0

I would like to use yara to extract information from a binary. I went through the doc but did not understand how to always get a certain piece of information. For example:

import "dotnet"

rule version
{        
    condition:
        dotnet.version == “v2.0.50727”
}

How can I modify this rule to always return the version found, not matter which version? Or is yara the wrong tool for this kind of information extraction?

My python code corresponding to the above rule is:

import yara

rule = yara.compile(r"rule.yara")
matches = rule.match("/path/to/sample")

print matches

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.