yara-python Documentation

The simplest method to install the library is using pip.

$ pip install yara-python

If you prefer to link dynamically against a shared libyara library instead of static linking, use the --dynamic-linking flag during the build process.

Requirement: You must have already built and installed the core YARA library separately on your system before attempting this build.

$ python setup.py build --dynamic-linking

You can build and install from source. When cloning the repository, you must use the --recursive flag to ensure the libyara subproject (the core YARA library) is downloaded.

By default, these methods link libyara statically into yara-python.

$ git clone --recursive https://github.com/VirusTotal/yara-python
$ cd yara-python
$ python setup.py build
$ sudo python setup.py install

This example demonstrates how to compile a YARA rule from a string and perform a match against a data string, accessing rule metadata and string instance details.

>>> import yara
>>> rule = yara.compile(source='rule foo: bar {strings: $a = "lmn" condition: $a}')
>>> matches = rule.match(data='abcdefgjiklmnoprstuvwxyz')
>>> print(matches)
[foo]
>>> print(matches[0].rule)
foo
>>> print(matches[0].tags)
['bar']
>>> print(matches[0].strings)
[$a]
>>> print(matches[0].strings[0].identifier)
$a
>>> print(matches[0].strings[0].instances)
[lmn]
>>> print(matches[0].strings[0].instances[0].offset)
10
>>> print(matches[0].strings[0].instances[0].matched_length)
3