All credit for this plugin and the code goes to David Berard (@p0ly)
This plugin is copied from David’s excellent findcrypt-yara plugin. This plugin just extends his to use any yara rule.
- Install yara-python
- Using pip:
pip install yara-python
- Other methods: https://pypi.python.org/pypi/yara-python
- Using pip:
- Copy FindYara.py to your IDA “plugins” directory
Watch the tutorial video!
Yara Rules With IDA Pro”>
Launch the plugin
The plugin can be launched from the menu using
Edit->Plugins->FindYara. Or the plugin can be quickly launched using the hot-key combination
Select a Yara file to scan with
When the plugin launches it will open a file selection dialogue box. You will need to use this to choose the yara file that you want to scan with.
All of the strings from the yara rule that match the binary will be displayed along with the match locations.
- A huge thank you to David Berard (@p0ly) – Follow him on GitHub here! This is mostly his code and he gets all the credit for the original plugin framework.
- Also, hat tip to Alex Hanel @nullandnull – Follow him on GitHub here. Alex helped me sort through how the IDC methods are being used. His IDA Python book is a fantastic reference!!
Feedback / Help
- Any questions, comments, requests hit me up on twitter: @herrcore
- Pull requests welcome!