{"id":33171315,"url":"https://github.com/subreption/ghidra_yara","last_synced_at":"2026-01-15T00:56:41.540Z","repository":{"id":259722047,"uuid":"859483000","full_name":"subreption/ghidra_yara","owner":"subreption","description":"A direct Yara/Ghidra integration, finally YARA for Ghidra without the suck!","archived":false,"fork":false,"pushed_at":"2024-10-11T11:55:41.000Z","size":3192,"stargazers_count":4,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-11-20T19:06:53.837Z","etag":null,"topics":["ghidra","reverse-engineering","signature-detection","yara"],"latest_commit_sha":null,"homepage":"","language":"YARA","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/subreption.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-09-18T18:30:00.000Z","updated_at":"2025-11-03T00:40:43.000Z","dependencies_parsed_at":"2024-10-27T15:41:21.684Z","dependency_job_id":"29e3876a-fa8d-40cd-ae99-bd8214ce6e69","html_url":"https://github.com/subreption/ghidra_yara","commit_stats":null,"previous_names":["subreption/ghidra_yara"],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/subreption/ghidra_yara","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/subreption%2Fghidra_yara","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/subreption%2Fghidra_yara/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/subreption%2Fghidra_yara/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/subreption%2Fghidra_yara/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/subreption","download_url":"https://codeload.github.com/subreption/ghidra_yara/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/subreption%2Fghidra_yara/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28440977,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-15T00:55:22.719Z","status":"ssl_error","status_checked_at":"2026-01-15T00:55:20.945Z","response_time":107,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ghidra","reverse-engineering","signature-detection","yara"],"created_at":"2025-11-16T01:00:46.865Z","updated_at":"2026-01-15T00:56:41.532Z","avatar_url":"https://github.com/subreption.png","language":"YARA","funding_links":[],"categories":["Tools"],"sub_categories":[],"readme":"# GhidraYara\n\n\u003e **A direct Yara/Ghidra integration, finally YARA for Ghidra without the suck!**\n\n[![Build](https://github.com/subreption/ghidra_yara/actions/workflows/build.yml/badge.svg)](https://github.com/subreption/ghidra_yara/actions/workflows/build.yml)\n\n![Screenshot](images/screenshot_1.png)\n![Screenshot](images/analysis_bookmarks.png)\n\n## Introduction\n\nThis is an extension providing an Analyzer for Ghidra integrating the YARA engine (via `yara-java`\nbindings) directly in the analysis process, as well as YARA generation and management capabilities\nthroughout the Ghidra toolkit.\n\nUntil now, Ghidra users interested in leveraging YARA signature detection needed to resort to\nscripting or out-of-band solutions. With this extension, the entire process can be configured per-program\nand executed within the existent analysis workflow, automatically or manually, making the YARA\nengine a first-class citizen in the process. The same approach is applied for rule generation and testing.\n\n**This extension is still in development.** It is fully functional, but should be considered\nexperimental.\n\n## Highlights\n\n### Scanning (signature matching)\n\n![Screenshot](images/analyzer.png)\n\n - Can operate in monolithic or block-based scanning mode: the former loads the entirety of the program in contiguous memory (coalescing the initialized memory blocks), while the latter will iterate through each block independently.\n - High performance: typical sub-second completion times even with dozens of thousands of non-optimized rules loaded.\n - Can load external user-provided rules, refreshed each time the analyzer is tasked.\n - Provides excellent detection capabilities for:\n     - Algorithmic (ex. CRC) and cryptographic constants using a modernized version of the `signsrch` ruleset, among others.\n     - Packers (via rules translated from PEID and other sources).\n - Fully integrated in the analysis workflow.\n - Automatic labeling and creation (avoiding conflicts) of data types matching the exact size of the detected signature.\n     - For example, CRC lookup tables can be fully recovered, labeled and typed correctly.\n\n### Rule generation and testing\n\n![Screenshot](images/rule_management.png)\n\n - Rules can be generated from code or data selections, directly through contextual actions.\n - Management of rules can be done with real-time updates in an integrated table.\n - Rules can be exported to the file-system.\n - Individual selection for all operations, including verification.\n\n## Planned features and work in progress\n\nCurrently the following features are work-in-progress or planned for future inclusion:\n\n - Integrated save/restore functionality with the ProgramDB for generated rules.\n - Intra-program rule verification and matching.\n - Advanced rule generation using biclustering.\n     - Based off the work from Edward Raff, Richard Zak, Gary Lopez Munoz, et al. (\"Automatic Yara Rule Generation Using Biclustering\", [https://arxiv.org/abs/2009.03779](https://arxiv.org/abs/2009.03779))\n\n## Curated rule sets\n\nTL;DR: **Let the disassembler and decompiler do what they do best, and let the YARA engine do what it does best.**\n\nCurrently, we provide a limited set of rules, documented in the `data/rules` directory. Some of\nthese have been modified to eliminate false positives and otherwise irrelevant rules that, in our\nexperience, are not particularly useful in a reverse engineering context.\n\nThe importance of minimizing or crafting rules carefully cannot be overstated: typically, the use\ncase for YARA inside a tool like a Ghidra will be matching constants, such as those belonging to\ncryptographic suites, or algorithms related to error correction, lookup tables, encoding, etc.\nFunction detection, for example, is best left to other Ghidra components to deal with (such as the\nFID engine). For example, YARA rules intended to match strings related to \"antivm\" or \"antidebug\",\nas found in many public repositories, are practically useless, and usually create conflicts. This\nalso applies to rules attempting to detect compiler toolchains (as opposed to, say, packers).\n\nExamples of good targets for rules to use with Ghidra:\n\n - URLs, API tokens, and other potential *secrets*.\n - S-Boxes, initialization vectors and constants, multiplication constants.\n - Error correction tables.\n - Codec-specific tables, transformations, etc.\n - Telltale marks from known APT samples and their components, including variants of known ciphers.\n - Shellcode stages.\n - Packet and network protocol headers that could be used as part of covert channels or C2 routines.\n\n## Reporting bugs\n\nPlease file an issue, or even better, provide a **tested** and **documented** PR. :-)\n\n## Licensing\n\n```\n   Copyright (c) 2024 Subreption LLC. All rights reserved.\n\n   Licensed under the Apache License, Version 2.0 (the \"License\");\n   you may not use this file except in compliance with the License.\n   You may obtain a copy of the License at\n\n       http://www.apache.org/licenses/LICENSE-2.0\n\n   Unless required by applicable law or agreed to in writing, software\n   distributed under the License is distributed on an \"AS IS\" BASIS,\n   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n   See the License for the specific language governing permissions and\n   limitations under the License.\n```\n\nThis library and source code are distributed under the terms described in the `LICENSE` file.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsubreption%2Fghidra_yara","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsubreption%2Fghidra_yara","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsubreption%2Fghidra_yara/lists"}