I would like to use yara to extract information from a binary. I went through the doc but did not understand how to always get a certain piece of information. For example:

import "dotnet"

rule version
        dotnet.version == “v2.0.50727”

How can I modify this rule to always return the version found, not matter which version? Or is yara the wrong tool for this kind of information extraction?

My python code corresponding to the above rule is:

import yara

rule = yara.compile(r"rule.yara")
matches = rule.match("/path/to/sample")

print matches

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.