Golang for infosec — Building an EDR #Part2 — YARA rules

Go, C, … cgo!

// #include <stdio.h>
// #include <errno.h>
import “C”

Compile your YARA rules

go get github.com/hillu/go-yara
go install github.com/hillu/go-yara
// LoadYaraRules compile yara rules from specified paths and return a pointer to the yara compiler
func LoadYaraRules(path []string) (compiler *yara.Compiler, err error) {
compiler, err = yara.NewCompiler()
if err != nil {
return nil, errors.New("Failed to initialize YARA compiler")
for _, dir := range path {
f, err := os.Open(dir)
if err != nil{
log.Println("[ERROR]", "Could not open rule file ", dir, err)
namespace := filepath.Base(dir)[:len(filepath.Base(dir))-4] if err = compiler.AddFile(f, namespace); err != nil{
log.Println("[ERROR]", "Could not load rule file ", dir, err)
return compiler, nil}

Search for YARA match

// PerformYaraScan use provided YARA rules and search for match in the given byte slicefunc PerformYaraScan(data []byte, rules *yara.Rules) yara.MatchRules {
result, err := YaraScan(data, rules)
if err != nil{
log.Println("[ERROR]", err)
return result




Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium



Nunchuk 0.9.7

Analyzing Java Heap Dumps via OQL queries

Gantt Chart Vs. Kanban: What to Choose for Your Project?

Historic software — can your package manager handle this?

Nifty tool-chain for CQRS application development with read model projection

Udemy, LinkedIn Learning, or Edureka? Which is Better to Learn Tech Skills in 2021?

Terraform in internet restricted networks on AWS

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Jean-Pierre GARNIER

Jean-Pierre GARNIER

More from Medium

Importing private repos from Github

GoReleaser 1.3 — the first of 2022

Simple IoT Messages Delivery With GoLang — 2

Using Petri to simulate cultural interactions with Go