{
  "added_at": "2026-11-06",
  "additional_evidence_urls": [
    "https://github.com/VirusTotal/yara-x/blob/1bda5fc3cbd05c937bcedc63a662f513b7490c4d/site/content/docs/intro/yara_vs_yara-x.md",
    "https://github.com/VirusTotal/yara-x/blob/1bda5fc3cbd05c937bcedc63a662f513b7490c4d/site/content/docs/intro/installation.md",
    "https://github.com/VirusTotal/yara-x/blob/1bda5fc3cbd05c937bcedc63a662f513b7490c4d/site/content/docs/intro/language_server.md",
    "https://github.com/VirusTotal/yara-x/tree/1bda5fc3cbd05c937bcedc63a662f513b7490c4d/site/content/docs/modules",
    "https://github.com/VirusTotal/yara-x/blob/1bda5fc3cbd05c937bcedc63a662f513b7490c4d/site/content/docs/api/python.md",
    "https://github.com/VirusTotal/yara-x/blob/1bda5fc3cbd05c937bcedc63a662f513b7490c4d/site/content/docs/api/go.md",
    "https://github.com/VirusTotal/yara-x/blob/1bda5fc3cbd05c937bcedc63a662f513b7490c4d/LICENSE",
    "https://github.com/VirusTotal/yara-x/releases/tag/v1.23.0"
  ],
  "category": "native-analysis",
  "description_en": "VirusTotal's Rust rewrite of YARA for identifying and classifying files with pattern-matching rules. It is meant to replace YARA, with more detailed error reports, faster regular-expression and hex-pattern matching and a more capable command line. Rules keep YARA's syntax of text, hex and regular-expression patterns joined by a Boolean condition, and modules parse PE, ELF, Mach-O, .NET, Android DEX, Chrome CRX and Windows LNK files; the CLI can also print a module's parsed output as JSON or YAML without any rule, which makes it usable as a file-dissection tool. Rust, C, Go and Python APIs, a rule formatter and a language server with a Visual Studio Code extension are included.",
  "description_zh": "VirusTotal 用 Rust 重写的 YARA，以模式匹配规则识别和归类文件。它的目标是取代 YARA，提供更详细的错误报告、更快的正则表达式与十六进制模式匹配，以及功能更强的命令行。规则沿用 YARA 的语法，即文本、十六进制和正则表达式模式加布尔条件；各模块可解析 PE、ELF、Mach-O、.NET、Android DEX、Chrome CRX 和 Windows LNK 文件。命令行无需任何规则即可把模块的解析结果输出为 JSON 或 YAML，因此也能当作文件结构剖析工具使用。项目提供 Rust、C、Go 和 Python API、规则格式化工具，以及带 Visual Studio Code 扩展的语言服务器。",
  "entry_url": "https://awesomerea.org/resources/yara-x/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/yara-x/",
  "evidence_url": "https://github.com/VirusTotal/yara-x/blob/1bda5fc3cbd05c937bcedc63a662f513b7490c4d/README.md",
  "group": "tools",
  "id": "yara-x",
  "json_url": "https://awesomerea.org/resources/yara-x/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/yara-x/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/yara-x/index.md",
  "name": "YARA-X",
  "name_zh": "YARA-X Rust 版 YARA 模式匹配工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirement_facets": [
    "prerequisites",
    "limits",
    "license"
  ],
  "requirements": [
    "Pre-built binaries for Linux, macOS and Windows come with each release; macOS users can install it with Homebrew and Python users with pip install yara-x. Building needs a recent Rust toolchain (cargo install --path cli), and the Go library builds on the C API. Release at review: v1.23.0, published 2026-11-05.",
    "Its comparison page says the C/C++, Python and Go APIs are not compatible with YARA's and that process scanning is not implemented yet; a separate page lists rule-level differences. The README calls YARA-X mature and stable and says VirusTotal runs it in production.",
    "BSD-3-Clause per LICENSE; contributions need Google's Contributor License Agreement."
  ],
  "requirements_zh": [
    "每个发布版本都附有 Linux、macOS 和 Windows 预编译程序；macOS 用户可用 Homebrew 安装，Python 用户可用 pip install yara-x 安装。从源码构建需要较新的 Rust 工具链（cargo install --path cli），Go 库基于 C API 构建。审阅时的版本为 v1.23.0，于 2026-11-05 发布。",
    "对比文档指出，其 C/C++、Python 和 Go API 与 YARA 的不兼容，进程扫描功能也尚未实现；另有专页列出规则层面的差异。README 称 YARA-X 已经成熟稳定，VirusTotal 已在生产环境中使用。",
    "依 LICENSE 采用 BSD-3-Clause 许可；提交贡献须签署 Google 贡献者许可协议（CLA）。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/VirusTotal/yara-x",
  "verification": "source-reviewed",
  "verified_at": "2026-11-05"
}