YARA Dependency Chain & YARA Ruleset Diff

[gazunder]

Over the past year I’ve been using GYP fairly heavily to help manage a large YARA ruleset. One of the things I needed to do was to:

• Build a dependency chain for
  • a rule
  • a list of rules
• Diff two rulesets

So I wrote code to accomplish both these tasks. I believe this code can be useful to others (I’ve been asked about it by multiple people) so I’d like to open source it. I think it would make a good addition to GYP, but I’d like to get feedback and see if the community thinks it should be added to GYP. Is this something that makes sense to move into GYP?

At a high level my implementation plan (very open to feedback) is to create a new dir at the root of GYP called utils. Within this dir I’d add yara_diff.go and yara_dependency_walker.go. I’d also write two simple CLI go programs to serve as examples of how to use them (maybe throw them in an examples dir).

Dependency Chain

The purpose of this code is to return a list of dependent rules for a given rule. This code takes in a ruleset and a list of rule identifiers to get dependencies for. For each identifier the code will recursively get the the rules that it depends on.

Yara Ruleset Diff

This code will take in two YARA rulesets and return a data structure that shows if a rule was modified, deleted, added, or is the same.