YaraXSharp 1.0.0
There is a newer version of this package available.
See the version list below for details.
See the version list below for details.
dotnet add package YaraXSharp --version 1.0.0
NuGet\Install-Package YaraXSharp -Version 1.0.0
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package.
<PackageReference Include="YaraXSharp" Version="1.0.0" />
For projects that support PackageReference, copy this XML node into the project file to reference the package.
<PackageVersion Include="YaraXSharp" Version="1.0.0" />
<PackageReference Include="YaraXSharp" />
For projects that support Central Package Management (CPM), copy this XML node into the solution Directory.Packages.props file to version the package.
paket add YaraXSharp --version 1.0.0
The NuGet Team does not provide support for this client. Please contact its maintainers for support.
#r "nuget: YaraXSharp, 1.0.0"
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package.
#:package YaraXSharp@1.0.0
#:package directive can be used in C# file-based apps starting in .NET 10 preview 4. Copy this into a .cs file before any lines of code to reference the package.
#addin nuget:?package=YaraXSharp&version=1.0.0
#tool nuget:?package=YaraXSharp&version=1.0.0
The NuGet Team does not provide support for this client. Please contact its maintainers for support.
Yara-X Sharp
A simple wrapper for Yara-X around the Yara-X C/C++ API.
You can find the Nuget package here.
Requirements
For versions 0.0.3 and below, bring your own yara_x_capi.dll which you can find here.
Usage
/*
* New Compiler instance.
* You can pass multiple params from YRX_COMPILE_FLAGS.
* E.g. new Compiler(YRX_COMPILE_FLAGS.YRX_ERROR_ON_SLOW_PATTERN)
*/
var yara = new Compiler();
yara.AddRuleFile("./eicar.yar");
var (rules, errors, warnings) = yara.Build(); // Compiled rules to be used in Scanner.
Scanner scanner = new Scanner(rules, YRX_SCANNER_FLAGS.LOAD_METADATA, YRX_SCANNER_FLAGS.LOAD_PATTERNS);
scanner.scan("./eicar.txt");
List<Match> results = scanner.Results();
foreach (Match rule in results) {
Console.WriteLine($"Pattern match count: {rule.Patterns.Count}");
Console.WriteLine(rule.Metadata["malware_family"]);
}
// Make sure to destroy.
scanner.Destroy();
yara.Destroy();
Or
using (var yara = new Compiler())
{
yara.AddRuleFile(Path.Combine(Environment.CurrentDirectory, "../../../", "eicar.yar"));
yara.AddRuleFile(Path.Combine(Environment.CurrentDirectory, "../../../", "eitwo.yar"));
var (rules, errors, warnings) = yara.Build();
Console.WriteLine($"Number of rules: {rules.Count()}");
using (Scanner scanner = new Scanner(rules, YRX_SCANNER_FLAGS.LOAD_METADATA, YRX_SCANNER_FLAGS.LOAD_PATTERNS))
{
scanner.Scan(Path.Combine(Environment.CurrentDirectory, "eicar.txt"));
List<Match> results = scanner.Results();
Console.WriteLine($"Matches: {results.Count}");
foreach (Match rule in results)
{
Console.WriteLine($"Pattern match count: {rule.Patterns.Count}");
Console.WriteLine(rule.Metadata["malware_family"]);
}
}
}
Reference
To-Dos
Compiler flagsCompiler error and warningsUnpredictable behaviorScanner timeoutIterate matched rule patterns and tagsFile streaming for scanning large filesBYO
Compatibility
| Yara-X Release Version | Wrapper Version |
|---|---|
| 1.4.0 | 0.0.1, 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.1.0, 1.0.0 |
| Product | Versions Compatible and additional computed target framework versions. |
|---|---|
| .NET | net8.0 is compatible. net8.0-android was computed. net8.0-browser was computed. net8.0-ios was computed. net8.0-maccatalyst was computed. net8.0-macos was computed. net8.0-tvos was computed. net8.0-windows was computed. net9.0 was computed. net9.0-android was computed. net9.0-browser was computed. net9.0-ios was computed. net9.0-maccatalyst was computed. net9.0-macos was computed. net9.0-tvos was computed. net9.0-windows was computed. net10.0 was computed. net10.0-android was computed. net10.0-browser was computed. net10.0-ios was computed. net10.0-maccatalyst was computed. net10.0-macos was computed. net10.0-tvos was computed. net10.0-windows was computed. |
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.
-
net8.0
- Newtonsoft.Json (>= 13.0.3)
NuGet packages
This package is not used by any NuGet packages.
GitHub repositories
This package is not used by any popular GitHub repositories.