plyara

library2.2.8pypypi✓ verified 79d ago

plyara is a YARA rule parser that takes YARA rule text and returns a dictionary with metadata, strings, conditions, and other components. Current version 2.2.8, supports Python >=3.10. Released on an as-needed basis for bugfixes and minor improvements.

data

pip install plyara

github ↗package ↗

INSTALL

IMPORT

SIG · PLYARA

plyara

datapythonv2.2.8

Install

1.7s avg

Import

—

Disk

16MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v2.2.8 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.000s · 18.1MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 1.7s · import 0.000s · 19MB

16MB installed

● package 16MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

Plyara

✓ from plyara import Plyara

✗ from plyara import plyara

Parse a YARA rule string into a dictionary of rule components.

from plyara import plyara parser = plyara() yara_rules = ''' rule ExampleRule { strings: $my_text_string = "text here" $my_hex_string = { E2 34 A1 C8 23 FB } condition: $my_text_string or $my_hex_string }''' parsed = parser.parse_string(yara_rules) print(parsed[0]['rule_name']) print(parsed[0]['strings'])

Debug

Known issues

breakingVersion 2.2.2 changed how logic hashes are computed. Old behavior (without version and algorithm names) is no longer default. Set `plyara_obj.store_logic_hash_versions = True` to retain old behavior.

fix

If you rely on the exact hash output, use `parser.store_logic_hash_versions = True` before parsing.

affects: >=2.2.2

gotchaComments between rules are now properly discarded (since 2.2.5). Previously they could be attached to the next rule, causing unexpected metadata or comment fields.

fix

Upgrade to >=2.2.5 or ensure your rules don't have trailing comments between rule blocks.

affects: <2.2.5

deprecatedThe `store_raw_sections` parameter defaults to `True`, but when set to `False` there was a bug in 2.2.0 causing an exception. Fixed in 2.2.1.

fix

Use version >=2.2.1 if you need to set `store_raw_sections=False`.

affects: 2.2.0

Upgrade

Version history

2.2.8latest on PyPI · released Feb 6, 2025

Audit

Dependencies

No dependency data recorded yet.

Agent activity

2 hits · last 30 days

node

Resources

githubhttps://github.com/plyara/plyara ↗

packagehttps://pypi.org/project/plyara/ ↗