Today I publish Yara.NET – A C++/CLI .NET wrapper around the Yara 3.4.0 library. It enables you to use all the Yara functionality that the native C lib exposes in .NET! Yara.NET API was inspired by the Python API and has thus a somewhat similar API. Why is it built in C++/CLI and not C#? Because building a wrapper library in C# around a native library is a pain compared to using C++/CLI. Using C++/CLI you can link directly against the native lib and use all of the existing header files without the need to redefine every function using PInvoke..
Example of Yara.NET in action:
string myYaraRule = "...my rule here..."; string namespaceName = null; //optional List errors; //contains yara compile warnings. If there are any errors a YaraException is thrown from CompileFromSource YaraRules yrRules = YaraNET.Yara.Instance.CompileFromSource(myYaraRule, namespaceName, false, null, out errors); List matches = yrRules.MatchFile("C:\mypathtoscan.ext", null, false, 0);
Check it out on GitHub: