YARA-X — The Cyber Toolchain

YARA-X v1.22.0

Tue, 20 Oct 2026 13:39:16 GMT

YARA-X v1.22.0 adds 64-bit integer built-ins, pe.offset_to_rva, zip module support in yr dump, and xor_key in C/Go APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `int64`, `int64be`, `uint64`, and `uint64be` built-in functions with support for unsigned 64-bit integers and integer literals greater than `i64::MAX`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `pe.offset_to_rva` function to the `pe` module for converting file offsets to RVAs. • Exposes `xor_key` for matching patterns in the C and Go APIs. • Allows the `yr dump` command to show information from the `zip` module. • Raises warnings on implicit sign conversions that change constant values and on unary operations on unsigned integers. • Improves Language Server with `Workspace Symbols` support, better `Code Completion` documentation, auto-importing modules on non-top-level symbol completion, and `--help`/`--version` CLI flags. • Links compiler errors and warnings to their documentation pages. • Implements constant folding for integer division and modulus operations. • Keeps the width and signedness of protobuf integer fields. • Delivers performance and memory consumption improvements. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara-x

YARA-X v1.21.0

Tue, 29 Sep 2026 09:11:32 GMT

YARA-X v1.21.0 adds a debug command for atoms, stdin scan lists, Python `Scanner.set_module_output`, and broader ELF machine type coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Scanner.set_module_output` method to the Python bindings for controlling module output during scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `debug` command for showing atoms extracted from YARA-X rules. • Supports reading scan target lists from stdin, enabling pipeline-driven scanning workflows. • Expands the `elf` module to support additional ELF machine types. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara-x

YARA-X v1.20.0

Mon, 24 Aug 2026 12:32:25 GMT

YARA-X v1.20.0 adds --ignore-invalid-rules CLI flag, experimental MSI/VBA/OLECF modules, SIMD-accelerated matching, and new C/Go/Python API surfaces. • Adds `--ignore-invalid-rules` CLI option to skip rules that fail to compile without aborting a scan. • Exposes `ignore_invalid_rules` in the Python API, matching the new CLI flag. • Adds `yrx_scanner_max_matches_per_pattern` to the C API and `Scanner.MaxMatchedPerPattern` to the Go API to cap per-pattern match counts. • Adds type annotations to match and return data in the Python API. • Adds `rlib` crate types to `yara-x-capi` and `yara-x-py` to allow linking into wrapper crates. • Implements experimental `msi`, `vba`, and `olecf` modules for parsing those file formats in YARA rules. • Extends the `lnk` module to parse ShellItems and malformed sections. • Implements SIMD-accelerated masked literal matching for faster pattern scanning. • Serializes Aho-Corasick automata directly with compiled rules for faster deserialization. • Improves atom extraction heuristics and applies file size/header constraints only to regular expressions for better scan performance. • Raises a warning when patterns are unintentionally included in a set. • Improves code completion in the language server by distinguishing enums from other fields. • Adds light/dark theme support to the playground UI. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara-x

YARA-X v1.19.0

Wed, 24 Jun 2026 14:13:34 GMT

YARA-X v1.19.0 adds missing PE machine types and new compiler warnings for single-byte and duplicate patterns. • Adds missing machine architecture types to the `pe` module, expanding PE header analysis coverage. • New compiler warning when a rule defines a single-byte pattern, helping authors catch low-specificity signatures early. • New compiler warning when a rule contains duplicate patterns, surfacing redundant definitions at compile time. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara-x

YARA-X v1.18.0

Mon, 15 Jun 2026 13:27:38 GMT

YARA-X v1.18.0 adds `--cpu-limit` CLI flag and improves scan performance • Adds `--cpu-limit` option to the CLI for controlling CPU usage during scans • Improves scan performance by ignoring patterns that can't match due to file header constraints • Optimizes regular expression evaluation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara-x

YARA-X v1.17.0

Thu, 28 May 2026 06:41:21 GMT

v1.17.0 adds `--fast-scan` CLI flag and external crate modules for YARA-X • Adds `--fast-scan` CLI option to enable fast scan mode • Add support for modules developed in external crates Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara-x

YARA-X v1.14.0

Fri, 06 Mar 2026 10:19:53 GMT

Adds `deps` CLI subcommand to display rule dependencies. • Adds `deps` command to the CLI tool that shows rule dependencies Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara-x

