#!/usr/bin/env python3
"""Agent for YARA rule development and testing.

Creates YARA rules from malware samples by extracting unique strings
and byte patterns, validates rules for performance, tests against
sample sets, and generates detection coverage reports.
"""

import json
import sys
import os
import hashlib
import re
from datetime import datetime
from pathlib import Path

try:
    import yara
    HAS_YARA = True
except ImportError:
    HAS_YARA = False


class YaraRuleDeveloper:
    """Develops, validates, and tests YARA rules."""

    def __init__(self, output_dir="./yara_rules"):
        self.output_dir = Path(output_dir)
        self.output_dir.mkdir(parents=True, exist_ok=True)
        self.rules = []

    def extract_strings(self, sample_path, min_length=8, max_strings=30):
        """Extract unique strings from a binary sample for rule creation."""
        with open(sample_path, "rb") as f:
            data = f.read()

        ascii_strings = re.findall(rb'[\x20-\x7E]{%d,}' % min_length, data)
        wide_strings = re.findall(
            rb'(?:[\x20-\x7E]\x00){%d,}' % min_length, data)

        unique_ascii = list(set(s.decode("ascii", errors="ignore")
                                for s in ascii_strings))
        unique_wide = list(set(s.decode("utf-16-le", errors="ignore")
                               for s in wide_strings))

        scored = []
        generic_terms = {"http", "https", "www", "com", "dll", "exe",
                         "the", "this", "that", "error", "warning"}
        for s in unique_ascii:
            score = len(s)
            if any(g in s.lower() for g in generic_terms):
                score -= 5
            if re.search(r'[A-Z][a-z]+[A-Z]', s):
                score += 3
            if "/" in s or "\\" in s:
                score += 2
            scored.append({"string": s, "type": "ascii", "score": score})

        for s in unique_wide:
            scored.append({"string": s, "type": "wide", "score": len(s) - 2})

        scored.sort(key=lambda x: x["score"], reverse=True)
        return scored[:max_strings]

    def generate_rule(self, rule_name, sample_path, description="",
                      tags=None, author="auto"):
        """Generate a YARA rule from a malware sample."""
        strings = self.extract_strings(sample_path)
        sha256 = hashlib.sha256(Path(sample_path).read_bytes()).hexdigest()

        rule_strings = []
        for i, s in enumerate(strings[:15]):
            if s["type"] == "ascii":
                rule_strings.append(f'        $s{i} = "{s["string"]}"')
            else:
                rule_strings.append(f'        $s{i} = "{s["string"]}" wide')

        tags_str = " : " + " ".join(tags) if tags else ""
        rule_text = f"""rule {rule_name}{tags_str}
{{
    meta:
        description = "{description}"
        author = "{author}"
        date = "{datetime.utcnow().strftime('%Y-%m-%d')}"
        hash = "{sha256}"

    strings:
{chr(10).join(rule_strings)}

    condition:
        uint16(0) == 0x5A4D and filesize < 10MB and 5 of ($s*)
}}
"""
        rule_path = self.output_dir / f"{rule_name}.yar"
        rule_path.write_text(rule_text)
        self.rules.append({"name": rule_name, "path": str(rule_path),
                           "strings_count": len(rule_strings)})
        return {"rule_name": rule_name, "path": str(rule_path),
                "strings": len(rule_strings), "hash": sha256}

    def validate_rule(self, rule_path):
        """Compile and validate a YARA rule for syntax and performance."""
        if not HAS_YARA:
            return {"error": "yara-python not installed"}
        try:
            yara.compile(filepath=rule_path)
            return {"valid": True, "path": rule_path}
        except yara.SyntaxError as exc:
            return {"valid": False, "error": str(exc)}

    def test_rule(self, rule_path, sample_dir):
        """Test a YARA rule against a directory of samples."""
        if not HAS_YARA:
            return {"error": "yara-python not installed"}
        try:
            compiled = yara.compile(filepath=rule_path)
        except yara.SyntaxError as exc:
            return {"error": str(exc)}

        results = {"matches": [], "no_match": [], "errors": []}
        for root, dirs, files in os.walk(sample_dir):
            for fname in files:
                fpath = os.path.join(root, fname)
                try:
                    matches = compiled.match(fpath, timeout=30)
                    if matches:
                        results["matches"].append({
                            "file": fpath, "rules": [m.rule for m in matches]})
                    else:
                        results["no_match"].append(fpath)
                except yara.Error as exc:
                    results["errors"].append({"file": fpath, "error": str(exc)})
        return results

    def generate_report(self):
        report = {
            "report_date": datetime.utcnow().isoformat(),
            "rules_created": len(self.rules),
            "rules": self.rules,
        }
        print(json.dumps(report, indent=2))
        return report


def main():
    if len(sys.argv) < 3:
        print("Usage: agent.py <rule_name> <sample_path> [test_dir]")
        sys.exit(1)
    agent = YaraRuleDeveloper()
    rule_name = sys.argv[1]
    sample = sys.argv[2]
    result = agent.generate_rule(rule_name, sample)
    validation = agent.validate_rule(result["path"])
    print(json.dumps({"rule": result, "validation": validation}, indent=2))
    if len(sys.argv) > 3:
        test_results = agent.test_rule(result["path"], sys.argv[3])
        print(json.dumps(test_results, indent=2))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
YARA Rule Development and Testing Framework

Assists in creating, testing, and optimizing YARA rules
for malware detection.

