SAFE 是一款用于创建二进制函数嵌入的工具，由 Massarelli L.、Di Luna G.A.、Petroni F.、Querzoni L. 和 Baldoni R. 开发。您可以使用 SAFE 创建自己的函数嵌入，并将其应用于 yara 规则中。
如果您有兴趣，请查看我们的研究论文：https://arxiv.org/abs/1811.05296
如果您在研究中使用本工具，请引用：
@inproceedings{massarelli2018safe,
title={SAFE: Self-Attentive Function Embeddings for Binary Similarity},
author={Massarelli, Luca and Di Luna, Giuseppe Antonio and Petroni, Fabio and Querzoni, Leonardo and Baldoni, Roberto},
booktitle={Proceedings of 16th Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA)},
year={2019}
}
这不是用于重现论文实验的代码。如果您对此感兴趣，请查看：https://github.com/gadiluna/SAFE
如果您更喜欢使用 PyTorch，请查看 SAFEtorch：https://github.com/facebookresearch/SAFEtorch
使用 yarasafe，您可以轻松地为二进制函数创建签名，而无需查看汇编代码！您只需安装本仓库 IDA Pro Plugin 文件夹中的 IDA Pro 插件即可。
安装插件后，您就可以开始为您想要匹配的函数创建嵌入。这些嵌入可以插入 yara 规则中，用于通过 yara 匹配函数。为了创建强大的规则，您可以将多个函数的嵌入与标准 yara 规则结合起来。
在本仓库中，您将找到 IDA Pro 的插件以及 yarasafe 模块。
Yarasafe 可以匹配指令数大于 50 且小于 150 的函数。
首先，安装 IDA Pro 插件。您可以在本仓库的 ida-pro-plugin 文件夹中找到安装说明。然后，您可以使用我们的 Docker 容器，或者自行编译带有 yarasafe 模块的 yara。
使用 yarasafe 最快的方法是使用我们的 Docker 容器。
拉取镜像：
docker pull massarelli/yarasafe启动 Docker，挂载包含规则和待分析文件的目录：
docker run -v {FOLDER_TO_MOUNT}:/home/yarasafe/test -it massarelli/yarasafe bash在 Docker 中使用您的规则启动 yara！
git clone https://github.com/lucamassarelli/yarasafe.git
sudo apt-get install automake libtool make gcc flex bison
sudo apt-get install libjansson-dev
git clone https://github.com/radare/radare2.git
cd radare2
./sys/install.sh
cd yarasafe/python_script
pip3 install -r requirements.txt
./bootstrap.sh
./configure
make
export YARAPYSCRIPT={PATH_TO_YARASAFE_REPO}/python_script
git clone https://github.com/lucamassarelli/yarasafe.git
brew install automake libtool flex bison
brew install jansson
git clone https://github.com/radare/radare2.git
cd radare2
./sys/install.sh
cd yarasafe/python_script
pip3 install -r requirements.txt
./bootstrap.sh
./configure.sh
make
export YARAPYSCRIPT={PATH_TO_YARASAFE_REPO}/python_script
在 rules 文件夹中，您可以找到规则文件 sample_safe_rule.yar。该规则应对任何 PE 文件触发：
yara {PATH_TO_YARASAFE_REPO}/rules/sample_safe_rule.yar {FILES}
要创建您自己的 safe-yara 规则，首先需要为您的函数创建嵌入。为此，您可以使用本仓库提供的 IDA Pro 插件。在 ida-pro-plugin 文件夹中，您可以找到如何运行插件的所有信息！
一旦获得了函数的嵌入，您只需创建规则即可。safe-yara 规则的示例：
import "safe"
rule example
{
meta:
description = "This is just an example"
threat_level = 3
in_the_wild = true
condition:
safe.similarity("[-0.02724416,0.00640265,0.01138294,-0.07013566,0.00306808,-0.09757628,0.10414989,-0.13555837,-0.07873314,-0.00725415,-0.01418876,-0.05907412,-0.12452127,0.06237456,0.02260636,-0.06013175,0.11689295,-0.00200026,-0.03594812,0.07857288,-0.00288544,0.01148411,0.00891006,0.04702956,0.1205316,0.0079077,-0.07449158,0.00653283,0.15414064,0.13021031,0.01325423,-0.35491243,-0.00992016,-0.21460094,0.0558461,-0.07761839,-0.10909985,-0.05616508,0.01800609,0.06736821,0.00308393,0.04241242,-0.08351246,0.13501632,-0.10729794,-0.10229874,0.00066896,-0.01963937,0.05516102,-0.01612499,-0.09743191,-0.0314435,-0.01470971,-0.00125769,-0.01774654,0.2332938,0.14166495,0.16998142,-0.04843156,-0.08931472,0.13102795,0.14147657,0.02275739,-0.04335862,0.05724025,0.03936686,-0.10526938,-0.11637416,-0.0112917,0.05484914,-0.06934103,0.2543144,-0.17833991,-0.00828893,0.00174531,-0.03048271,-0.04773486,0.095866,-0.14434388,0.11433239,-0.10749247,0.03952292,0.03988512,-0.11541581,-0.07812429,-0.04978319,0.32052052,-0.0497911,-0.13022986,0.02477266,-0.05968329,0.01724695,0.01577485,-0.0497415,0.24494685,0.00361651,-0.08172874,-0.07473877,-0.01046288,0.02298573]") > 0.95
}
如果样本中至少存在一个函数与目标的相似度大于 0.95，则该规则将被满足。
如果您想将 safe 添加到您的 yara 仓库中：
安装所有依赖
将文件 libyara/modules/safe.c 复制到 your_rep/libyara/modules/safe.c
将文件夹 libyara/include/python 复制到 your_rep/libyara/include
在 libyara/modules/module_list 末尾添加 ` MODULE(safe)
修改 libyara/Makefile.am：
libyara_la_LDFLAGS = -version-number 3:8:1
libyara_la_LDFLAGS += -LPATH_TO_PYTHON3.*_LIB -lpython3.*m -ljansson
编译！