6 min read
|
Saved February 14, 2026
|
Copied!
Do you care about this?
BinYars is a plugin that connects YARA-X scanning capabilities to Binary Ninja. It requires building from source using Rust and offers functionalities like rule compilation and project folder organization. The plugin also provides a UI for viewing scan results and managing YARA rules.
If you do, here's more
BinYars is a plugin that integrates YARA-X with Binary Ninja, enhancing malware analysis capabilities. It consists of two main components: a Rust backend for scanning and a Python-based UI for the sidebar widget. To set it up, users need to clone the repository and build it using Cargo. Depending on the operating system—Linux, Windows, or macOS—users must copy the appropriate shared library into the Binary Ninja plugin directory. Rust, along with tools like clang or Xcode, is required for building the plugin.
The plugin features several scanning functionalities. The "Oracle of Order" scans all project files against compiled YARA-X rules and organizes results based on metadata. This process can alter the Binary Ninja project structure, so users should proceed with caution. The "Scanning Sage" performs similar scans but is compatible with the Personal version of Binary Ninja. Users can compile rules directly from the YARA-X directory via the plugin menu. The sidebar widget displays scan results, allowing users to explore string matches and navigate directly to their locations in the binary.
BinYars supports custom YARA-X rules with specific metadata fields that control rendering in the UI. Users can limit string matches displayed to prevent UI sluggishness. The plugin also allows for executing code snippets when matches are found, providing a way to automate responses based on scan results. Special value names like "Offset" and "Length" enhance interactivity, letting users click through to relevant binary locations. This setup offers a detailed and efficient approach to malware analysis, streamlining the process with powerful automation features.
Questions about this article
No questions yet.