Tool

YaraVM

YaraVM is an IDA Pro loader and processor module for compiled YARA rules. It loads the rule bytecode and the regex bytecode so they can be disassembled in IDA.

Targets: Binary
Category: Native analysis tools
Relationship: Foundation tool
Sources reviewed: 2026-11-07

Stars: 53
Last commit: 2024-12-31
Language: Python

GitHub data as of 2026-11-09

Copy as Markdown View JSON Cite

Requirements & limits

Copy yara_loader.py into the IDA loaders directory, yara_proc.py into the procs directory, and libyara.til into the til directory.
The README names no license.

Cite

BibTeX

@misc{yaravm,
  title = {{YaraVM}},
  howpublished = {\url{https://github.com/milankovo/YaraVM}},
  url = {https://github.com/milankovo/YaraVM},
  urldate = {2026-11-07},
  note = {Awesome REA entry: \url{https://awesomerea.org/resources/yaravm/}}
}

Plain text

YaraVM. https://github.com/milankovo/YaraVM (accessed 2026-11-07). Awesome REA entry: https://awesomerea.org/resources/yaravm/

Useful? Star Awesome REA on GitHub2.4k

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

README.md GitHub · milankovo/YaraVM · Revision 3b4e357

More in Native binaries

All 502 entries in Native binaries