Quote:
Originally Posted by Storm Shadow
if you do a yara scan
you will quickly see if the scanner is set proberly.
you will see the yara rules load after push button peform yara scan
RL]
|
I'm sorry I didn't notice there is a push button, yes, I see the yara rules loaded when push the button, thank you so much.
Quote:
Originally Posted by Storm Shadow
he adds the RSA headers to the scanner
Code:
rules = yara.compile(sources = {
'x509' : 'rule x509 {strings: $a = {30 82 ?? ?? 30 82 ?? ??} condition: $a}',
'pkcs' : 'rule pkcs {strings: $a = {30 82 ?? ?? 02 01 00} condition: $a}',
})
|
Which file I should put this rule into? I try name a new rule file as rsa.yar, but seems failed to load.