FindYara – IDA Python Plugin To Scan Binary With Yara Rules

Use this IDA python plugin to scan your binary with yara rules. All the yara rule matches will be listed with their offset so you can quickly hop to them!All credit for this plugin and the code goes to David Berard (@p0ly)This plugin is copied from David’s excellent findcrypt-yara plugin. This plugin just extends his to use any yara rule.InstallationInstall yara-pythonUsing pip: pip install yara-pythonOther methods: to your IDA “plugins" directoryWatch the tutorial video!Yara Rules With IDA Pro">UsageLaunch the pluginThe plugin can be launched from the menu using Edit->Plugins->FindYara. Or the plugin can be quickly launched using the hot-key combination ctl-alt-y. Select a Yara file to scan withWhen the plugin launches it will open a file selection dialogue box. You will need to use this to choose the yara file that you want to scan with. View matchesAll of the strings from the yara rule that match the binary will be displayed along with the match locations. AcknowledgmentsA huge thank you to David Berard (@p0ly) – Follow him on GitHub here! This is mostly his code and he gets all the credit for the original plugin framework.Also, hat tip to Alex Hanel @nullandnull – Follow him on GitHub here. Alex helped me sort through how the IDC methods are being used. His IDA Python book is a fantastic reference!!Feedback / HelpAny questions, comments, requests hit me up on twitter: @herrcorePull requests welcome!Download FindYara