Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Latest commit

* Fixing format of ast.go

* Modify grammar to record base of LiteralInteger

* Added Base to LiteralInteger in ProtoBuf

* Added test case for LiteralInteger base checks

* Ran flexgo & protoc

Git stats


Failed to load latest commit information.
Latest commit message
Commit time

GoDoc Go Report Card

gyp (go-yara-parser)

gyp is a Go library for parsing YARA rules. It uses the same grammar and lexer files as the original libyara to ensure that lexing and parsing work exactly like YARA. This library produces an Abstract Syntax Tree (AST) for the parsed YARA rules. Additionally, the AST can be serialized as a Protocol Buffer, which facilitate its manipulation in other programming languages.

Go Usage

The example below illustrates the usage of gyp, this a simple program that reads a YARA source file from the standard input, creates the corresponding AST, and writes the rules back to the standard output. The resulting output won't be exactly like the input, during the parsing and re-generation of the rules the text is reformatted and comments are lost.

package main

import (


func main() {
	ruleset, err := gyp.Parse(os.Stdin)
	if err != nil {
		log.Fatalf(`Error parsing rules: %v`, err)
	if err = ruleset.WriteSource(os.Stdout); err != nil {
		log.Fatalf(`Error writing rules: %v`, err)


Setup development environment (Linux)

  1. Install the required packages using your package manager (apt is assumed in the following example):
	apt update && apt install \
		automake \
		bison \
		help2man \
		m4 \
		texinfo \
  1. Install golang following the provided installation instructions.
  2. Install golang protobuf package following the provided installation instructions.
  3. Install the project dependencies:
  • go get
  • go get
  • Add the environment variable FLEXGO, pointing out to the flexgo folder in your Go workspace (e.g., $HOME/go/src/
  • cd ${FLEXGO} && ./configure && cd -
  • make -C ${FLEXGO} && make -C ${FLEXGO} install

Build project

The Makefile includes targets for quickly building the parser and lexer and the data protocol buffer, as well as the y2j and j2y command-line tools:

  • Build rulesets parser and lexer: make grammar
  • Build hex strings parser and lexer: make hexgrammar
  • Build ruleset protocol buffer: make proto
  • Build y2j tool: make y2j
  • Build j2y tool: make j2y

License and third party code

This project uses code from yara-parser by Northern-Lights, which is available under the MIT license (see LICENSES_THIRD_PARTIES).