{"id":24246,"library":"plyara","title":"plyara","description":"plyara is a YARA rule parser that takes YARA rule text and returns a dictionary with metadata, strings, conditions, and other components. Current version 2.2.8, supports Python >=3.10. Released on an as-needed basis for bugfixes and minor improvements.","status":"active","version":"2.2.8","language":"python","source_language":"en","source_url":"https://github.com/plyara/plyara","tags":["yara","parser","malware","rules","security"],"install":[{"cmd":"pip install plyara","lang":"bash","label":"Standard install"}],"dependencies":[],"imports":[{"note":"Direct import of the main class","symbol":"plyara","correct":"from plyara import plyara"},{"note":"Convenience functions for quick parsing","symbol":"parse_source","correct":"from plyara import parse_source, is_yara_rule"}],"quickstart":{"code":"from plyara import plyara\n\nparser = plyara()\nyara_rules = '''\nrule ExampleRule\n{\n    strings:\n        $my_text_string = \"text here\"\n        $my_hex_string = { E2 34 A1 C8 23 FB }\n\n    condition:\n        $my_text_string or $my_hex_string\n}'''\nparsed = parser.parse_string(yara_rules)\nprint(parsed[0]['rule_name'])\nprint(parsed[0]['strings'])","lang":"python","description":"Parse a YARA rule string into a dictionary of rule components."},"warnings":[{"fix":"If you rely on the exact hash output, use `parser.store_logic_hash_versions = True` before parsing.","message":"Version 2.2.2 changed how logic hashes are computed. Old behavior (without version and algorithm names) is no longer default. Set `plyara_obj.store_logic_hash_versions = True` to retain old behavior.","severity":"breaking","affected_versions":">=2.2.2"},{"fix":"Upgrade to >=2.2.5 or ensure your rules don't have trailing comments between rule blocks.","message":"Comments between rules are now properly discarded (since 2.2.5). Previously they could be attached to the next rule, causing unexpected metadata or comment fields.","severity":"gotcha","affected_versions":"<2.2.5"},{"fix":"Use version >=2.2.1 if you need to set `store_raw_sections=False`.","message":"The `store_raw_sections` parameter defaults to `True`, but when set to `False` there was a bug in 2.2.0 causing an exception. Fixed in 2.2.1.","severity":"deprecated","affected_versions":"2.2.0"}],"env_vars":null,"last_verified":"2026-05-01T00:00:00.000Z","next_check":"2026-07-30T00:00:00.000Z","problems":[{"fix":"Run `pip install plyara` and import using `from plyara import plyara`.","cause":"The package is not installed or the import path is wrong.","error":"ModuleNotFoundError: No module named 'plyara'"},{"fix":"Remove the cache argument. plyara does not support caching out of the box.","cause":"Trying to pass 'cache' argument to plyara() constructor, which doesn't exist.","error":"TypeError: __init__() got an unexpected keyword argument 'cache'"},{"fix":"Double-check your YARA rule for syntax errors. plyara follows YARA 4.x syntax but may not support all new operators (like 'xor' modifiers on hex strings were added in later versions).","cause":"Invalid YARA syntax or unsupported rule features.","error":"plyara.core.ParseException: Failed to parse YARA rule: syntax error at line ..."}],"ecosystem":"pypi","meta_description":null,"install_score":null,"install_tag":null,"quickstart_score":null,"quickstart_tag":null}