Next time AI makes up a garbage answer just remember wxs' first law of AI: "Never trust robots, a bunch of assholes if you ask me."

So @xorhex.bsky.social asked (in our YARA keybase chat) how one might only iterate through the last 10 matches of a string in YARA. I took a shot at answering it by logging the last 10 locations of a match in descending order: for all i in (0..10): (console.log(@a[#a - i]))

github.com/VirusTotal/y... - congrats to all involved! These new features are really great!

Not so fun fact: The imphash implementation in pefile has diverged from the implementation in YARA and YARA-X... and any other one in the last 15 years. This has existed for 2 years and I'm pushing to get it reverted and a new pefile release made. github.com/erocarrera/p...

It really annoyed me that we could not return multiple tag linter errors, but returned multiple errors for other linters. The root cause is kind of interesting. More importantly, I put up a fix for it: github.com/VirusTotal/y...

Two for one today! Added support for console.log(offset, length) to the console module in YARA-X, per the suggestion of a user. Makes it nicer to work with arbitrary sequences of bytes. Hopefully it makes it in the next release!

I've been struggling to find time to write code during the week, and I know I need to get better at that as I still very much enjoy contributing to this project. Anyways, here's the PR that adds the linter functionality the compiler has to the Python API: github.com/VirusTotal/y...

One of those days. I have a bit of time to work on some code, so I start in on it. I quickly realize I want a feature that was added sometime after I started my branch. Fine, I pull it down into my repository BUT COMPLETELY FORGET TO REBASE MY WORK ON IT! Took me a solid 20 minutes of debugging.

So @tlansec.bsky.social asked about exposing the linter capabilities of `yr check` (sometimes called the "checker") in the python API. It is done modulo test cases and some minor tweaks to the API I'm considering to make it a bit nicer. PR up hopefully by the end of this weekend.

Did some work to expose the functionality of the “yr check” command (what I call the linter) in the python bindings. The basic gist is done, just need to clean it up this weekend. Should have a PR up soon.

Victor just released v1.14.0 - improvements in macho module, tighter code generation in the compiler and the new “deps” command. Congratulations to everyone involved! github.com/VirusTotal/y...

Spent some time yesterday cleaning up my dependency graphing code for yara-x. No longer outputs graphviz. Instead it dumps an ascii tree. You can try it with “yr deps” in the next release.

Some of the analysis I've done over the past few years is referenced in various places in this overview. I might be most happy that my sneaky reference to the time a half-dozen of us ate a Vermonster in a single attempt made it into the report. cloud.google.com/blog/topics/...

github.com/VirusTotal/y... - Once again, new release with some good bug fixes and nice improvements.

YARA-X 1.12.0 is out. Some small bug fixes but still worth upgrading! Once again, congrats to Victor and the contributors as the project keeps getting better. github.com/VirusTotal/y...

github.com/VirusTotal/y... - 1.11.0 is out! Lots of new features, modules and bug fixes. Read the release notes and congrats to Victor and the contributors!

One wheel Jesus was at the Christmas parade again. All praise be to one wheel Jesus and his crew.

Quality of life improvement for yara-x: I realized the functions that output hash values do not have constraints on them like the hash module functions do. See virustotal.github.io/yara-x/blog/... for details on why this is useful to extend everywhere. PR that fixes it: github.com/VirusTotal/y...

Yara-x 1.10.0 released today! It can now automatically fix some warnings, and some improvements in code generation. This is another great step forward for the project. github.com/VirusTotal/y...

Don't ask why but you may now refer to me as "Sir Wesley, robot, esq." (thanks @gabagool.ing for that one) and gemini thinks this is what I look like. It may have had some help with the Pikachu hoodie and hot dogs. You're welcome for this visual.

Finally put this up for review in a PR (github.com/VirusTotal/y...) - it's now in it's own command and has been tested on some pretty gnarly graphs of rules. If you have huge dependency graphs the output gets messy, but it works well otherwise.

If you're interested in my dependency querying code for yara rules check out my deps branch: github.com/wxsBSD/yara-... You can build it with "cargo build --features=debug-cmd" and use it like "yr debug deps -h". My TODO list for this is basically: - Write tests - Move to it's own command

@pdub5.bsky.social does great work! If you’re going to be at the conference go see his talk and maybe heckle him for me.

I've got something built on Victor's new DFSIter for yara-x AST that takes a set of rules and outputs the dependencies and modules used (based upon the compiled list of modules). Ultimately I want to make it output a graphviz file for visualization but for now it's dumping them to stdout...

yara-x 1.9.0 is out! The DFSIterator for AST traversal is what I was finishing up this week (and now I don’t have to, yay), and is definitely really interesting if you are into that sort of thing. I’ll finish my work onto top of this new implementation. github.com/VirusTotal/y...

