or run

npx @tessl/cli init
Log in

Version

Tile

Overview

Evals

Files

docs

compilation.mdconfig.mdindex.mdmatching.md
tile.json

tessl/pypi-yara-python

Python interface for YARA, a powerful malware identification and classification tool

Workspace
tessl
Visibility
Public
Created
Last updated
Describes
pypipkg:pypi/yara-python@3.11.x

To install, run

npx @tessl/cli install tessl/pypi-yara-python@3.11.0

index.mddocs/

YARA Python Interface

YARA-Python provides Python bindings for YARA (Yet Another Recursive Acronym), a powerful malware identification and classification tool. It enables Python developers to compile YARA rules, scan files, memory, and processes for pattern matches, and handle malware detection workflows within Python applications.

Package Information

  • Package Name: yara-python
  • Package Type: pypi
  • Language: Python (C extension)
  • Installation: pip install yara-python
  • License: Apache 2.0
  • Platform Support: Windows, macOS, Linux, FreeBSD, OpenBSD

Core Imports

import yara

Basic Usage

import yara

# Compile YARA rules from source
rules = yara.compile(source='''
rule TestRule {
    strings:
        $text = "malicious"
    condition:
        $text
}
''')

# Scan data for matches
matches = rules.match(data="This contains malicious content")

# Process results
for match in matches:
    print(f"Rule {match.rule} matched!")
    for offset, identifier, data in match.strings:
        print(f"  Found '{data}' at offset {offset}")

# Save compiled rules for reuse
rules.save(filepath="compiled_rules.yarc")

# Load previously compiled rules
loaded_rules = yara.load(filepath="compiled_rules.yarc")

Architecture

YARA-Python follows a three-layer architecture:

  • Compilation Layer: Compiles textual YARA rules into optimized Rules objects
  • Scanning Layer: Applies compiled rules to various data sources (files, memory, processes)
  • Results Layer: Provides structured access to match results with rule metadata

The package supports both static and dynamic linking against the YARA library, with optional modules for enhanced functionality including magic file type detection, PE/Mach-O/DEX executable parsing, and Cuckoo sandbox integration.

Capabilities

Rule Compilation and Loading

Compile YARA rules from various sources (strings, files, file-like objects) with support for external variables, include callbacks, and namespace organization. Save and load compiled rules for performance optimization.

def compile(source=None, filepath=None, file=None, filepaths=None, sources=None, 
           includes=True, externals=None, error_on_warning=False, include_callback=None): ...
def load(filepath=None, file=None): ...

Rule Compilation and Loading

Pattern Matching and Scanning

Scan files, memory buffers, and running processes with compiled YARA rules. Support for callbacks, timeouts, external variables, and module-specific data processing.

class Rules:
    def match(self, filepath=None, pid=None, data=None, externals=None, callback=None,
              fast=False, timeout=60, modules_data=None, modules_callback=None, 
              which_callbacks=None): ...

Pattern Matching and Scanning

Configuration and Error Handling

Configure YARA engine parameters and handle various error conditions including syntax errors, timeouts, and warnings with structured exception hierarchy.

def set_config(stack_size=None, max_strings_per_rule=None): ...

class Error(Exception): ...
class SyntaxError(Error): ...
class TimeoutError(Error): ...
class WarningError(Error): ...

Configuration and Error Handling

Version Information

__version__: str        # YARA library version string
YARA_VERSION: str      # YARA library version string  
YARA_VERSION_HEX: int  # YARA library version as hexadecimal

Types

class Rules:
    """Compiled YARA rules container supporting iteration."""
    def match(self, filepath=None, pid=None, data=None, externals=None, callback=None,
              fast=False, timeout=60, modules_data=None, modules_callback=None, 
              which_callbacks=None): ...
    def save(self, filepath=None, file=None): ...
    def profiling_info(self): ...
    def __iter__(self): ...  # Iterate over Rule objects

class Rule:
    """Individual YARA rule representation."""
    identifier: str  # Rule name/identifier
    tags: list      # List of rule tags
    meta: dict      # Rule metadata dictionary

class Match:
    """Represents a rule match result."""
    rule: str        # Name of the matching rule
    namespace: str   # Namespace of the matching rule
    tags: list       # Tags associated with the rule
    meta: dict       # Metadata dictionary from the rule
    strings: list    # List of (offset, identifier, data) tuples

Constants

# Callback control constants
CALLBACK_CONTINUE: int = 0     # Continue processing in callbacks
CALLBACK_ABORT: int = 1        # Abort processing in callbacks
CALLBACK_MATCHES: int = 0x01   # Callback for matching rules only
CALLBACK_NON_MATCHES: int = 0x02  # Callback for non-matching rules only
CALLBACK_ALL: int = 0x03       # Callback for all rules