yaraQA是何使和性一款功能强大的Yara规则分析工具 ，在该工具的则的质量帮助下 ，广大研究人员可以轻松提升Yara规则的何使和性质量和性能 。
很多Yara规则可能在语法上是则的质量正确的香港云服务器 ，但功能很可能仍然存在问题。何使和性而yaraQA则会试图找到这些问题并将其报告给YARA规则集的则的质量开发者或维护者。
yaraQA会尝试检测下列问题 ：
1 、语法正确 ，则的质量但由于条件中的模板下载何使和性错误，从而导致不匹配的则的质量规则；
2、使用可能错误的何使和性字符串和修饰符组合的规则（例如$ = "\\Debug\\" fullword）；
3 、由短原子 、则的质量重复字符或循环引起的云计算何使和性性能问题（例如$ = "AA"; 可以使用--ignore-performance从分析中排除）；
由于该工具基于Python 3开发，因此我们首先需要在本地设备上安装并配置好Python 3环境 。则的质量接下来 ，何使和性广大研究人员可以使用下列命令将该项目源码克隆至本地：
复制git clone https://github.com/Neo23x0/yaraQA.git1.然后切换到项目目录中 ，使用pip工具和项目提供的requirements.txt文件安装该工具所需的其他依赖组件：
复制cd yaraQA/ pip install -r requirements.txt1.2.3.屏蔽所有性能相关的问题，仅显示逻辑问题 ：
复制python3 yaraQA.py -d ./test/ --ignore-performance1.屏蔽所有信息性字符问题 ：
复制python3 yaraQA.py -d ./test/ -level 21.使用一个基线 ，仅显示新的问题，基线文件需要是一个.json文件 ：
复制python3 yaraQA.py -d ./test/ -b yaraQA-reviewed-issues.json1.yaraQA会将检测到的免费模板问题写入一个名为yaraQA-issues.json的文件中 。
下面给出的是yaraQA生成的JSON格式结果 ：
复制[ { "rule": "Demo_Rule_1_Fullword_PDB", "id": "SM1", "issue": "The rule uses a PDB string with the modifier wide. PDB strings are always included as ASCII strings. The wide keyword is unneeded.", "element": { "name": "$s1", "value": "\\\\i386\\\\mimidrv.pdb", "type": "text", "modifiers": [ "ascii", "wide", "fullword" ] }, "level": "info", "type": "logic", "recommendation": "Remove the wide modifier" }, { "rule": "Demo_Rule_1_Fullword_PDB", "id": "SM2", "issue": "The rule uses a PDB string with the modifier fullword but it starts with two backslashes and thus the modifier could lead to a dysfunctional rule.", "element": { "name": "$s1", "value": "\\\\i386\\\\mimidrv.pdb", "type": "text", "modifiers": [ "ascii", "wide", "fullword" ] }, "level": "warning", "type": "logic", "recommendation": "Remove the fullword modifier" }, { "rule": "Demo_Rule_2_Short_Atom", "id": "PA2", "issue": "The rule contains a string that turns out to be a very short atom, which could cause a reduced performance of the complete rule set or increased memory usage.", "element": { "name": "$s1", "value": "{ 01 02 03 }", "type": "byte" }, "level": "warning", "type": "performance", "recommendation": "Try to avoid using such short atoms, by e.g. adding a few more bytes to the beginning or the end (e.g. add a binary 0 in front or a space after the string). Every additional byte helps." }, { "rule": "Demo_Rule_3_Fullword_FilePath_Section", "id": "SM3", "issue": "The rule uses a string with the modifier fullword but it starts and ends with two backslashes and thus the modifier could lead to a dysfunctional rule.", "element": { "name": "$s1", "value": "\\\\ZombieBoy\\\\", "type": "text", "modifiers": [ "ascii", "fullword" ] }, "level": "warning", "type": "logic", "recommendation": "Remove the fullword modifier" }, { "rule": "Demo_Rule_4_Condition_Never_Matches", "id": "CE1", "issue": "The rule uses a condition that will never match", "element": { "condition_segment": "2 of", "num_of_strings": 1 }, "level": "error", "type": "logic", "recommendation": "Fix the condition" }, { "rule": "Demo_Rule_5_Condition_Short_String_At_Pos", "id": "PA1", "issue": "This rule looks for a short string at a particular position. A short string represents a short atom and could be rewritten to an expression using uint(x) at position.", "element": { "condition_segment": "$mz