yara-python
fleur
yara-python | fleur | |
---|---|---|
1 | 3 | |
623 | 116 | |
0.6% | 0.0% | |
6.7 | 0.0 | |
about 1 month ago | about 1 year ago | |
C | C | |
Apache License 2.0 | BSD 3-clause "New" or "Revised" License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
yara-python
-
Pros and Cons of Rust for Cybersecurity
But, due to the young ecosystem, Rust isn't often the best choice for the 2nd category. There are exceptions: while working on a ROP exploitation CLI tool, I was surprised to find the top 3 fastest x86-64 disassemblers are all written in Rust. But other languages just have more mature security ecosystems. Python in particular has some amazing libraries like scapy and bindings for yara.
fleur
-
Fleur – A bloom filter implementation in C
> There is also strange code like this loop https://github.com/hashlookup/fleur/blob/4ee2644a850381d928a... that jumped into my eye.
The line below that is worse:
strncpy(bloom_path , argv[optind], 128);
If you pass something >= 128 chars then bloom_path won't be null terminated. In general strncpy should never be used for copying strings.
For expansion on that: https://ramblings.implicit.net/c/2014/05/02/c-functions-that...
What are some alternatives?
signature-base - YARA signature and IOC database for my scanners and tools
RedisBloom - Probabilistic Datatypes Module for Redis
awesome-yara - A curated list of awesome YARA rules, tools, and people.
a-ray-grass - a-ray-grass is a yara module that provides support for DCSO-format bloom filters in yara. In the context of hashlookup, it allows quickly discard known files "pour séparer le grain de l'ivraie"
scapy - Scapy: the Python-based interactive packet manipulation program & library. Supports Python 2 & Python 3.
xgadget - Fast, parallel, cross-variant ROP/JOP gadget search for x86/x64 binaries.
yara - The pattern matching swiss knife
disas-bench - X86 disassembler benchmark
Loki - Loki - Simple IOC and YARA Scanner