From 61be02188b3f9dee9dd0e1c6797f199e46e65f16 Mon Sep 17 00:00:00 2001 From: Jordan Wiens Date: Tue, 14 Jun 2022 14:47:05 -0400 Subject: [PATCH] adjust hyara to work in BN plugin manager, PySide 6 support --- README.md | 30 ++++++++++-------- __init__.py | 14 +++++++-- .../integration/bn_hyara/__init__.py | 6 ++-- .../{ => bn_hyara}/binaryninja_api.py | 2 +- hyara_lib/integration/bn_hyara/plugin.json | 31 +++++++++++++++++++ hyara_lib/plugins/yara_checker.py | 5 ++- hyara_lib/plugins/yara_detector.py | 5 ++- hyara_lib/plugins/yara_icon.py | 11 +++++-- hyara_lib/ui/settings.py | 5 ++- 9 files changed, 83 insertions(+), 26 deletions(-) rename Hyara_BinaryNinja.py => hyara_lib/integration/bn_hyara/__init__.py (88%) rename hyara_lib/integration/{ => bn_hyara}/binaryninja_api.py (98%) create mode 100644 hyara_lib/integration/bn_hyara/plugin.json diff --git a/README.md b/README.md index 86a770f..00d3ec8 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@ # Hyara -![Version](https://img.shields.io/badge/version-2.0-blue.svg?cacheSeconds=2592000) +![Version](https://img.shields.io/badge/version-2.2-blue.svg?cacheSeconds=2592000) - +![](https://github.com/hyuunnn/Hyara/blob/master/images/Hyara.gif?raw=true) > Hyara is plugin that provides convenience when writing yararule. > @@ -20,11 +20,14 @@ - If you double-click the table, you can clear the rule. - `Export Yara Rule` - Exports the previously created yara rules. - + +![](https://github.com/hyuunnn/Hyara/blob/master/images/Hyara_1.png?raw=true) + - `Right Click` - You can select either start address or end address. (IDA Pro, Cutter) - + +![](https://github.com/hyuunnn/Hyara/blob/master/images/Hyara_7.png?raw=true) - `Comment Option` - Annotates the instructions next to the condition rule(s). @@ -33,21 +36,22 @@ - `String option` - This option extracts strings within the range specified. - - +![](https://github.com/hyuunnn/Hyara/blob/master/images/Hyara_3.png?raw=true) +![](https://github.com/hyuunnn/Hyara/blob/master/images/cutter_1.png?raw=true) ## Installation ### IDA Pro & BinaryNinja +- IDA Pro ```bash pip install -r requirements.txt ``` -- IDA Pro - copy ``Hyara_IDA.py and hyara_lib folder`` to $ida_dir/plugins - Activate via Edit -> Plugins -> Hyara (or CTRL+SHIFT+Y) + - BinaryNinja - - copy ``Hyara_BinaryNinja.py and hyara_lib folder`` to BinaryNinja Plugin directory + - Just use the plugin manager! - Activate via View -> Show Hyara ### Cutter @@ -61,7 +65,7 @@ copy ``__init__.py, Hyara_Cutter.py and hyara_lib folder`` to $cutter_dir/plugin - Linux - +![](https://github.com/hyuunnn/Hyara/blob/master/images/cutter_install__1.png?raw=true) ```bash cp -r /tmp/.mount_Cutter5o3a5G/usr /root @@ -73,7 +77,7 @@ copy ``__init__.py, Hyara_Cutter.py and hyara_lib folder`` to /root/.local/share Activate via Windows -> Plugins -> Hyara - +![](https://github.com/hyuunnn/Hyara/blob/master/images/cutter__0.png?raw=true) ## Features @@ -81,13 +85,13 @@ Activate via Windows -> Plugins -> Hyara - Supports BinaryNinja, Cutter, and IDA - YaraChecker - Tests the yararule on the fly - - + - ![](https://github.com/hyuunnn/Hyara/blob/master/images/Hyara_4.png?raw=true) - YaraDetector - Shows which part is detected in the sample loaded to disassembler, and when "Address" is clicked, it moves to the corresponding address on the disassembler view. - - + - ![](https://github.com/hyuunnn/Hyara/blob/master/images/Hyara_5.png?raw=true) - YaraIcon - Creates yara rules for icon resources embedded in the PE. - - + - ![](https://github.com/hyuunnn/Hyara/blob/master/images/Hyara_6.png?raw=true) ## Author diff --git a/__init__.py b/__init__.py index 16130c3..150e330 100644 --- a/__init__.py +++ b/__init__.py @@ -1,5 +1,13 @@ -from . import Hyara_Cutter +import imp +try: + imp.find_module('cutter') + cutter_found = True +except ImportError: + cutter_found = False +if cutter_found: + import cutter + from . import Hyara_Cutter -def create_cutter_plugin(): - return Hyara_Cutter.HyaraPlugin() + def create_cutter_plugin(): + return Hyara_Cutter.HyaraPlugin() diff --git