{"id":13705981,"url":"https://github.com/plyara/plyara","last_synced_at":"2026-01-11T23:52:37.489Z","repository":{"id":45330392,"uuid":"136099441","full_name":"plyara/plyara","owner":"plyara","description":"Parse YARA rules and operate over them more easily.","archived":false,"fork":false,"pushed_at":"2024-06-24T18:34:27.000Z","size":493,"stargazers_count":173,"open_issues_count":23,"forks_count":37,"subscribers_count":11,"default_branch":"master","last_synced_at":"2024-10-02T23:13:16.764Z","etag":null,"topics":["lexer","parser","ply","python","python3","sly","yara","yara-parser","yara-rules"],"latest_commit_sha":null,"homepage":"https://plyara.readthedocs.io/","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/plyara.png","metadata":{"files":{"readme":"README.rst","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-06-05T00:53:20.000Z","updated_at":"2024-09-21T12:38:21.000Z","dependencies_parsed_at":"2022-08-29T06:51:22.051Z","dependency_job_id":"3c72f2bf-30a3-4127-8f04-117a96656141","html_url":"https://github.com/plyara/plyara","commit_stats":null,"previous_names":[],"tags_count":22,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plyara%2Fplyara","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plyara%2Fplyara/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plyara%2Fplyara/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plyara%2Fplyara/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/plyara","download_url":"https://codeload.github.com/plyara/plyara/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":224455969,"owners_count":17314220,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["lexer","parser","ply","python","python3","sly","yara","yara-parser","yara-rules"],"created_at":"2024-08-02T22:00:50.805Z","updated_at":"2026-01-11T23:52:37.461Z","avatar_url":"https://github.com/plyara.png","language":"Python","funding_links":[],"categories":["Tools"],"sub_categories":[],"readme":"plyara\n======\n\n.. image:: https://travis-ci.com/plyara/plyara.svg?branch=master\n   :target: https://travis-ci.com/plyara/plyara\n   :alt: Build Status\n.. image:: https://readthedocs.org/projects/plyara/badge/?version=latest\n   :target: http://plyara.readthedocs.io/en/latest/?badge=latest\n   :alt: Documentation Status\n.. image:: https://api.codacy.com/project/badge/Grade/7bd0be1749804f0a8dd3d57f69888f68\n   :target: https://www.codacy.com/app/plyara/plyara\n   :alt: Code Health\n.. image:: https://api.codacy.com/project/badge/Coverage/1c234b3d1ff349fa9dea7b4048dbc115\n   :target: https://app.codacy.com/app/plyara/plyara\n   :alt: Test Coverage\n.. image:: http://img.shields.io/pypi/v/plyara.svg\n   :target: https://pypi.python.org/pypi/plyara\n   :alt: PyPi Version\n\nParse YARA_ rules into a dictionary representation.\n\nPlyara is a script and library that lexes and parses a file consisting of one more YARA rules\ninto a python dictionary representation. The goal of this tool is to make it easier to perform\nbulk operations or transformations of large sets of YARA rules, such as extracting indicators,\nupdating attributes, and analyzing a corpus. Other applications include linters and dependency\ncheckers.\n\nPlyara leverages the Python module PLY_ for lexing YARA rules.\n\nThis is a community-maintained fork of the `original plyara`_ by 8u1a_. The \"plyara\" trademark\nis used with permission.\n\nInstallation\n------------\n\nPlyara requires Python 3.6+.\n\nInstall with pip::\n\n    pip3 install plyara\n\nUsage\n-----\n\nUse the plyara Python library in your own applications:\n\n.. code-block:: python\n\n    \u003e\u003e\u003e import plyara\n    \u003e\u003e\u003e parser = plyara.Plyara()\n    \u003e\u003e\u003e mylist = parser.parse_string('rule MyRule { strings: $a=\"1\" \\n condition: false }')\n    \u003e\u003e\u003e\n    \u003e\u003e\u003e import pprint\n    \u003e\u003e\u003e pprint.pprint(mylist)\n    [{'condition_terms': ['false'],\n      'raw_condition': 'condition: false ',\n      'raw_strings': 'strings: $a=\"1\" \\n ',\n      'rule_name': 'MyRule',\n      'start_line': 1,\n      'stop_line': 2,\n      'strings': [{'name': '$a', 'type': 'text', 'value': '1'}]}]\n    \u003e\u003e\u003e\n\nOr, use the included ``plyara`` script from the command line::\n\n    $ plyara -h\n    usage: plyara [-h] [--log] FILE\n\n    Parse YARA rules into a dictionary representation.\n\n    positional arguments:\n      FILE        File containing YARA rules to parse.\n\n    optional arguments:\n      -h, --help  show this help message and exit\n      --log       Enable debug logging to the console.