How does it handle anti-debugging techniques?

The skill includes a specific category for anti-debug and anti-VM signatures, helping you identify if the software is trying to detect your analysis environment.

What are the prerequisites for using this skill?

You must have yara-python and Git installed on your system, as the skill uses these to process rules and manage the signature database.

Where does it get the YARA rules from?

The skill automatically clones and maintains the official x64dbg/yarasigs repository, which contains a collection of community-standard rules.

What does the yara-sigs skill actually scan?

It scans memory dumps from state snapshots taken during an active x64dbg debugging session against a large database of YARA rules.

Can I target a specific module instead of the whole memory?

Yes, you can use the module filter option to focus the scan on a specific executable or DLL, which helps in detecting patterns that span across different sections.

YARA Signature Scanner for x64dbg

Name: YARA Signature Scanner for x64dbg
Author: dariushoule

bydariushoule

•

Security & Testing

Analyzes x64dbg memory snapshots using YARA signatures to identify malware patterns, packers, and cryptographic constants.

This skill integrates YARA signature scanning into the x64dbg automation workflow, allowing developers and security researchers to identify hidden characteristics within a debuggee's memory. By scanning memory snapshots against a comprehensive database of rules, it can pinpoint specific packers, compiler artifacts, cryptographic algorithms, and sophisticated anti-debugging or anti-VM techniques. This is particularly useful during reverse engineering and malware analysis to quickly orient the researcher and reveal the underlying nature of obfuscated or malicious binaries.

Key Features

01Targeted module filtering to detect patterns spanning multiple memory sections

02Automated YARA rule database management and submodule updates

03Detailed reporting of matches including base addresses and metadata

04Detection of common packers, compilers, and obfuscation tools

05Identification of cryptographic constants for AES, RSA, MD5, and more

0657 GitHub stars

Use Cases

01Identifying malware families and malicious patterns during live debugging

02Locating cryptographic implementations within an unknown binary's memory

03Detecting anti-analysis and anti-debugging tricks used by protected software

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add dariushoule/x64dbg-skills yara-sigs

For use in Claude.ai and ChatGPT

Download Skill