{"id":19909236,"url":"https://github.com/spiderlabs/yara-ruby","last_synced_at":"2025-07-19T08:09:49.004Z","repository":{"id":1302061,"uuid":"1244273","full_name":"SpiderLabs/yara-ruby","owner":"SpiderLabs","description":"Ruby bindings for the yara file analysis and classification library","archived":false,"fork":false,"pushed_at":"2011-08-26T17:54:28.000Z","size":184,"stargazers_count":28,"open_issues_count":2,"forks_count":6,"subscribers_count":7,"default_branch":"master","last_synced_at":"2025-07-06T00:51:33.660Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"http://github.com/spiderlabs/yara-ruby","language":"Ruby","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SpiderLabs.png","metadata":{"files":{"readme":"README.rdoc","changelog":"History.txt","contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2011-01-12T04:31:34.000Z","updated_at":"2024-08-12T19:19:41.000Z","dependencies_parsed_at":"2022-08-16T13:00:45.754Z","dependency_job_id":null,"html_url":"https://github.com/SpiderLabs/yara-ruby","commit_stats":null,"previous_names":[],"tags_count":5,"template":false,"template_full_name":null,"purl":"pkg:github/SpiderLabs/yara-ruby","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SpiderLabs%2Fyara-ruby","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SpiderLabs%2Fyara-ruby/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SpiderLabs%2Fyara-ruby/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SpiderLabs%2Fyara-ruby/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SpiderLabs","download_url":"https://codeload.github.com/SpiderLabs/yara-ruby/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SpiderLabs%2Fyara-ruby/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":265904330,"owners_count":23846675,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-12T21:14:44.109Z","updated_at":"2025-07-19T08:09:48.936Z","avatar_url":"https://github.com/SpiderLabs.png","language":"Ruby","funding_links":[],"categories":[],"sub_categories":[],"readme":"= yara\nEric Monti - emonti at trustwave dot com\n\n== Introduction\n\nRuby bindings for the yara malware analysis library.\n\nYARA is a tool aimed at helping malware researchers to identify and classify \nmalware families. With YARA you can create descriptions of malware families\nbased on textual or binary information contained on samples of those families.\nThese descriptions, named rules, consist of a set of strings and a Boolean\nexpression which determines the rule logic.\n\nYara and it's code are copyrights of Victor M. Alvarez. Please see\nhttp://code.google.com/p/yara-project/\n\n\n== Usage\n\n  # basic example... find all PE files under the current dir\n\n  require 'yara'\n\n  ctx = Yara::Rules.new\n  ctx.compile_string \"rule IsPE { condition: uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 }\"\n\n  Dir[\"**/*\", \"*\"].each do |fname|\n    begin\n      next unless File.file?(fname)\n      ctx.scan_file(fname).each {|match| puts \"#{fname} -\u003e #{match.rule}\" }\n    rescue Yara::ScanError =\u003e e\n      STDERR.puts e\n    end\n  end\n\n== Versioning\nThe current version of libyara at the time of writing is 1.5.0. Bindings\nhave been written against this API and may not work with earlier versions\nof the libyara library.\n\nThe major and minor version numbers of the ruby library are intended\nto be in step with the C api version.\n\nNote that yara-ruby began existence as of yara 1.4 so binding versions\ngo back this far. The yara 1.4 binding in ruby to use is the most recent\n1.4.X gem, and so on.\n\n== Requirements\n* libyara 1.5 must be installed - http://code.google.com/p/yara-project/\n\n== Installation\n\nFirst make sure you have libyara and its dependencies installed. You'll need\nlibyara and yara.h in your search paths.\n\nInstall the yara ruby package from a gem:\n\n    (sudo)? gem install yara\n\nOr from the github package.\n\n    git clone https://github.com/SpiderLabs/yara-ruby.git\n    cd yara-ruby\n    rake compile\n\n\n== Copyright\nyara-ruby - Ruby bindings for the yara malware analysis library.\nEric Monti\nCopyright (C) 2011 Trustwave Holdings\n\nThis program is free software: you can redistribute it and/or modify it \nunder the terms of the GNU General Public License as published by the \nFree Software Foundation, either version 3 of the License, or (at your\noption) any later version.\n\nThis program is distributed in the hope that it will be useful, but \nWITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY\nor FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License\nfor more details.\n\nYou should have received a copy of the GNU General Public License along\nwith this program. If not, see \u003chttp://www.gnu.org/licenses/\u003e.\n\nSee LICENSE.txt\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fspiderlabs%2Fyara-ruby","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fspiderlabs%2Fyara-ruby","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fspiderlabs%2Fyara-ruby/lists"}