YARA-X v1.13.0

Fri, 06 Feb 2026 17:41:32 GMT

Adds `crx` and `dex` modules to the Python invoke API • Add Python API for specifying the metadata that should be passed to modules Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara-x

YARA-X v1.11.0

Fri, 09 Jan 2026 12:35:46 GMT

YARA-X v1.11.0 adds dex module, imports() API, and stricter parsing with warnings • Adds `dex` module for scanning Android Dex files • Adds imports() method to the `Rules` object in the Python API • Adds support for parsing `LC_LAZY_LOAD_DYLIB` and `LC_LOAD_UPWARD_DYLIB` load commands in the `macho` module • Adds `permhash` functionality within the `crx` module • Adds C API console logging capability Breaking changes: • The parser is now stricter, which may cause previously accepted malformed or ambiguous YARA rules to trigger warnings or errors. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara-x

YARA-X v1.10.0

Thu, 20 Nov 2025 11:25:36 GMT

YARA-X v1.10.0 adds `yr fix warnings` command and improves WASM compilation efficiency. • Adds the `yr fix warnings` subcommand to automatically correct rule warnings • Generates more efficient WASM code for certain expressions, reducing compiled rule size • Improves the AST traversal API to support Depth-First Search (DFS) order Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara-x

YARA-X v1.9.0

Mon, 03 Nov 2025 12:10:30 GMT

YARA-X v1.9.0 adds C/Go file-scan functions, Rust version API, and ELF osabi field. • Add function for scanning files by path to the C and Go APIs • Add version number to the Rust API • Add `osabi` field to `elf` module Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara-x

YARA-X v1.8.0

Mon, 06 Oct 2025 10:19:44 GMT

YARA-X v1.8.0 adds block scanning API and typed global variable APIs for Rust, C, Go, and Python. • `Implement block scanning API for Rust and C` • `Implement Golang and C APIs for setting global variables of type array and structure` • `Add iterator for Rules object in Python` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara-x

YARA-X v1.7.0

Wed, 17 Sep 2025 10:51:31 GMT

YARA-X v1.7.0 adds Python/CLI match limits, C API library management functions • Adds `--max-matches-per-pattern` CLI flag and `max_matches_per_pattern` Python method to limit matches per pattern. • Adds `yrx_finalize` function to the C API to dynamically unload the YARA-X library. • Adds `yrx_compiler_add_include_dir` function to the C API for compiler include directory management. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara-x

YARA-X v1.6.0

Fri, 05 Sep 2025 08:13:01 GMT

YARA-X v1.6.0 adds `--no-mmap`, relative includes, dict globals in Python API, and regex metadata validation • Adds `--no-mmap` CLI flag to disable memory-mapped file access for scanning. • Supports relative paths in YARA rule `include` directives. • Enables regular expression validation of rule metadata fields. • Adds global variables of type `dict` support in the Python API. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara-x

YARA-X v1.5.0

Fri, 08 Aug 2025 09:55:06 GMT

YARA-X v1.5.0 adds `crx` module for Chrome Extensions, API include dirs, symhash support, and boolean console logs • Introduces the `crx` module for parsing Chrome Extension files • Allows specifying include directories in the C, Go and Python APIs • Adopts Anomali's symhash algorithm for Mach-O file parsing • Supports boolean type in console.log() Breaking changes: • Returns an error for rules that can have arbitrarily long prefixes Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara-x

YARA-X v1.4.0

Thu, 10 Jul 2025 07:44:10 GMT

YARA-X v1.4.0 adds warning suppression via comments and built-in float parsing functions • Add `// suppress: warning_id` comment syntax to suppress YARA-X warnings during rule compilation • Add built-in functions `float32`, `float64`, `float32be`, and `float64be` for parsing floating-point values in rules Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara-x

YARA-X v1.3.0

Wed, 02 Jul 2025 10:23:19 GMT

YARA-X v1.3.0 adds private pattern support and span info to events • Adds `private` patterns which are now accepted instead of being silently ignored • Adds span information to `Event::Begin` and `Event::End` for more precise rule matching context Breaking changes: • The C API constants now require the `YRX_` prefix, which may break existing code that referenced them without the prefix Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara-x

