Victor M. Alvarez

Software Engineer at

[Victor M. Alvarez @plusvic]

We are focused in YARA-X, but don't forget our old and trusted YARA. This is a new release with a bunch of bug fixes. Many thanks to Hongduo Zhao, Ada Logics and Anthropic for reporting many of these bugs.
https://t.co/7PVzKchMOp

[Victor M. Alvarez @plusvic]

YARA-X v1.22.0 is out! https://t.co/dgkO26IbwS

[Victor M. Alvarez @plusvic]

YARA-X 1.21.0 has been released https://t.co/lvRDpp8Qcr

[Miguel Ángel Durán @midudev]

En un mes hemos pasado de "la IA nos va a quitar el trabajo" a "la IA nos va a quitar la vida"

[Bryan Cantrill @bcantrill]

The contagion of fear
https://t.co/DiS7OcqU2D

[Todd P. @toddatlarge]

YARA is powerful and this course by @stvemillertime did a good job teaching foundational concepts with real-world examples for practical application.

[Victor M. Alvarez @plusvic]

@craiu Well, the original quote actually said "a station wagon full of tapes". So, given that modern tapes can contain 40TB, and that you can fit more than 1000 in a Volvo 240, I guess this is still true.

[Victor M. Alvarez @plusvic]

The language server for YARA now can be found in Open VSX too. https://t.co/4c6xWhCHTc

[Victor M. Alvarez @plusvic]

YARA-X 1.20.0 is out!

https://t.co/bJPbIHA7eZ

[Victor M. Alvarez @plusvic]

I keep trying to make YARA-X more user-friendly. Now it helps you catch a very common error in YARA rules:
https://t.co/pr35OhSDyk

[Victor M. Alvarez @plusvic]

The credits are for the contributors that sent all the bug fixes. Kudos to them.

[Florian Roth ⚡️ @cyb3rops]

You may want to update your YARA because Victor shipped some new releases and fixed several bugs
https://t.co/muve0GCFOd

[Victor M. Alvarez @plusvic]

@wessorh No, not yet.

[Victor M. Alvarez @plusvic]

YARA-X 1.19.0 is out https://t.co/ul4oWgGzYi.

Next version may be the first one supporting file decompression (i.e: scanning inside ZIP files and other formats). Stay tuned!

[Victor M. Alvarez @plusvic]

YARA-X 1.18.0 is out!
https://t.co/a9CMCQKHN6

[Victor M. Alvarez @plusvic]

@wessorh Yes, you submit a PR

[Victor M. Alvarez @plusvic]

YARA-X 1.17.0 has been released. This time with the long-awaited `--fast-scan` option. https://t.co/bmmQP7Rp8A

[Victor M. Alvarez @plusvic]

@wessorh With this new repository I have the intention of creating a canonical benchmarking suite for YARA-X and YARA: https://t.co/4A9wWQgEDu

I'll be adding more rules and files in the future. The idea is covering all those cases in which YARA and YARA-X tend to differ in performance.

[Victor M. Alvarez @plusvic]

@wessorh Yep, much better if you use a corpus of real files, specially if rules are making use of modules like pe, elf, etc.

[Victor M. Alvarez @plusvic]

@wessorh From the number of files, and their total size, I would say that the time is dominated by rule compilation/loading, and that would explain the bad results of YARA-X. For benchmarking scanning speed I would recommend bigger and more files, so that the scanning phase takes longer.

[Victor M. Alvarez @plusvic]

@cyb3rops @wessorh I found this conversation with @regeciovad but it doesn't contain details. https://t.co/V1oJN4XhO8

[Victor M. Alvarez @plusvic]

For those who are interested in learning about the recent performance improvements in YARA-X:
https://t.co/dq4Cp6Oe0q

[Victor M. Alvarez @plusvic]

@cyb3rops @wessorh I was trying to recall the details about why I discarded the vectorscan/hyperscan option long ago, but I didn't write down my thoughts back then. I considered using hyperscan for YARA, but I found subtle differences that didn't make it a good fit for YARA's use case.