Awesome REA
中文Star on GitHubStar1.1k stars
Star on GitHubStar1.1k stars

Tool

YARA-X

VirusTotal's Rust rewrite of YARA for identifying and classifying files with pattern-matching rules. It is meant to replace YARA, with more detailed error reports, faster regular-expression and hex-pattern matching and a more capable command line. Rules keep YARA's syntax of text, hex and regular-expression patterns joined by a Boolean condition, and modules parse PE, ELF, Mach-O, .NET, Android DEX, Chrome CRX and Windows LNK files; the CLI can also print a module's parsed output as JSON or YAML without any rule, which makes it usable as a file-dissection tool. Rust, C, Go and Python APIs, a rule formatter and a language server with a Visual Studio Code extension are included.

Targets
Binary
Category
Native analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Prerequisites: Pre-built binaries for Linux, macOS and Windows come with each release; macOS users can install it with Homebrew and Python users with pip install yara-x. Building needs a recent Rust toolchain (cargo install --path cli), and the Go library builds on the C API. Release at review: v1.23.0, published 2026-11-05.
  • Limits: Its comparison page says the C/C++, Python and Go APIs are not compatible with YARA's and that process scanning is not implemented yet; a separate page lists rule-level differences. The README calls YARA-X mature and stable and says VirusTotal runs it in production.
  • License: BSD-3-Clause per LICENSE; contributions need Google's Contributor License Agreement.

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · VirusTotal/yara-x · Revision 1bda5fc
  2. site/content/docs/intro/yara_vs_yara-x.md GitHub · VirusTotal/yara-x · Revision 1bda5fc
  3. site/content/docs/intro/installation.md GitHub · VirusTotal/yara-x · Revision 1bda5fc
  4. site/content/docs/intro/language_server.md GitHub · VirusTotal/yara-x · Revision 1bda5fc
  5. site/content/docs/modules GitHub · VirusTotal/yara-x · Revision 1bda5fc
  6. site/content/docs/api/python.md GitHub · VirusTotal/yara-x · Revision 1bda5fc
  7. site/content/docs/api/go.md GitHub · VirusTotal/yara-x · Revision 1bda5fc
  8. LICENSE GitHub · VirusTotal/yara-x · Revision 1bda5fc
  9. https://github.com/VirusTotal/yara-x/releases/tag/v1.23.0

More in Native binaries

All 269 entries in Native binaries

↑↓ move↵ open⌘↵ new tab