YARA Tester
Build a YARA rule string by string, and scan a pasted sample live. The matching is real and byte-level.
Build a YARA rule and scan text, hex or a file with it, byte by byte, in the page. Every offset shown is where the bytes were actually found.
This runs in your browser. Nothing you type or open is uploaded.
How to read it
Text strings take ascii, wide and nocase. Windows binaries keep many strings in UTF-16, so add wide when you hunt them.
Hex strings take ?? for any byte. Use it for version digits and other bytes that change between builds.
The condition says how many strings must hit: any of them, all of them, 2 of them, or a list.
| Feature | Example | Note |
|---|---|---|
| Modules | import "pe" | The pe, math, hash, elf, magic and cuckoo modules, and every condition term they provide. |
| External variables | filename matches /\.exe$/ | Values a caller injects at scan time. This tool has no scan-time context to inject. |
| Regex strings | $re = /ab+c/ | Only text strings and hex strings are supported. |
| Count / offset / length | #a > 3, @a, !a, $a at 0 | A string is a plain boolean here. No occurrence count, match offset or length arithmetic in the condition. |
| Rule metadata | meta: author = "…" | Nothing beyond the rule name: no meta block, no rule tags, no global/private modifiers. |
| Other string modifiers | "a" fullword xor base64 | fullword, xor, base64, base64wide and private are all out of scope. |
| Hex jumps & alternatives | { 8D [2-3] 6A ( 04 | 05 ) } | Nibble wildcards (?? / A? / ?A) are the only hex construct supported; jumps, alternatives and the ~ not-operator are not. |
| Other condition forms | none of them, 2 of ($a*) | Only "them" is understood in the of-operator. none of them (YARA 4.3.0+), explicit string sets, for-loops, not, filesize and entrypoint are out of scope. |
Sources
- Writing YARA rules (official YARA documentation). The authoritative YARA rule-writing reference: the full string-modifier set, hex-string jumps and alternatives, the complete condition grammar, and the module system. The source this page's supported subset was written against, and where to go for everything the subset deliberately leaves out.
- YARA-X documentation (VirusTotal). Official docs for YARA-X, VirusTotal's Rust rewrite of YARA, roughly rule-compatible with YARA 4.x but stricter about a few constructs the older parser tolerated. Worth reading alongside the YARA docs when a rule behaves differently between the two engines.
Worth using too
- YARAify (abuse.ch / Spamhaus). A free platform for scanning files against a large public collection of YARA rules, and for publishing your own through YARAhub: the natural next step once a rule works here and you want to see how it behaves against real corpus data.
- Awesome YARA (InQuest). A large, actively curated index of YARA rule sets, editors, linters, scanning frameworks and style guides. The fastest way to find real published rules to study, or a rule-authoring tool that fits your workflow.
- signature-base (Florian Roth). A long-running open collection of YARA rules and IOCs written for low false-positive rates, released under the Detection Rule License. A good corpus of real, production-quality rules to read for authoring conventions.