YARA-X v1.2.0

Wed, 18 Jun 2025 09:59:25 GMT

YARA-X v1.2.0 adds configuration file support to disable specific warnings via the [warnings] section. • Allow disabling specific warnings via the configuration file Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara-x

YARA-X v0.15.0

Mon, 19 May 2025 16:22:42 GMT

YARA-X v0.15.0 adds include statements to rules and Python API invoke module support • Adds `include` statements to YARA rule files for modular rule composition Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara-x

YARA-X v0.14.0

Fri, 28 Mar 2025 11:46:36 GMT

v0.14.0 adds Mach-O chained fixups, 32-bit support, multi-line regex anchors, vt module OSS, and tag linter • Adds support for parsing `LC_DYLD_EXPORTS_TRIE` in Mach-O files • Adds parsing for `LC_DYLD_CHAINED_FIXUPS` (chained fixup imports) in Mach-O files • Enables the tag linter via a new implementation • Supports regex anchors `^` and `$` in multi-line mode • Adds support for 32-bit targets • Open-sources the `vt` module Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara-x

YARA-X v0.13.0

Mon, 03 Feb 2025 16:10:20 GMT

YARA-X v0.13.0 introduces `yara check` for rule linting and expands YARA language capabilities. • Adds the `check` subcommand to provide basic linting for YARA rules • Enables referencing previously defined variables within `with` statements in YARA rules Breaking changes: • The format of JSON output has been refactored, which may break parsers expecting the previous structure Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara-x

YARA-X v0.12.0

Tue, 17 Dec 2024 20:10:27 GMT

YARA-X v0.12.0 adds LC_LINKER_OPTION parsing and more SpcSpOpusInfo extraction • `macho` module now parses and exposes `LC_LINKER_OPTION` commands • Extracts more information from the `SpcSpOpusInfo` structure contained in PE signatures Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara-x

YARA-X v0.11.0

Tue, 26 Nov 2024 11:38:03 GMT

YARA-X v0.11.0 adds JSON output, `--profiling` flag, and new YARA functions. • Adds JSON as a new output format for scan results • Adds the `--profiling` option to the `scan` command • Implements sym_hash() function for the `macho` module • Allows larger jumps in hex patterns Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara-x

YARA-X v0.8.0

Mon, 09 Sep 2024 15:24:48 GMT

v0.8.0 adds `fmt` command, `--module-data`, and `cuckoo` module support • Implements the new `fmt` subcommand to automatically format YARA source code • Adds `--module-data ` option to the `scan` command to load external module data • Adds `--ignore-module ` option to `scan` and `compile` commands to disable specific modules Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara-x

YARA-X v0.7.0

Wed, 28 Aug 2024 11:00:25 GMT

YARA-X v0.7.0 adds --print-meta, tag filtering via --tag/--print-tags, and --count to the scan CLI • Adds `--print-meta` option to `scan` command for printing metadata in output • Adds `--tag` and `--print-tags` options to `scan` command for filtering matches by tag and printing matched tags • Adds `--count` option to `scan` command to report the count of matching rules • Allows specifying source origin in Golang, Python, and C APIs • Redesigned API to expose more details about compiler errors and warnings Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara-x

YARA-X v0.6.0

Wed, 31 Jul 2024 06:33:28 GMT

YARA-X v0.6.0 adds NDJSON output for the scan command • Scan command can now produce ndjson output Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara-x

YARA-X v0.5.0

Mon, 01 Jul 2024 07:19:27 GMT

YARA-X v0.5.0 adds Mach-O export parsing with `export_hash` and `--disable-warnings` flag • Adds `export_hash` function to the `macho` module for parsing Mach-O exports • Adds `--disable-warnings` option to suppress specific warnings using identifiers like `slow_patterns` or `duplicate_import` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara-x

YARA-X v0.4.0

Wed, 29 May 2024 11:58:01 GMT

YARA-X v0.4.0 adds --scan-list and --output flags, non-global rule inclusion, metadata APIs, and Mach-O hashing. • `--scan-list` option added to the `scan` command to process files from a list • `--output` option added to the `compile` command to specify compilation output destination • Non-global rules can now be imported into global rules • New APIs for accessing rule metadata are implemented in the public interface • The `macho` module now supports dylib and entitlement hashing Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yara-x