Skip to content

Latest commit

 

History

History
63 lines (41 loc) · 3.13 KB

README.md

File metadata and controls

63 lines (41 loc) · 3.13 KB

Yara For Arm (Android)

If you need prebuilt version of yara, check prebuilt directory. It contains both cli executables and static libary

Compile

Use NDK Version 21+

This instruction outlines how to compile yara for ARM. Specifically, for Android. The below instruction were done on OSX. We are going to start with arm8. You can repeat the below steps for the remaining architectures. You can do this by chaning the target,

    export TARGET=aarch64-linux-android (arm8)
    export TARGET=armv7a-linux-androideabi (arm7)
    export TARGET=i686-linux-android (x86)
    export TARGET=x86_64-linux-android (x86_64)

  1. First clone yara, https://github.com/virustotal/yara

  2. Next setup enviroment variables,

     export TOOLCHAIN=$NDK/toolchains/llvm/prebuilt/darwin-x86_64
 # Only choose one of these, depending on your device...
 export TARGET=aarch64-linux-android
 export TARGET=armv7a-linux-androideabi
 export TARGET=i686-linux-android
 export TARGET=x86_64-linux-android
 # Set this to your minSdkVersion.
 export API=21
 # Configure and build.
 export AR=$TOOLCHAIN/bin/llvm-ar
 export CC=$TOOLCHAIN/bin/$TARGET$API-clang
 export AS=$CC
 export CXX=$TOOLCHAIN/bin/$TARGET$API-clang++
 export LD=$TOOLCHAIN/bin/ld
 export RANLIB=$TOOLCHAIN/bin/llvm-ranlib
 export STRIP=$TOOLCHAIN/bin/llvm-strip

  3. Run autoreconf,

     autoreconf --force --install

  4. Configure. If you want to configure with openssl (--with-crypto) use the second command. The flags should point to the dir where openssl headers and libs are located)

     $ ./configure --host $TARGET --enable-static --disable-shared --disable-cuckoo --disable-dotnet --enable-dex

 $ CPPFLAGS="-I/Users/sirack/Desktop/arm-yara/headers/" LDFLAGS="-L/Users/sirack/Desktop/arm-yara/openssl_libs/<ABI>" ./configure --host $TARGET --enable-static --disable-shared --disable-cuckoo --disable-dotnet --enable-dex --with-crypto

  5. Make

     make

  6. Find search for object files

     find libyara -type f -name "*.o" | paste -sd " " -

  7. Build .a static library. Use $AR to archive object files

     $AR cr libyara.a <list of object files>

 <list of object files> - See #5 above

 E.g. $AR cr libyara.a libyara/proc/linux.o libyara/exefiles.o libyara/strutils.o libyara/proc.o libyara/compiler.o libyara/base64.o libyara/hex_lexer.o libyara/endian.o libyara/ahocorasick.o libyara/parser.o libyara/re.o libyara/bitmask.o libyara/threading.o libyara/hex_grammar.o libyara/libyara.o libyara/stream.o libyara/sizedstr.o libyara/re_grammar.o libyara/modules.o libyara/filemap.o libyara/scanner.o libyara/grammar.o libyara/atoms.o libyara/stopwatch.o libyara/stack.o libyara/exec.o libyara/object.o libyara/lexer.o libyara/re_lexer.o libyara/mem.o libyara/rules.o libyara/modules/pe/pe.o libyara/modules/pe/pe_utils.o libyara/modules/tests/tests.o libyara/modules/math/math.o libyara/modules/time/time.o libyara/modules/dex/dex.o libyara/modules/elf/elf.o libyara/modules/console/console.o libyara/arena.o libyara/notebook.o libyara/hash.o libyara/scan.o