# YARA-X

> VirusTotal's Rust rewrite of YARA for identifying and classifying files with pattern-matching rules. It is meant to replace YARA, with more detailed error reports, faster regular-expression and hex-pattern matching and a more capable command line. Rules keep YARA's syntax of text, hex and regular-expression patterns joined by a Boolean condition, and modules parse PE, ELF, Mach-O, .NET, Android DEX, Chrome CRX and Windows LNK files; the CLI can also print a module's parsed output as JSON or YAML without any rule, which makes it usable as a file-dissection tool. Rust, C, Go and Python APIs, a rule formatter and a language server with a Visual Studio Code extension are included.

- Type: Tool
- Targets: Binary
- Category: Native analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-11-05
- Added to the catalog: 2026-11-06
- Original resource: <https://github.com/VirusTotal/yara-x>
- Primary source: <https://github.com/VirusTotal/yara-x/blob/1bda5fc3cbd05c937bcedc63a662f513b7490c4d/README.md>
- Catalog page: <https://awesomerea.org/resources/yara-x/>
- Record JSON: <https://awesomerea.org/resources/yara-x/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/yara-x/index.md)

## Requirements & limits

- **Prerequisites:** Pre-built binaries for Linux, macOS and Windows come with each release; macOS users can install it with Homebrew and Python users with pip install yara-x. Building needs a recent Rust toolchain (cargo install --path cli), and the Go library builds on the C API. Release at review: v1.23.0, published 2026-11-05.
- **Limits:** Its comparison page says the C/C++, Python and Go APIs are not compatible with YARA's and that process scanning is not implemented yet; a separate page lists rule-level differences. The README calls YARA-X mature and stable and says VirusTotal runs it in production.
- **License:** BSD-3-Clause per LICENSE; contributions need Google's Contributor License Agreement.

## Primary sources

1. <https://github.com/VirusTotal/yara-x/blob/1bda5fc3cbd05c937bcedc63a662f513b7490c4d/README.md>
2. <https://github.com/VirusTotal/yara-x/blob/1bda5fc3cbd05c937bcedc63a662f513b7490c4d/site/content/docs/intro/yara_vs_yara-x.md>
3. <https://github.com/VirusTotal/yara-x/blob/1bda5fc3cbd05c937bcedc63a662f513b7490c4d/site/content/docs/intro/installation.md>
4. <https://github.com/VirusTotal/yara-x/blob/1bda5fc3cbd05c937bcedc63a662f513b7490c4d/site/content/docs/intro/language_server.md>
5. <https://github.com/VirusTotal/yara-x/tree/1bda5fc3cbd05c937bcedc63a662f513b7490c4d/site/content/docs/modules>
6. <https://github.com/VirusTotal/yara-x/blob/1bda5fc3cbd05c937bcedc63a662f513b7490c4d/site/content/docs/api/python.md>
7. <https://github.com/VirusTotal/yara-x/blob/1bda5fc3cbd05c937bcedc63a662f513b7490c4d/site/content/docs/api/go.md>
8. <https://github.com/VirusTotal/yara-x/blob/1bda5fc3cbd05c937bcedc63a662f513b7490c4d/LICENSE>
9. <https://github.com/VirusTotal/yara-x/releases/tag/v1.23.0>

## More in Native binaries

- [ReClass.NET](https://awesomerea.org/resources/reclass-net/index.md) · Tool
- [Keypatch](https://awesomerea.org/resources/keypatch/index.md) · Tool
- [edb-debugger](https://awesomerea.org/resources/edb-debugger/index.md) · Tool
- [BinNavi](https://awesomerea.org/resources/binnavi/index.md) · Tool
- [flare-emu](https://awesomerea.org/resources/flare-emu/index.md) · Tool
- [IDA Pro](https://awesomerea.org/resources/ida-pro/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.