Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

adjust hyara to work in BN plugin manager, PySide 6 support #18

Merged
merged 1 commit into from
Jun 15, 2022
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 17 additions & 13 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# Hyara

![Version](https://img.shields.io/badge/version-2.0-blue.svg?cacheSeconds=2592000)
![Version](https://img.shields.io/badge/version-2.2-blue.svg?cacheSeconds=2592000)

<img src="images/Hyara.gif" width="100%">
![](https://github.com/hyuunnn/Hyara/blob/master/images/Hyara.gif?raw=true)

> Hyara is plugin that provides convenience when writing yararule.
>
Expand All @@ -20,11 +20,14 @@
- If you double-click the table, you can clear the rule.
- `Export Yara Rule`
- Exports the previously created yara rules.
<img src="images/Hyara_1.png" width="100%">

![](https://github.com/hyuunnn/Hyara/blob/master/images/Hyara_1.png?raw=true)


- `Right Click`
- You can select either start address or end address. (IDA Pro, Cutter)
<img src="images/Hyara_7.png" width="100%">

![](https://github.com/hyuunnn/Hyara/blob/master/images/Hyara_7.png?raw=true)

- `Comment Option`
- Annotates the instructions next to the condition rule(s).
Expand All @@ -33,21 +36,22 @@
- `String option`
- This option extracts strings within the range specified.

<img src="images/Hyara_3.png" width="100%">
<img src="images/cutter_1.png" width="100%">
![](https://github.com/hyuunnn/Hyara/blob/master/images/Hyara_3.png?raw=true)
![](https://github.com/hyuunnn/Hyara/blob/master/images/cutter_1.png?raw=true)

## Installation

### IDA Pro & BinaryNinja

- IDA Pro
```bash
pip install -r requirements.txt
```
- IDA Pro
- copy ``Hyara_IDA.py and hyara_lib folder`` to $ida_dir/plugins
- Activate via Edit -> Plugins -> Hyara (or CTRL+SHIFT+Y)

- BinaryNinja
- copy ``Hyara_BinaryNinja.py and hyara_lib folder`` to BinaryNinja Plugin directory
- Just use the plugin manager!
- Activate via View -> Show Hyara

### Cutter
Expand All @@ -61,7 +65,7 @@ copy ``__init__.py, Hyara_Cutter.py and hyara_lib folder`` to $cutter_dir/plugin

- Linux

<img src="images/cutter_install__1.png" width="100%">
![](https://github.com/hyuunnn/Hyara/blob/master/images/cutter_install__1.png?raw=true)

```bash
cp -r /tmp/.mount_Cutter5o3a5G/usr /root
Expand All @@ -73,21 +77,21 @@ copy ``__init__.py, Hyara_Cutter.py and hyara_lib folder`` to /root/.local/share

Activate via Windows -> Plugins -> Hyara

<img src="images/cutter__0.png" width="100%">
![](https://github.com/hyuunnn/Hyara/blob/master/images/cutter__0.png?raw=true)

## Features

- GUI-based
- Supports BinaryNinja, Cutter, and IDA
- YaraChecker
- Tests the yararule on the fly
- <img src="images/Hyara_4.png" width="100%">
- ![](https://github.com/hyuunnn/Hyara/blob/master/images/Hyara_4.png?raw=true)
- YaraDetector
- Shows which part is detected in the sample loaded to disassembler, and when "Address" is clicked, it moves to the corresponding address on the disassembler view.
- <img src="images/Hyara_5.png" width="100%">
- ![](https://github.com/hyuunnn/Hyara/blob/master/images/Hyara_5.png?raw=true)
- YaraIcon
- Creates yara rules for icon resources embedded in the PE.
- <img src="images/Hyara_6.png" width="100%">
- ![](https://github.com/hyuunnn/Hyara/blob/master/images/Hyara_6.png?raw=true)

## Author

Expand Down
14 changes: 11 additions & 3 deletions __init__.py
Original file line number Diff line number Diff line change
@@ -1,5 +1,13 @@
from . import Hyara_Cutter
import imp
try:
imp.find_module('cutter')
cutter_found = True
except ImportError:
cutter_found = False

if cutter_found:
import cutter
from . import Hyara_Cutter

def create_cutter_plugin():
return Hyara_Cutter.HyaraPlugin()
def create_cutter_plugin():
return Hyara_Cutter.HyaraPlugin()
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
from hyara_lib.integration.binaryninja_api import HyaraBinaryNinja
from .binaryninja_api import HyaraBinaryNinja

import PySide2.QtWidgets as QtWidgets
from PySide2.QtCore import Qt
from binaryninjaui import DockHandler, DockContextHandler, UIActionHandler
import PySide6.QtWidgets as QtWidgets
from PySide6.QtCore import Qt


class HyaraDockWidget(QtWidgets.QWidget, DockContextHandler):
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
from ..ui.settings import HyaraGUI
from ...ui.settings import HyaraGUI
import pefile
import binascii

Expand Down
31 changes: 31 additions & 0 deletions hyara_lib/integration/bn_hyara/plugin.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
{
"pluginmetadataversion": 2,
"name": "Hyara",
"type": [
"ui"
],
"api": [
"python2",
"python3"
],
"description": "YARA rule making tool for Binary Ninja, Cutter, and IDA",
"license": {
"name": "MIT",
"text": "Copyright (c) 2018 Hyun Yi\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE."
},
"platforms": [
"Darwin",
"Linux",
"Windows"
],
"installinstructions": {
"Darwin": "",
"Linux": "",
"Windows": ""
},
"dependencies": {
},
"version": "2.2",
"author": "Hyun Yi",
"minimumbinaryninjaversion": 3469
}
5 changes: 4 additions & 1 deletion hyara_lib/plugins/yara_checker.py
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,10 @@
from PyQt5 import QtWidgets
else:
# We are running inside Cutter or Binary Ninja
import PySide2.QtWidgets as QtWidgets
try:
import PySide2.QtWidgets as QtWidgets
except:
import PySide6.QtWidgets as QtWidgets

import os.path
import yara
Expand Down
5 changes: 4 additions & 1 deletion hyara_lib/plugins/yara_detector.py
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,10 @@
from PyQt5 import QtWidgets
else:
# We are running inside Cutter or Binary Ninja
import PySide2.QtWidgets as QtWidgets
try:
import PySide2.QtWidgets as QtWidgets
except:
import PySide6.QtWidgets as QtWidgets

import os.path
import yara
Expand Down
11 changes: 8 additions & 3 deletions hyara_lib/plugins/yara_icon.py
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,14 @@
from PyQt5 import QtWidgets, QtCore, QtGui
else:
# We are running inside Cutter or Binary Ninja
import PySide2.QtWidgets as QtWidgets
import PySide2.QtCore as QtCore
import PySide2.QtGui as QtGui
try:
import PySide2.QtWidgets as QtWidgets
import PySide2.QtCore as QtCore
import PySide2.QtGui as QtGui
except:
import PySide6.QtWidgets as QtWidgets
import PySide6.QtCore as QtCore
import PySide6.QtGui as QtGui

from PIL import Image
from PIL.ImageQt import ImageQt
Expand Down
5 changes: 4 additions & 1 deletion hyara_lib/ui/settings.py
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,10 @@
from PyQt5 import QtWidgets
else:
# We are running inside Cutter or Binary Ninja
import PySide2.QtWidgets as QtWidgets
try:
import PySide2.QtWidgets as QtWidgets
except:
import PySide6.QtWidgets as QtWidgets

from abc import ABCMeta, abstractmethod
from ..plugins import yara_checker, yara_detector, yara_icon
Expand Down