Skip to content
This repository has been archived by the owner on Jan 23, 2024. It is now read-only.
/ Yara.NET Public archive

A .NET wrapper around the Yara pattern matching library

License

Notifications You must be signed in to change notification settings

jellever/Yara.NET

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

16 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Yara.NET

Yara.NET is a C++/CLI .NET wrapper around the popular Yara project. It currently is compiled against Yara lib 3.5.0. The Yara.NET API was inspired/based on the Yara Python API and thus has a somewhat similar API.

Example:

string myYaraRule = "...my rule here...";
string namespaceName = null; //optional
List<YaraCompilationError> errors; //contains yara compile warnings. If there are any errors a YaraException is thrown from CompileFromSource
YaraRules yrRules = YaraNET.Yara.Instance.CompileFromSource(myYaraRule, namespaceName, false, null, out errors);
List<YaraMatch> matches = yrRules.MatchFile("C:\mypathtoscan.ext", null, false, 0);

Additionaly, MatchProcessMemory and MatchData are available to do Yara matching. These functions use respectively yr_rules_scan_mem, yr_rules_scan_file and yr_rules_scan_proc underwater.

About

A .NET wrapper around the Yara pattern matching library

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published