at 0", "string": "$mz", "value": "MZ" }, "level": "warning", "type": "performance", "recommendation": "" }, { "rule": "Demo_Rule_5_Condition_Short_String_At_Pos", "id": "PA2", "issue": "The rule contains a string that turns out to be a very short atom, which could cause a reduced performance of the complete rule set or increased memory usage.", "element": { "name": "$mz", "value": "MZ", "type": "text", "modifiers": [ "ascii" ] }, "level": "warning", "type": "performance", "recommendation": "Try to avoid using such short atoms, by e.g. adding a few more bytes to the beginning or the end (e.g. add a binary 0 in front or a space after the string). Every additional byte helps." }, { "rule": "Demo_Rule_6_Condition_Short_Byte_At_Pos", "id": "PA1", "issue": "This rule looks for a short string at a particular position. A short string represents a short atom and could be rewritten to an expression using uint(x) at position.", "element": { "condition_segment": "$mz at 0", "string": "$mz", "value": "{ 4d 5a }" }, "level": "warning", "type": "performance", "recommendation": "" }, { "rule": "Demo_Rule_6_Condition_Short_Byte_At_Pos", "id": "PA2", "issue": "The rule contains a string that turns out to be a very short atom, which could cause a reduced performance of the complete rule set or increased memory usage.", "element": { "name": "$mz", "value": "{ 4d 5a }", "type": "byte" }, "level": "warning", "type": "performance", "recommendation": "Try to avoid using such short atoms, by e.g. adding a few more bytes to the beginning or the end (e.g. add a binary 0 in front or a space after the string). Every additional byte helps." }, { "rule": "Demo_Rule_6_Condition_Short_Byte_At_Pos", "id": "SM3", "issue": "The rule uses a string with the modifier fullword but it starts and ends with two backslashes and thus the modifier could lead to a dysfunctional rule.", "element": { "name": "$s1", "value": "\\\\Section\\\\in\\\\Path\\\\", "type": "text", "modifiers": [ "ascii", "fullword" ] }, "level": "warning", "type": "logic", "recommendation": "Remove the fullword modifier" } ]1.2.3.4.5.6.7.8.9.10.11.12.13.14.15.16.17.18.19.20.21.22.23.24.25.26.27.28.29.30.31.32.33.34.35.36.37.38.39.40.41.42.43.44.45.46.47.48.49.50.51.52.53.54.55.56.57.58.59.60.61.62.63.64.65.66.67.68.69.70.71.72.73.74.75.76.77.78.79.80.81.82.83.84.85.86.87.88.89.90.91.92.93.94.95.96.97.98.99.100.101.102.103.104.105.106.107.108.109.110.111.112.113.114.115.116.117.118.119.120.121.122.123.124.125.126.127.128.129.130.131.132.133.134.135.136.137.138.139.140.141.142.143.144.145.146.147.148.149.150.151.152.153.154.155.156.157.158.159.160.161.162.163.164.165.166.167.168.169.170.171.172.173.174.175.176.177.178.179.180.181.182.183.184.185.186.187.188.189.190.191.192.193.194.195.196.197.198.199.200.201.202.203.204.205.206.207.208.209.210.211.212.213.214.215.216.217.218.219.220.221.222.223.224.225.226.227.228.229.230.231.232.233.234.235.236.237.238.239.240.241.242.243.244.245.246.247.248.249.250.251.252.253.254.255.256.257.258.259.260.261.262.263.264.265.266.267.268.269.270.271.272.273.274.275.276.277.278.279.280.281.282.283.284.285.286.287.288.289.290.291.292.293.294.295.296.297.298.299.300.301.302.303.项目专门提供了包含问题的规则样例 ，可以在./test目录中找到 。
本项目的高防服务器开发与发布遵循GPL-3.0开源许可证协议 。
(责任编辑：人工智能)