- 当前位置：首页 >热点 >如何使用yaraQA提升Yara规则的质量和性能
如何使用yaraQA提升Yara规则的质量和性能
发布时间：2025-11-05 02:38:50 来源：创站工坊 作者：系统运维
关于yaraQA
yaraQA是何使和性一款功能强大的Yara规则分析工具，在该工具的则的质量帮助下，广大研究人员可以轻松提升Yara规则的何使和性质量和性能。
很多Yara规则可能在语法上是则的质量正确的，但功能很可能仍然存在问题。何使和性而yaraQA则会试图找到这些问题并将其报告给YARA规则集的则的质量开发者或维护者。
yaraQA的何使和性功能
yaraQA会尝试检测下列问题：
1、语法正确，则的质量但由于条件中的何使和性错误，源码下载从而导致不匹配的则的质量规则；
2、使用可能错误的何使和性字符串和修饰符组合的规则（例如$ = "\\Debug\\" fullword）；
3、由短原子、则的质量重复字符或循环引起的何使和性性能问题（例如$ = "AA"; 可以使用--ignore-performance从分析中排除）；
工具安装
由于该工具基于Python 3开发，因此我们首先需要在本地设备上安装并配置好Python 3环境。则的质量接下来，何使和性广大研究人员可以使用下列命令将该项目源码克隆至本地：
复制git clone https://github.com/Neo23x0/yaraQA.git1.然后切换到项目目录中，使用pip工具和项目提供的requirements.txt文件安装该工具所需的其他依赖组件：
复制cd yaraQA/ pip install -r requirements.txt1.2.3.工具使用帮助
复制usage: yaraQA.py [-h] [-f yara files [yara files ...]] [-d yara files [yara files ...]] [-o outfile] [-b baseline] [-l level] [--ignore-performance] [--debug] YARA RULE ANALYZER optional arguments: -h, --help 显示工具帮助信息和退出 -f yara files [yara files ...] 输入文件路径（一个或多个Yara规则，由空格分隔） -d yara files [yara files ...] 输入目录路径（Yara规则目录，由空格分隔） -o outfile 分析结果输出文件（JSON格式，默认为yaraQA-issues.json） -b baseline 使用一个问题基线来过滤分析结果中的问题 -l level 要显示的亿华云计算最低级别（1=基本信息, 2=警告, 3=严重） --ignore-performance 屏蔽与性能相关的规则问题 --debug 调试模式输出1.2.3.4.5.6.7.8.9.10.11.12.13.14.15.16.17.18.19.20.21.22.23.24.25.26.27.28.29.30.31.工具使用样例
复制python3 yaraQA.py -d ./test/1.屏蔽所有性能相关的问题，仅显示逻辑问题：
复制python3 yaraQA.py -d ./test/ --ignore-performance1.屏蔽所有信息性字符问题：
复制python3 yaraQA.py -d ./test/ -level 21.使用一个基线，仅显示新的问题，基线文件需要是一个.json文件：
复制python3 yaraQA.py -d ./test/ -b yaraQA-reviewed-issues.json1.工具输出
yaraQA会将检测到的问题写入一个名为yaraQA-issues.json的文件中。
下面给出的是yaraQA生成的JSON格式结果：
复制[ { "rule": "Demo_Rule_1_Fullword_PDB", "id": "SM1", "issue": "The rule uses a PDB string with the modifier wide. PDB strings are always included as ASCII strings. The wide keyword is unneeded.", "element": { "name": "$s1", "value": "\\\\i386\\\\mimidrv.pdb", "type": "text", "modifiers": [ "ascii", "wide", "fullword" ] }, "level": "info", "type": "logic", "recommendation": "Remove the wide modifier" }, { "rule": "Demo_Rule_1_Fullword_PDB", "id": "SM2", "issue": "The rule uses a PDB string with the modifier fullword but it starts with two backslashes and thus the modifier could lead to a dysfunctional rule.", "element": { "name": "$s1", "value": "\\\\i386\\\\mimidrv.pdb", "type": "text", "modifiers": [ "ascii", "wide", "fullword" ] }, "level": "warning", "type": "logic", "recommendation": "Remove the fullword modifier" }, { "rule": "Demo_Rule_2_Short_Atom", "id": "PA2", "issue": "The rule contains a string that turns out to be a very short atom, which could cause a reduced performance of the complete rule set or increased memory usage.", "element": { "name": "$s1", "value": "{ 01 02 03 }", "type": "byte" }, "level": "warning", "type": "performance", "recommendation": "Try to avoid using such short atoms, by e.g. adding a few more bytes to the beginning or the end (e.g. add a binary 0 in front or a space after the string). Every additional byte helps." }, { "rule": "Demo_Rule_3_Fullword_FilePath_Section", "id": "SM3", "issue": "The rule uses a string with the modifier fullword but it starts and ends with two backslashes and thus the modifier could lead to a dysfunctional rule.", "element": { "name": "$s1", "value": "\\\\ZombieBoy\\\\", "type": "text", "modifiers": [ "ascii", "fullword" ] }, "level": "warning", "type": "logic", "recommendation": "Remove the fullword modifier" }, { "rule": "Demo_Rule_4_Condition_Never_Matches", "id": "CE1", "issue": "The rule uses a condition that will never match", "element": { "condition_segment": "2 of", "num_of_strings": 1 }, "level": "error", "type": "logic", "recommendation": "Fix the condition" }, { "rule": "Demo_Rule_5_Condition_Short_String_At_Pos", "id": "PA1", "issue": "This