0

I would like to use yara to extract information from a binary. I went through the doc but did not understand how to always get a certain piece of information. For example:

import "dotnet"

rule version
{        
    condition:
        dotnet.version == “v2.0.50727”
}

How can I modify this rule to always return the version found, not matter which version? Or is yara the wrong tool for this kind of information extraction?

My python code corresponding to the above rule is:

import yara

rule = yara.compile(r"rule.yara")
matches = rule.match("/path/to/sample")

print matches

This site is temporarily in read only mode and not accepting new answers.

Browse other questions tagged .