is preferred to use
any of them
instead ofall of them
(because that allows inclusion in the grep rules) but this is not clear from the existing rules files. - Rules names are mostly arbitrary but have to be unique or Yara will complain.
I propose to create an intermediary layer that abstracts away most of the boilerplate. Rules are entered into text files frontend
and backend
. Rules are either strings (no quotes or escaping necessary) or regexes (enclosed by /
and with proper escapes). Rules are separated by newlines. Extra newlines can be added to group rules. Comments (starting with '#') can be added to indicate a rulename or explain rule logic.
A text2yara builder will convert the text files to proper Yara syntax. It will generate unique rules names based on checksum and possible comment, and group together rules.
More complex rules are still possible, they can be added to complex.yar
.