I’ve been working on something in YARA-X that I think is needed if you have complex sets of rules and dependencies. Should have something to show next week.

cloud.google.com/blog/topics/... I wrote some more on COLDRIVER - specifically about their recent malware they have been using since at least May. If you’re on the COLDRIVER target list keep an eye out for this stuff. They have been more active with it than previous malware.

Thanks to @xorhex for an interesting discussion that is worth sharing here. I knew I read this somewhere but here's a fun thing you can do in YARA-X: 2 of ($a*, $b*, 3 of ($c*)) This is documented but not widely known: virustotal.github.io/yara-x/docs/...

Is it a good idea to have a modifier that treats ' the same as " in strings. Something like this: $a = "foo('bar')" quotes This would effectively get you that string and foo("bar") but also foo('bar") or any combination of quote usage. Might have to put some thought into this and implement it.

Smart person says smart things! And it’s not just when walking this structure (though it is great there) it is for any loop that can get out of hand. Use it and be happy. Don’t use it and be sad - as I have seen first hand multiple times.

I won’t be at CYBERWARCON this year so I need someone to give @hultquist.bsky.social a hard time for me. I don’t yet know why he deserves this, but I’m sure a reason will present itself between now and then. The man never disappoints in the shenanigans and tomfoolery department.

Two things: YARA-X 1.8.0 is out with some nice features if you use the various bindings and a bug fix involving an edge case in PE signatures. Congrats to all involved! To be more useful I wrote a small PR to display filenames in console.log() output when using yr scan. github.com/VirusTotal/y...

www.zscaler.com/blogs/securi... - Nice writeup by zscaler on some COLDRIVER malware. I'm talking about this stuff at #FTSCon in a few weeks and will have lots more details there.

The first album by Lucid Planet was an instant like. A great progressive rock album that is insanely well produced. When the second album came out I liked it but it took a few full listens to really come into its own - I had to really embrace the electronica inspirations but definitely great album.

The whole “wxs is a robot” meme has officially gone too far. See you in October!

yara-x 1.7.0 is out. Some good bug fixes in there! Congrats to Victor and all the contributors! github.com/VirusTotal/y...

Spotify algorithm is on some serious drugs. What the deuce is this?

I’ll be giving a talk at FTS this year. Not going to lie, I’m doing it just so I can heckle Sir Tom of The House of Lancaster (@tlansec.bsky.social) in person. volatilityfoundation.org/from-the-sou...

Almost a month ago I had to have emergency surgery to have my gallbladder removed (not fun, do not recommend). It does mean I just got to use the sentence: "unnecessary organs will be removed for efficiency" - and for that I am happy.

Patrick doing good work and with classy emoji usage in the <whatever the equivalent to a tweet is>.

YARA-X 1.5.0 is out. Nice new features (including a crx module) and bug fixes. Congratulations to Victor and all the contributors! github.com/VirusTotal/y...

I’ve said this and a corollary to this for years. It’s all just bytes but “why is that particular sequence interesting” and “what do those bytes mean in the context of this malware” are the more interesting questions. Many decades ago I discovered something new to me that illustrates this…

First question: Will I be fired for only referring to you as Sir Tom of The House of Lancaster? Seriously though, if you’re looking this is one of the teams I would consider.

I took inspiration from the always classy @jacoblatonis.me recently and added support for underscores in integer and float literals in YARA. It makes reading large integers (in any supported base) much easier. github.com/VirusTotal/y...

We (@gabagool.ing - AKA gabbot) and I updated this with some more recent tomfoolery from this group. They continued the ASP campaign with evidence they responded to our initial publication. They were doing some sneaky calendar stuff that lead to adding a device to the target's O365 tenant.

The view from my driveway this year. Happy 4th of July!

I know I've been slacking on contributing to YARA-X, but I've been busy elsewhere. I do run a small keybase group where developers and users hang out. Ideas, features and bugs are discussed there. If you think you would benefit from being part of the discussion just hit me up for an invite.

So @gabagool.ing (who will henceforth be referred to as "gabbot") and I wrote some stuff on some ASP phishing campaigns: cloud.google.com/blog/topics/... Citizen Lab worked closely with one of the targets and shared their work on it also: citizenlab.ca/2025/06/russ...

Apparently my lightning talk at @cyberwarcon.bsky.social last year was released. Go watch it for a quick overview. COLDRIVER is still active, and still evolving to this day. The critical question is do I want to use emojis when I post about them?

New YARA-X release! In fact, Victor released 1.0.0. Lots of hard work by Victor and others to make this happen, congratulations to everyone involved! github.com/VirusTotal/y...