Skip to content

Instantly share code, notes, and snippets.

View fr0gger's full-sized avatar
🙃

Thomas Roccia fr0gger

🙃
850 followers · 30 following
View GitHub Profile
@fr0gger
fr0gger / floss-lite.py
Created November 18, 2022 23:48 — forked from mlaferrera/floss-lite.py
#!/usr/bin/env python3
'''
A simplified FLOSS implementation that only supports stackstrings.
requirements:
- yara-python
- unicorn
author: Willi Ballenthin
email: [email protected]
@fr0gger
fr0gger / yara_performance_guidelines.md
Created February 16, 2021 09:23 — forked from Neo23x0/yara_performance_guidelines.md
YARA Performance Guidelines

YARA Performance Guidelines

When creating your rules for YARA keep in mind the following guidelines in order to get the best performance from them. This guide is based on ideas and recommendations by Victor M. Alvarez and WXS.

  • Revision 1.4, October 2020, applies to all YARA versions higher than 3.7

Atoms

YARA extracts from the strings short substrings up to 4 bytes long that are called "atoms". Those atoms can be extracted from any place within the string, and YARA searches for those atoms while scanning the file, if it finds one of the atoms then it verifies that the string actually matches.