rule looks for a short string at a particular position. A short string represents a short atom and could be rewritten to an expression using uint(x) at position.", "element": { "condition_segment": "$mz at 0", "string": "$mz", "value": "MZ" }, "level": "warning", "type": "performance", "recommendation": "" }, { "rule": "Demo_Rule_5_Condition_Short_String_At_Pos", "id": "PA2", "issue": "The rule contains a string that turns out to be a very short atom, which could cause a reduced performance of the complete rule set or increased memory usage.", "element": { "name": "$mz", "value": "MZ", "type": "text", "modifiers": [ "ascii" ] }, "level": "warning", "type": "performance", "recommendation": "Try to avoid using such short atoms, by e.g. adding a few more bytes to the beginning or the end (e.g. add a binary 0 in front or a space after the string). Every additional byte helps." }, { "rule": "Demo_Rule_6_Condition_Short_Byte_At_Pos", "id": "PA1", "issue": "This rule looks for a short string at a particular position. A short string represents a short atom and could be rewritten to an expression using uint(x) at position.", "element": { "condition_segment": "$mz at 0", "string": "$mz", "value": "{ 4d 5a }" }, "level": "warning", "type": "performance", "recommendation": "" }, { "rule": "Demo_Rule_6_Condition_Short_Byte_At_Pos", "id": "PA2", "issue": "The rule contains a string that turns out to be a very short atom, which could cause a reduced performance of the complete rule set or increased memory usage.", "element": { "name": "$mz", "value": "{ 4d 5a }", "type": "byte" }, "level": "warning", "type": "performance", "recommendation": "Try to avoid using such short atoms, by e.g. adding a few more bytes to the beginning or the end (e.g. add a binary 0 in front or a space after the string). Every additional byte helps." }, { "rule": "Demo_Rule_6_Condition_Short_Byte_At_Pos", "id": "SM3", "issue": "The rule uses a string with the modifier fullword but it starts and ends with two backslashes and thus the modifier could lead to a dysfunctional rule.", "element": { "name": "$s1", "value": "\\\\Section\\\\in\\\\Path\\\\", "type": "text", "modifiers": [ "ascii", "fullword" ] }, "level": "warning", "type": "logic", "recommendation": "Remove the fullword modifier" } ]1.2.3.4.5.6.7.8.9.10.11.12.13.14.15.16.17.18.19.20.21.22.23.24.25.26.27.28.29.30.31.32.33.34.35.36.37.38.39.40.41.42.43.44.45.46.47.48.49.50.51.52.53.54.55.56.57.58.59.60.61.62.63.64.65.66.67.68.69.70.71.72.73.74.75.76.77.78.79.80.81.82.83.84.85.86.87.88.89.90.91.92.93.94.95.96.97.98.99.100.101.102.103.104.105.106.107.108.109.110.111.112.113.114.115.116.117.118.119.120.121.122.123.124.125.126.127.128.129.130.131.132.133.134.135.136.137.138.139.140.141.142.143.144.145.146.147.148.149.150.151.152.153.154.155.156.157.158.159.160.161.162.163.164.165.166.167.168.169.170.171.172.173.174.175.176.177.178.179.180.181.182.183.184.185.186.187.188.189.190.191.192.193.194.195.196.197.198.199.200.201.202.203.204.205.206.207.208.209.210.211.212.213.214.215.216.217.218.219.220.221.222.223.224.225.226.227.228.229.230.231.232.233.234.235.236.237.238.239.240.241.242.243.244.245.246.247.248.249.250.251.252.253.254.255.256.257.258.259.260.261.262.263.264.265.266.267.268.269.270.271.272.273.274.275.276.277.278.279.280.281.282.283.284.285.286.287.288.289.290.291.292.293.294.295.296.297.298.299.300.301.302.303.包含问题的规则样例
项目专门提供了包含问题的规则样例，可以在./test目录中找到。
工具运行截图
许可证协议
本项目的开发与发布遵循GPL-3.0开源许可证协议。
源码下载服务器租用益华科技企商汇IT资讯网亿华云源码库IT技术网香港云服务器亿华智造益强科技创站工坊极客编程益强IT技术网IT资讯网益强资讯优选运维纵横亿华灵动技术快报益强科技科技前瞻思维库亿华云益强智囊团云站无忧益强前沿资讯极客码头汇智坊全栈开发智能时代亿华云计算益华IT技术论坛益强智未来码上建站益强数据堂亿华互联益强编程堂多维IT资讯码力社亿华智慧云益华科技
- Copyright © 2025 Powered by 如何使用yaraQA提升Yara规则的质量和性能,创站工坊 滇ICP备2023006006号-44sitemap