Formatting YARA Files in Bulk

[xorhex]

Using either the command line or a custom python script, is it possible to pass in a yara rule to yls and have the formatted version returned? Hoping to use this to format some yara rules in bulk. If yes, pointers on where to look? Thanks!

[MatejKastak]

Hi xorhex!

Something like that is possible, for sure :) YLS uses Yaramod to do the formatting. And you can use it also from your scripts.

Here is a quick example script that formats the YARA file specified as the first argument:

#!/usr/bin/env python3

import sys
import yaramod

ymod = yaramod.Yaramod()

yfile = ymod.parse_file(sys.argv[1])
print(yfile.text_formatted)

Here is some more related documentation.

[xorhex]

This is awesome, thank you!

[MatejKastak]

I am glad I could help :slightly_smiling_face: , if you have any other questions feel free to open new issues. Closing this issue now.