From f80de30d3a41afcc28f61c6cb1a4afa4452f1018 Mon Sep 17 00:00:00 2001 From: "Marc R." Date: Wed, 16 Oct 2024 10:06:10 +0200 Subject: [PATCH 1/5] Added more documentation with examples for the YARA generation process --- README.md | 58 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 58 insertions(+) diff --git a/README.md b/README.md index 8bf727c..ac3a11f 100644 --- a/README.md +++ b/README.md @@ -43,6 +43,64 @@ Usage: yrg [action] [args..] load and run yara rules inside r2 [0x100003a84]> ``` +### Yara generator usage + +Commands Overview + + yrg - Initialize a YARA rule. + yrgs - Add strings as patterns. + yrgx - Add hex patterns. + yrgf - Add function byte signatures. + yrgz - Add all strings from the current function. + +To start using r2yara to create YARA rules automatically, follow these steps: + +##### Open a binary with radare2: + +``` +r2 +``` + +##### Generate a YARA rule: + +``` +yrg +``` + +This initializes a new YARA rule. + +##### Add strings from the binary as patterns: + +``` +yrgs +``` + +##### Add hex patterns: + +``` +yrgx +``` + +##### Optionally, add function signatures: + +``` +yrgf +``` + +##### Once you've added the desired patterns, save the rule: + +``` +ys +``` + +##### To scan the binary with the loaded rules: +``` +yrs +``` + + yrs - Scan the binary with loaded YARA rules. + ys - Save the generated rule. + Run it like this: ``` From e38b5b6203ca005d15503981beb2e1dd3ac809f7 Mon Sep 17 00:00:00 2001 From: "Marc R." Date: Wed, 16 Oct 2024 20:17:10 +0200 Subject: [PATCH 2/5] Update README.md Co-authored-by: pancake --- README.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index ac3a11f..5208a22 100644 --- a/README.md +++ b/README.md @@ -94,7 +94,9 @@ ys ``` ##### To scan the binary with the loaded rules: -``` + +missing newline + yrs ``` From fe447f56385f96721e33e178396379922752fce8 Mon Sep 17 00:00:00 2001 From: "Marc R." Date: Wed, 16 Oct 2024 20:17:16 +0200 Subject: [PATCH 3/5] Update README.md Co-authored-by: pancake --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 5208a22..5a9654b 100644 --- a/README.md +++ b/README.md @@ -47,7 +47,7 @@ Usage: yrg [action] [args..] load and run yara rules inside r2 Commands Overview - yrg - Initialize a YARA rule. +* **yrg** - Initialize a YARA rule. yrgs - Add strings as patterns. yrgx - Add hex patterns. yrgf - Add function byte signatures. From 76697220660d9b73ee7d47bfaefc594e7fc1bf56 Mon Sep 17 00:00:00 2001 From: "Marc R." Date: Wed, 16 Oct 2024 20:46:06 +0200 Subject: [PATCH 4/5] Update README.md --- README.md | 35 ++++++++++++++++------------------- 1 file changed, 16 insertions(+), 19 deletions(-) diff --git a/README.md b/README.md index 5a9654b..f596a8e 100644 --- a/README.md +++ b/README.md @@ -45,23 +45,23 @@ Usage: yrg [action] [args..] load and run yara rules inside r2 ### Yara generator usage -Commands Overview +**Commands Overview** -* **yrg** - Initialize a YARA rule. - yrgs - Add strings as patterns. - yrgx - Add hex patterns. - yrgf - Add function byte signatures. - yrgz - Add all strings from the current function. +**yrg** - Initialize a YARA rule. +**yrgs** - Add strings as patterns. +**yrgx** - Add hex patterns. +**yrgf** - Add function byte signatures. +**yrgz** - Add all strings from the current function. To start using r2yara to create YARA rules automatically, follow these steps: -##### Open a binary with radare2: +**Open a binary with radare2:** ``` r2 ``` -##### Generate a YARA rule: +**Generate a YARA rule:** ``` yrg @@ -69,39 +69,36 @@ yrg This initializes a new YARA rule. -##### Add strings from the binary as patterns: +**Add strings from the binary as patterns:** ``` yrgs ``` -##### Add hex patterns: +**Add hex patterns:** ``` yrgx ``` -##### Optionally, add function signatures: +**Optionally, add function signatures:** ``` yrgf ``` -##### Once you've added the desired patterns, save the rule: +**Once you've added the desired patterns, save the rule:** ``` ys ``` -##### To scan the binary with the loaded rules: - -missing newline - +**To scan the binary with the loaded rules:** +``` yrs ``` - - yrs - Scan the binary with loaded YARA rules. - ys - Save the generated rule. +**yrs** - Scan the binary with loaded YARA rules. +**ys** - Save the generated rule. Run it like this: From 260e7908fae19cec29455c419acd7eccdb9e4e76 Mon Sep 17 00:00:00 2001 From: "Marc R." Date: Thu, 17 Oct 2024 19:43:14 +0200 Subject: [PATCH 5/5] Update README.md Added new line --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index f596a8e..5923c32 100644 --- a/README.md +++ b/README.md @@ -94,6 +94,7 @@ ys ``` **To scan the binary with the loaded rules:** + ``` yrs ```