{"id":8569,"date":"2020-01-26T17:32:09","date_gmt":"2020-01-26T12:02:09","guid":{"rendered":"http:\/\/kalilinuxtutorials.com\/?p=8569"},"modified":"2020-01-26T17:32:09","modified_gmt":"2020-01-26T12:02:09","slug":"yarasafe","status":"publish","type":"post","link":"https:\/\/kalilinuxtutorials.com\/yarasafe\/","title":{"rendered":"Yarasafe : SAFE Embeddings To Match Functions In Yara"},"content":{"rendered":"\n

YARASAFE <\/strong>is for automatic binary function similarity checks with Yara. SAFE is a tool developed to create Binary Functions Embedding developed by Massarelli L., Di Luna G.A., Petroni F., Querzoni L. and Baldoni R. You can use SAFE to create your function embedding to use inside yara rules.<\/p>\n\n\n\n

If you are interested take a look at our research paper: https:\/\/arxiv.org\/abs\/1811.05296. If you are using this for your research please cite:<\/p>\n\n\n\n

@inproceedings{massarelli2018safe,
title={SAFE: Self-Attentive Function Embeddings for Binary Similarity},
author={Massarelli, Luca and Di Luna, Giuseppe Antonio and Petroni, Fabio and Querzoni, Leonardo and Baldoni, Roberto},
booktitle={Proceedings of 16th Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA)},
year={2019}
}<\/strong><\/p>\n\n\n\n

This is not the code for reproducing the experiments in the paper. If you are interested on it take a look at: https:\/\/github.com\/gadiluna\/SAFE<\/p>\n\n\n\n

Introduction<\/strong><\/p>\n\n\n\n

Using yarasafe you can easily create signature for binary functions without looking at the assembly code at all! You just need to install the IDA Pro Plugins that you find the IDA Pro Plugin folder of this repository.<\/p>\n\n\n\n

Once you have installed the plugin you can start creating embeddings for the function you want to match. These embeddings can be inserted into yara rules to match function using yara. <\/p>\n\n\n\n

To create powerful rule, you can combine multiple functions embeddings with standard yara rules.In this repository you will find the plugin for IDA Pro, and the yarasafe module.<\/p>\n\n\n\n

Yarasafe can match functions with more than 50 instructions and less than 150.<\/p>\n\n\n\n

Also Read – Gophish : Open-Source Phishing Toolkit<\/a><\/strong><\/p>\n\n\n\n

Requirements<\/strong><\/p>\n\n\n\n