# 克隆仓库
git clone https://github.com/tjnel/certgraveyard_yara.git
cd certgraveyard_yara

# 使用UV安装
uv sync --all-extras

# 从CertGraveyard下载最新CSV
cert-graveyard-yara download

# 检查CSV是否已更改
cert-graveyard-yara check-changed

# 生成YARA规则
cert-graveyard-yara generate

# 验证规则
cert-graveyard-yara validate --engine yara

# 创建合并文件和ZIP归档
cert-graveyard-yara combine
cert-graveyard-yara package

# 运行完整流程
cert-graveyard-yara run --all

# 使用合并规则集扫描
yara rules/combined/MAL_Compromised_Cert_*.yara /path/to/scan

# 或使用单个规则
yara rules/individual/*.yara /path/to/scan

cert-graveyard-yara/
├── .github/workflows/      # GitHub Actions
│   ├── daily-update.yml    # 每日CSV检查和规则生成
│   ├── ci.yml              # PR验证和测试
│   └── release.yml         # 版本发布
├── src/cert_graveyard_yara/  # 源代码
│   ├── __init__.py
│   ├── downloader.py       # CSV下载和缓存
│   ├── parser.py           # CSV解析
│   ├── generator.py        # YARA规则生成
│   ├── validator.py        # 规则验证
│   ├── changelog.py        # 更新日志管理
│   └── cli.py              # 命令行接口
├── tests/                  # 测试套件
├── rules/
│   ├── individual/         # 单个YARA规则文件
│   └── combined/           # 合并发布文件
├── data/                   # CSV数据和哈希文件
├── templates/              # Jinja2模板
└── CHANGELOG.md

import "pe"

rule MAL_Compromised_Cert_Emotet_DigiCert_0a_1b_2c_3d {
   meta:
      description         = "检测使用受损证书的恶意软件Emotet..."
      author              = "TNEL (https://github.com/tjnel/certgraveyard_yara)"
      reference           = "https://certgraveyard.org"
      
      hash                = "a1b2c3d4..."
      malware             = "Emotet"
      malware_type        = "Trojan"
      
      cert_issuer         = "DigiCert SHA2 Assured ID Code Signing CA"
      cert_serial         = "0a:1b:2c:3d"
      cert_valid_from     = "2024-01-15"
      cert_valid_to       = "2025-01-15"

   condition:
      uint16(0) == 0x5a4d and
      for any sig in pe.signatures : (
         sig.issuer contains "DigiCert SHA2 Assured ID Code Signing CA" and
         sig.serial == "0a:1b:2c:3d"
      )
}

# 安装包含开发依赖
uv sync --all-extras

# 运行代码检查
uv run ruff check src tests

# 运行类型检查
uv run mypy src

# 运行测试
uv run pytest

# 运行所有测试并带覆盖率
uv run pytest

# 运行特定测试文件
uv run pytest tests/test_generator.py

# 运行并输出详细信息
uv run pytest -v