\n\nThe command-line tool will print valid JSON output when parsing rules::\n\n    $ cat example.yar\n    rule silent_banker : banker\n    {\n        meta:\n            description = \"This is just an example\"\n            thread_level = 3\n            in_the_wild = true\n        strings:\n            $a = {6A 40 68 00 30 00 00 6A 14 8D 91}\n            $b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9}\n            $c = \"UVODFRYSIHLNWPEJXQZAKCBGMT\"\n        condition:\n            $a or $b or $c\n    }\n\n    $ plyara example.yar\n    [\n        {\n            \"condition_terms\": [\n                \"$a\",\n                \"or\",\n                \"$b\",\n                \"or\",\n                \"$c\"\n            ],\n            \"metadata\": [\n                {\n                    \"description\": \"This is just an example\"\n                },\n                {\n                    \"thread_level\": 3\n                },\n                {\n                    \"in_the_wild\": true\n                }\n            ],\n            \"raw_condition\": \"condition:\\n        $a or $b or $c\\n\",\n            \"raw_meta\": \"meta:\\n        description = \\\"This is just an example\\\"\\n        thread_level = 3\\n        in_the_wild = true\\n    \",\n            \"raw_strings\": \"strings:\\n        $a = {6A 40 68 00 30 00 00 6A 14 8D 91}\\n        $b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9}\\n        $c = \\\"UVODFRYSIHLNWPEJXQZAKCBGMT\\\"\\n    \",\n            \"rule_name\": \"silent_banker\",\n            \"start_line\": 1,\n            \"stop_line\": 13,\n            \"strings\": [\n                {\n                    \"name\": \"$a\",\n                    \"type\": \"byte\",\n                    \"value\": \"{6A 40 68 00 30 00 00 6A 14 8D 91}\"\n                },\n                {\n                    \"name\": \"$b\",\n                    \"type\": \"byte\",\n                    \"value\": \"{8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9}\"\n                },\n                {\n                    \"name\": \"$c\",\n                    \"type\": \"text\",\n                    \"value\": \"UVODFRYSIHLNWPEJXQZAKCBGMT\"\n                }\n            ],\n            \"tags\": [\n                \"banker\"\n            ]\n        }\n    ]\n\nReusing The Parser\n------------------\n\nIf you want to reuse a single instance of the parser object for efficiency when\nparsing large quantities of rule or rulesets, the new clear() method must be\nused.\n\n.. code-block:: python\n\n    rules = list()\n    parser = plyara.Plyara()\n\n    for file in files:\n        with open(file, 'r') as fh:\n            yararules = parser.parse_string(fh.read())\n            rules += yararules\n        parser.clear()\n\nMigration\n---------\n\nIf you used an older version of plyara, and want to migrate to this version,\nthere will be some changes required. Most importantly, the parser object\ninstantiation has changed. It was:\n\n.. code-block:: python\n\n    # Old style - don't do this!\n    import plyara.interp as interp\n    rules_list = interp.parseString(open('myfile.yar').read())\n\nBut is now:\n\n.. code-block:: python\n\n    # New style - do this instead!\n    import plyara\n    parser = plyara.Plyara()\n    rules_list = parser.parse_string(open('myfile.yar').read())\n\nThe existing parsed keys have stayed the same, and new ones have been added.\n\nWhen reusing a ``parser`` for multiple rules and/or files, be aware that\nimports are now shared across all rules - if one rule has an import, that\nimport will be added to all rules in your parser object.\n\nContributing\n------------\n\n* If you find a bug, or would like to see a new feature, Pull Requests and\n  Issues_ are always welcome.\n* By submitting changes, you agree to release those changes under the terms\n  of the LICENSE_.\n* Writing passing unit tests for your changes, while not required, is highly\n  encouraged and appreciated.\n* Please run all code contributions through each of the linters that we use\n  for this project: pycodestyle, pydocstyle, and pyflakes.  See the\n  .travis.yml file for exact use.  For more information on these linters,\n  please refer to the Python Code Quality Authority:\n  http://meta.pycqa.org/en/latest/\n\nDiscussion\n------------\n\n* You may join our IRC channel on irc.freenode.net #plyara\n\n.. _PLY: http://www.dabeaz.com/ply/\n.. _YARA: http://plusvic.github.io/yara/\n.. _plyara.readthedocs.io: https://plyara.readthedocs.io/en/latest/\n.. _original plyara: https://github.com/8u1a/plyara\n.. _8u1a: https://github.com/8u1a\n.. _Issues: https://github.com/plyara/plyara/issues\n.. _LICENSE: https://github.com/plyara/plyara/blob/master/LICENSE\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fplyara%2Fplyara","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fplyara%2Fplyara","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fplyara%2Fplyara/lists"}