Index

Symbols

-a <seconds> --timeout=<seconds> yara command line option -D --print-module-data yara command line option -d <identifier>=<value> yara command line option -e --print-namespace yara command line option -f --fast-scan yara command line option -g --print-tags yara command line option -h --help yara command line option -i <identifier> --identifier=<identifier> yara command line option -k <slots> --stack-size=<slots> yara command line option -l <number> --max-rules=<number> yara command line option

-m --print-meta yara command line option -n yara command line option -p <number> --threads=<number> yara command line option -r --recursive yara command line option -s --print-strings yara command line option -t <tag> --tag=<tag> yara command line option -v --version yara command line option -w --no-warnings yara command line option -x <module>=<file> yara command line option

A

AGGRESIVE_WS_TRIM (C type)

B

base (C type) BYTES_REVERSED_HI (C type)

BYTES_REVERSED_LO (C type)

C

characteristics (C type)

checksum32 (C function), [1]

D

DEBUG_STRIPPED (C type) deviation (C function), [1]

DLL (C type) dns_lookup (C function)

E

EM_386 (C type) EM_68K (C type) EM_860 (C type) EM_88K (C type) EM_AARCH64 (C type) EM_ARM (C type) EM_M32 (C type) EM_MIPS (C type) EM_MIPS_RS3_LE (C type) EM_PPC (C type) EM_PPC64 (C type) EM_SPARC (C type) EM_X86_64 (C type) entropy (C function), [1] entry_point (C type), [1] ERROR_CALLBACK_ERROR (C macro) ERROR_CORRUPT_FILE (C macro)

ERROR_COULD_NOT_MAP_FILE (C macro) ERROR_COULD_NOT_OPEN_FILE (C macro) ERROR_INSUFICENT_MEMORY (C macro) ERROR_INVALID_FILE (C macro) ERROR_SCAN_TIMEOUT (C macro) ERROR_SUCCESS (C macro) ERROR_TOO_MANY_MATCHES (C macro) ERROR_TOO_MANY_SCAN_THREADS (C macro) ERROR_UNSUPPORTED_FILE_VERSION (C macro) ERROR_ZERO_LENGTH_FILE (C macro) ET_CORE (C type) ET_DYN (C type) ET_EXEC (C type) ET_NONE (C type) ET_REL (C type) EXECUTABLE_IMAGE (C type) exports (C function)

F

fetch_data (C type) file_access (C function)

filesystem (C type) flags (C member)

G

get_integer (C function) get_object (C function)

get_string (C function)

H

http_get (C function) http_post (C function)

http_request (C function)

I

image_base (C type) image_version (C type) image_version.major (C member) image_version.minor (C member) imphash (C function)

imports (C function), [1], [2] in_range (C function) is_32bit (C function) is_64bit (C function) is_dll (C function)

K

key_access (C function)

L

language (C function) LARGE_ADDRESS_AWARE (C type) LINE_NUMS_STRIPPED (C type) linker_version (C type)

linker_version.major (C member) linker_version.minor (C member) LOCAL_SYMS_STRIPPED (C type) locale (C function)

M

machine (C type), [1] MACHINE_32BIT (C type) MACHINE_AM33 (C type) MACHINE_AMD64 (C type) MACHINE_ARM (C type) MACHINE_ARM64 (C type) MACHINE_ARMNT (C type) MACHINE_EBC (C type) MACHINE_I386 (C type) MACHINE_IA64 (C type) MACHINE_M32R (C type) MACHINE_MIPS16 (C type) MACHINE_MIPSFPU (C type) MACHINE_MIPSFPU16 (C type) MACHINE_POWERPC (C type) MACHINE_POWERPCFP (C type)

