Tree-sitter-yara

This is a treesitter grammar for yara rules. There may not be a lot of them out there (I could only find one)

It includes the standard normal treesitter structure and some queries, local and injections for syntax highlighting. It also includes zig source for parsing yara rules that leverages the zig treesitter bindings. In case you want to only use the parser and don't give a f about syntax highlighting, you can download the binary from the releases page or build it yourself.

🔌 Install and use in neovim

Ensure you have nvim-treesitter installed.

1. Add the following in your config file:

local treesitter = require("nvim-treesitter.configs")
local parser_config = require("nvim-treesitter.parsers").get_parser_configs()

parser_config.yara = {
  install_info = {
    url = "https://github.com/pop-ecx/tree-sitter-yara", -- or a local directory if you downloaded the zipped project from github
    files = { "src/parser.c" },
    generate_requires_npm = false,
    requires_generate_from_grammar = false,
  },
  filetype = "yara",
}

vim.filetype.add({
  extension = {
    yara = "yara",
    yar = "yara",
  }
})

2. Run TSInstall yara. This will install the parser but you will not get syntax highlighting yet.

3. Next run :TSEditQuery highlights yara. It will open a file. Paste the following in:

(rule_declaration) @keyword
(meta_section) @keyword
(strings_section) @keyword
(condition_section) @keyword

; Keywords and operators (unnamed literals)
"rule" @keyword
"meta" @keyword
"strings" @keyword
"condition" @keyword
"or" @keyword.operator
"and" @keyword.operator
"not" @keyword.operator
"of" @keyword
"at" @keyword
"in" @keyword

; String modifiers (unnamed literals, applied to string_modifier nodes)
(string_modifier
["nocase" "ascii" "wide" "fullword" "private"] @keyword.modifier
)

; Identifiers
(identifier) @variable
(string_identifier) @variable.builtin

;comments
(comment) @comment

; Literals
(string_literal) @string
(hex_string) @string.special
(hex_literal) @string.special
(number) @number
(boolean) @boolean

; Punctuation
"=" @operator
":" @punctuation.delimiter
"{" @punctuation.bracket
"}" @punctuation.bracket
"(" @punctuation.bracket
")" @punctuation.bracket
".." @punctuation.delimiter

4. Finally run :TSEditQuery injections yara and paste the following in and reload neovim:

(text_string
(string_literal) @injection.content
(#match? @injection.content "^/.*[^\\\\]/\\w*$")
(#set! injection.language "regex")
(#set! injection.combined))

Use in vscode

I don't know what happens in vscode

Use in helix

Helix deez nuts

🔧 Build

To build make sure you have zig 0.14.0 installed and in your path.

1. clone the repo.

Run the following:

• Zig build

⚡ Usage

Assuming you don't care for syntax highlighting, you just want to see your yara rule syntax tree, you can use the standalone parser.

To use the standalone parser, run:

yara-parser <yarafile>

Get the standalone parser from the releases page.

ToDo

• fix yara comments in grammar.js
• Tweak zig yara-parser to format tree appropriately
• Folds, indent?