a/Hyara_BinaryNinja.py b/hyara_lib/integration/bn_hyara/__init__.py similarity index 88% rename from Hyara_BinaryNinja.py rename to hyara_lib/integration/bn_hyara/__init__.py index b40bca2..c29c3df 100644 --- a/Hyara_BinaryNinja.py +++ b/hyara_lib/integration/bn_hyara/__init__.py @@ -1,8 +1,8 @@ -from hyara_lib.integration.binaryninja_api import HyaraBinaryNinja +from .binaryninja_api import HyaraBinaryNinja -import PySide2.QtWidgets as QtWidgets -from PySide2.QtCore import Qt from binaryninjaui import DockHandler, DockContextHandler, UIActionHandler +import PySide6.QtWidgets as QtWidgets +from PySide6.QtCore import Qt class HyaraDockWidget(QtWidgets.QWidget, DockContextHandler): diff --git a/hyara_lib/integration/binaryninja_api.py b/hyara_lib/integration/bn_hyara/binaryninja_api.py similarity index 98% rename from hyara_lib/integration/binaryninja_api.py rename to hyara_lib/integration/bn_hyara/binaryninja_api.py index fcbcc6d..4f7ff89 100644 --- a/hyara_lib/integration/binaryninja_api.py +++ b/hyara_lib/integration/bn_hyara/binaryninja_api.py @@ -1,4 +1,4 @@ -from ..ui.settings import HyaraGUI +from ...ui.settings import HyaraGUI import pefile import binascii diff --git a/hyara_lib/integration/bn_hyara/plugin.json b/hyara_lib/integration/bn_hyara/plugin.json new file mode 100644 index 0000000..e94fbec --- /dev/null +++ b/hyara_lib/integration/bn_hyara/plugin.json @@ -0,0 +1,31 @@ +{ + "pluginmetadataversion": 2, + "name": "Hyara", + "type": [ + "ui" + ], + "api": [ + "python2", + "python3" + ], + "description": "YARA rule making tool for Binary Ninja, Cutter, and IDA", + "license": { + "name": "MIT", + "text": "Copyright (c) 2018 Hyun Yi\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE." + }, + "platforms": [ + "Darwin", + "Linux", + "Windows" + ], + "installinstructions": { + "Darwin": "", + "Linux": "", + "Windows": "" + }, + "dependencies": { + }, + "version": "2.2", + "author": "Hyun Yi", + "minimumbinaryninjaversion": 3469 +} diff --git a/hyara_lib/plugins/yara_checker.py b/hyara_lib/plugins/yara_checker.py index 76449d5..b3fd834 100644 --- a/hyara_lib/plugins/yara_checker.py +++ b/hyara_lib/plugins/yara_checker.py @@ -5,7 +5,10 @@ from PyQt5 import QtWidgets else: # We are running inside Cutter or Binary Ninja - import PySide2.QtWidgets as QtWidgets + try: + import PySide2.QtWidgets as QtWidgets + except: + import PySide6.QtWidgets as QtWidgets import os.path import yara diff --git a/hyara_lib/plugins/yara_detector.py b/hyara_lib/plugins/yara_detector.py index 002bf9c..58c56e7 100644 --- a/hyara_lib/plugins/yara_detector.py +++ b/hyara_lib/plugins/yara_detector.py @@ -5,7 +5,10 @@ from PyQt5 import QtWidgets else: # We are running inside Cutter or Binary Ninja - import PySide2.QtWidgets as QtWidgets + try: + import PySide2.QtWidgets as QtWidgets + except: + import PySide6.QtWidgets as QtWidgets import os.path import yara diff --git a/hyara_lib/plugins/yara_icon.py b/hyara_lib/plugins/yara_icon.py index 4cb9917..ca97ebe 100644 --- a/hyara_lib/plugins/yara_icon.py +++ b/hyara_lib/plugins/yara_icon.py @@ -5,9 +5,14 @@ from PyQt5 import QtWidgets, QtCore, QtGui else: # We are running inside Cutter or Binary Ninja - import PySide2.QtWidgets as QtWidgets - import PySide2.QtCore as QtCore - import PySide2.QtGui as QtGui + try: + import PySide2.QtWidgets as QtWidgets + import PySide2.QtCore as QtCore + import PySide2.QtGui as QtGui + except: + import PySide6.QtWidgets as QtWidgets + import PySide6.QtCore as QtCore + import PySide6.QtGui as QtGui from PIL import Image from PIL.ImageQt import ImageQt diff --git a/hyara_lib/ui/settings.py b/hyara_lib/ui/settings.py index 099b211..1550e6c 100644 --- a/hyara_lib/ui/settings.py +++ b/hyara_lib/ui/settings.py @@ -5,7 +5,10 @@ from PyQt5 import QtWidgets else: # We are running inside Cutter or Binary Ninja - import PySide2.QtWidgets as QtWidgets + try: + import PySide2.QtWidgets as QtWidgets + except: + import PySide6.QtWidgets as QtWidgets from abc import ABCMeta, abstractmethod from ..plugins import yara_checker, yara_detector, yara_icon