MACHINE_R4000 (C type) MACHINE_SH3 (C type) MACHINE_SH3DSP (C type) MACHINE_SH4 (C type) MACHINE_SH5 (C type) MACHINE_THUMB (C type) MACHINE_UNKNOWN (C type) MACHINE_WCEMIPSV2 (C type) match() (yara.Rules method) md5 (C function), [1] mean (C function), [1] memory_size (C member) mime_type (C function) monte_carlo_pi (C function), [1] mutex (C function)

N

NET_RUN_FROM_SWAP (C type) network (C type) number_of_resources (C type)

number_of_sections (C type), [1] number_of_segments (C type) number_of_signatures (C type)

O

offset (C member) os_version (C type)

os_version.major (C member) os_version.minor (C member)

P

PF_R (C type) PF_W (C type) PF_X (C type) physical_address (C member) PT_DYNAMIC (C type) PT_GNU_STACK (C type) PT_HIPROC (C type)

PT_INTERP (C type) PT_LOAD (C type) PT_LOPROC (C type) PT_NOTE (C type) PT_NULL (C type) PT_PHDR (C type) PT_SHLIB (C type)

R

registry (C type) RELOCS_STRIPPED (C type) REMOVABLE_RUN_FROM_SWAP (C type) resource_timestamp (C type) RESOURCE_TYPE_ACCELERATOR (C type) RESOURCE_TYPE_ANICURSOR (C type) RESOURCE_TYPE_ANIICON (C type) RESOURCE_TYPE_BITMAP (C type) RESOURCE_TYPE_CURSOR (C type) RESOURCE_TYPE_DIALOG (C type) RESOURCE_TYPE_DLGINCLUDE (C type) RESOURCE_TYPE_FONT (C type) RESOURCE_TYPE_FONTDIR (C type) RESOURCE_TYPE_GROUP_CURSOR (C type) RESOURCE_TYPE_GROUP_ICON (C type) RESOURCE_TYPE_HTML (C type) RESOURCE_TYPE_ICON (C type) RESOURCE_TYPE_MANIFEST (C type) RESOURCE_TYPE_MENU (C type) RESOURCE_TYPE_MESSAGETABLE (C type) RESOURCE_TYPE_PLUGPLAY (C type) RESOURCE_TYPE_RCDATA (C type)

RESOURCE_TYPE_STRING (C type) RESOURCE_TYPE_VERSION (C type) RESOURCE_TYPE_VXD (C type) resource_version (C type) resource_version.major (C member) resource_version.minor (C member) resources (C type) resources.id (C member) resources.language (C member) resources.language_string (C member) resources.length (C member) resources.name_string (C member) resources.offset (C member) resources.type (C member) resources.type_string (C member) rich_signature (C type) rich_signature.clear_data (C member) rich_signature.key (C member) rich_signature.length (C member) rich_signature.offset (C member) rich_signature.raw_data (C member) Rules (class in yara)

S

save() (yara.Rules method) SECTION_CNT_CODE (C type) SECTION_CNT_INITIALIZED_DATA (C type) SECTION_CNT_UNINITIALIZED_DATA (C type) SECTION_GPREL (C type) section_index (C function), [1] SECTION_LNK_NRELOC_OVFL (C type) SECTION_MEM_16BIT (C type) SECTION_MEM_DISCARDABLE (C type) SECTION_MEM_EXECUTE (C type) SECTION_MEM_NOT_CACHED (C type) SECTION_MEM_NOT_PAGED (C type) SECTION_MEM_READ (C type) SECTION_MEM_SHARED (C type) SECTION_MEM_WRITE (C type) sections (C type), [1] sections.characteristics (C member) sections.name (C member), [1] sections.offset (C member) sections.raw_data_offset (C member) sections.raw_data_size (C member) sections.size (C member) sections.type (C member) sections.virtual_address (C member) sections.virtual_size (C member) segments (C type) segments.alignment (C member) segments.file_size (C member) segments.flags (C member) serial_correlation (C function), [1] set_integer (C function) set_string (C function) sha1 (C function), [1] sha256 (C function), [1] SHF_ALLOC (C type) SHF_EXECINSTR (C type) SHF_WRITE (C type) SHT_DYNAMIC (C type)

