Victor M. Alvarez

Software Engineer at

[Victor M. Alvarez @plusvic]

@wessorh Yes, you submit a PR

[Victor M. Alvarez @plusvic]

YARA-X 1.17.0 has been released. This time with the long-awaited `--fast-scan` option. https://t.co/bmmQP7Rp8A

[Victor M. Alvarez @plusvic]

@wessorh With this new repository I have the intention of creating a canonical benchmarking suite for YARA-X and YARA: https://t.co/4A9wWQgEDu

I'll be adding more rules and files in the future. The idea is covering all those cases in which YARA and YARA-X tend to differ in performance.

[Victor M. Alvarez @plusvic]

@wessorh Yep, much better if you use a corpus of real files, specially if rules are making use of modules like pe, elf, etc.

[Victor M. Alvarez @plusvic]

@wessorh From the number of files, and their total size, I would say that the time is dominated by rule compilation/loading, and that would explain the bad results of YARA-X. For benchmarking scanning speed I would recommend bigger and more files, so that the scanning phase takes longer.

[Victor M. Alvarez @plusvic]

@cyb3rops @wessorh I found this conversation with @regeciovad but it doesn't contain details. https://t.co/V1oJN4XhO8

[Victor M. Alvarez @plusvic]

For those who are interested in learning about the recent performance improvements in YARA-X:
https://t.co/dq4Cp6Oe0q

[Victor M. Alvarez @plusvic]

@cyb3rops @wessorh I was trying to recall the details about why I discarded the vectorscan/hyperscan option long ago, but I didn't write down my thoughts back then. I considered using hyperscan for YARA, but I found subtle differences that didn't make it a good fit for YARA's use case.

[Victor M. Alvarez @plusvic]

@wessorh I also would like to figure out why YARA-X seems to be consistenly slower than YARA C in your tests. My own tests point in the opposite direction after the improvements in YARA-X 1.16.0. But performance is very sensitive the the rules and files scanned.

[Victor M. Alvarez @plusvic]

@wessorh Contributions are always welcomed. For instance, a canonical set of rules and files that can be used for benchmarking would be really great. So that different implementations can be compared using that canonical set.

[Victor M. Alvarez @plusvic]

@wessorh @cyb3rops holloman2 is the interesting part because the claims are bold. If I understood correctly, you can enterily avoid the Aho-Corasick scan by comparing the file's fingerprint to the pattern's fingerprint. That would discard files that don't contain the pattern. Is that correct?

[Victor M. Alvarez @plusvic]

@wessorh @cyb3rops Do you plan to open source yara-g in the future?

[Victor M. Alvarez @plusvic]

@halvarflake I feel the same. For projects that I really care about my strategy consists in forcing myself to treat the AI like a pair-programming buddy. With that mindset I feel productive but in control, and actually end up learning a few things from the AI.

[Victor M. Alvarez @plusvic]

@dev_metthal No, in such cases it won't help. You are probably thinking about cases in which the same function is called with multiple regexes, right?

[Victor M. Alvarez @plusvic]

@cyb3rops @wessorh I guess there's a lot of variance too. Person A can create tons of bad rules within seconds, while person B takes the time to find a pattern that is likely to cover most specimens of a malware family while not producing false positives.

[Victor M. Alvarez @plusvic]

@wessorh Hard to tell. I haven't seen any research in that topic. Maybe @cyb3rops has some relevant metrics, they create a lot of rules.

[Victor M. Alvarez @plusvic]

@wessorh That sounds very interesting. If you can point me out to some repository I would take a look. Also, I think it would be great to have a canonical set of rules and files for benchmarking. I can come up with something.

[Victor M. Alvarez @plusvic]

YARA-X 1.16.0 is out!

This time with performance improvements that make it much faster. With this release YARA-X is faster than traditional YARA in almost every case.

https://t.co/dWYX5PmJy2

[Victor M. Alvarez @plusvic]

YARA-X 1.15.0 is out!

https://t.co/jdYNwa75dU