SHT_DYNSYM (C type) SHT_HASH (C type) SHT_NOBITS (C type) SHT_NOTE (C type) SHT_NULL (C type) SHT_PROGBITS (C type) SHT_REL (C type) SHT_RELA (C type) SHT_SHLIB (C type) SHT_STRTAB (C type) SHT_SYMTAB (C type) signatures (C type) signatures.algorithm (C member) signatures.issuer (C member) signatures.not_after (C member) signatures.not_before (C member) signatures.serial (C member) signatures.subject (C member) signatures.valid_on (C member) signatures.version (C member) size (C type) SIZED_STRING (C type) SIZED_STRING.c_string (C member) SIZED_STRING.length (C member) subsystem (C type) SUBSYSTEM_NATIVE (C type) SUBSYSTEM_NATIVE_WINDOWS (C type) SUBSYSTEM_OS2_CUI (C type) SUBSYSTEM_POSIX_CUI (C type) SUBSYSTEM_UNKNOWN (C type) subsystem_version (C type) subsystem_version.major (C member) subsystem_version.minor (C member) SUBSYSTEM_WINDOWS_CUI (C type) SUBSYSTEM_WINDOWS_GUI (C type) sync (C type) SYSTEM (C type)

T

timestamp (C type) toolid (C function)

type (C function) (C member) (C type)

U

UP_SYSTEM_ONLY (C type)

V

version (C function) version_info (C type)

virtual_address (C member)

Y

yara (module) yara command line option -D --print-module-data -a <seconds> --timeout=<seconds> -d <identifier>=<value> -e --print-namespace -f --fast-scan -g --print-tags -h --help -i <identifier> --identifier=<identifier> -k <slots> --stack-size=<slots> -l <number> --max-rules=<number> -m --print-meta -n -p <number> --threads=<number> -r --recursive -s --print-strings -t <tag> --tag=<tag> -v --version -w --no-warnings -x <module>=<file> yara.compile() (in module yara) yara.load() (in module yara) YR_COMPILER (C type) yr_compiler_add_file (C function) yr_compiler_add_string (C function) yr_compiler_create (C function) yr_compiler_define_boolean_variable (C function) yr_compiler_define_float_variable (C function) yr_compiler_define_integer_variable (C function) yr_compiler_define_string_variable (C function) yr_compiler_destroy (C function) yr_compiler_get_rules (C function) yr_compiler_set_callback (C function) yr_finalize (C function) yr_finalize_thread (C function) yr_initialize (C function) YR_MATCH (C type) YR_MATCH.base (C member) YR_MATCH.data (C member) YR_MATCH.data_length (C member) YR_MATCH.match_length (C member) YR_MATCH.offset (C member) YR_META (C type) YR_META.identifier (C member) YR_META.type (C member) YR_MODULE_IMPORT (C type)

YR_MODULE_IMPORT.module_data (C member) YR_MODULE_IMPORT.module_data_size (C member) YR_MODULE_IMPORT.module_name (C member) YR_RULE (C type) YR_RULE.identifier (C member) YR_RULE.metas (C member) YR_RULE.strings (C member) YR_RULE.tags (C member) yr_rule_metas_foreach (C function) yr_rule_strings_foreach (C function) yr_rule_tags_foreach (C function) YR_RULES (C type) yr_rules_destroy (C function) yr_rules_foreach (C function) yr_rules_load (C function) yr_rules_load_stream (C function) yr_rules_save (C function) yr_rules_save_stream (C function) yr_rules_scan_fd (C function) yr_rules_scan_file (C function) yr_rules_scan_mem (C function) YR_STREAM (C type) YR_STREAM.read (C member) YR_STREAM.user_data (C member) YR_STREAM.write (C member) YR_STRING (C type) YR_STRING.identifier (C member) yr_string_matches_foreach (C function)