Requirements:
    pip install yara-python pefile

Usage:
    python process.py --analyze sample.exe
    python process.py --test rule.yar --samples ./malware --clean ./goodware
    python process.py --generate --name MalwareX --strings strings.txt
"""

import argparse
import json
import os
import re
import sys
import time
from collections import Counter
from pathlib import Path

try:
    import yara
except ImportError:
    print("ERROR: yara-python not installed. Run: pip install yara-python")
    sys.exit(1)

try:
    import pefile
except ImportError:
    pefile = None


class YaraRuleBuilder:
    """Build and test YARA rules."""

    def __init__(self):
        self.candidate_strings = []
        self.candidate_hex = []
        self.imports = []

    def analyze_sample(self, filepath):
        """Extract candidate patterns from a malware sample."""
        with open(filepath, 'rb') as f:
            data = f.read()

        # Extract ASCII strings (min 8 chars)
        ascii_strings = [
            s.decode('ascii')
            for s in re.findall(rb'[\x20-\x7e]{8,}', data)
        ]

        # Extract wide strings
        wide_strings = [
            s.decode('utf-16-le')
            for s in re.findall(rb'(?:[\x20-\x7e]\x00){8,}', data)
        ]

        # Score strings by uniqueness/suspiciousness
        suspicious = [
            'http', 'https', 'ftp', 'cmd.exe', 'powershell',
            'mutex', 'pipe', 'password', 'encrypt', 'decrypt',
            'inject', 'hook', 'shell', 'backdoor', 'keylog',
            'screenshot', 'clipboard', 'download', 'upload',
            'sandbox', 'vmware', 'virtualbox', 'debug',
        ]

        scored = []
        for s in ascii_strings + wide_strings:
            score = 0
            s_lower = s.lower()
            for kw in suspicious:
                if kw in s_lower:
                    score += 10
            if len(s) > 20:
                score += 5
            if re.search(r'[A-Z][a-z]+[A-Z]', s):  # CamelCase
                score += 3
            scored.append((s, score))

        scored.sort(key=lambda x: -x[1])
        self.candidate_strings = scored[:30]

        # PE imports if available
        if pefile:
            try:
                pe = pefile.PE(filepath)
                if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'):
                    for entry in pe.DIRECTORY_ENTRY_IMPORT:
                        for imp in entry.imports:
                            if imp.name:
                                self.imports.append(
                                    imp.name.decode('utf-8', errors='replace')
                                )
            except Exception:
                pass

        return {
            "total_ascii": len(ascii_strings),
            "total_wide": len(wide_strings),
            "top_candidates": [(s, sc) for s, sc in scored[:10]],
            "suspicious_imports": [
                i for i in self.imports
                if i in ['VirtualAlloc', 'VirtualAllocEx',
                         'WriteProcessMemory', 'CreateRemoteThread',
                         'NtUnmapViewOfSection', 'OpenProcess',
                         'CryptEncrypt', 'InternetOpenA']
            ],
        }

    def generate_rule(self, name, author="analyst", description=""):
        """Generate YARA rule from analyzed patterns."""
        strings_section = []
        conditions = []

        # Add top candidate strings
        for i, (s, score) in enumerate(self.candidate_strings[:8]):
            if score > 0:
                escaped = s.replace('\\', '\\\\').replace('"', '\\"')
                strings_section.append(
                    f'$str{i} = "{escaped}" ascii wide'
                )

        # Add import-based strings
        sus_imports = [
            i for i in self.imports
            if i in ['VirtualAlloc', 'VirtualAllocEx',
                     'WriteProcessMemory', 'CreateRemoteThread']
        ]
        for i, imp in enumerate(sus_imports[:4]):
            strings_section.append(f'$api{i} = "{imp}" ascii')

        # Build condition
        str_count = len([s for s in strings_section if s.startswith('$str')])
        api_count = len([s for s in strings_section if s.startswith('$api')])

        condition_parts = ['uint16(0) == 0x5A4D', 'filesize < 5MB']
        if str_count > 0:
            threshold = max(2, str_count // 2)
            condition_parts.append(f'{threshold} of ($str*)')
        if api_count > 0:
            condition_parts.append(f'{max(1, api_count - 1)} of ($api*)')

        rule = f"""rule {name} {{
    meta:
        description = "{description or f'Detects {name}'}"
        author = "{author}"
        date = "{time.strftime('%Y-%m-%d')}"
        tlp = "WHITE"

    strings:
        {chr(10) + "        ".join(strings_section)}

    condition:
        {" and ".join(condition_parts)}
}}"""
        return rule

    def test_rule(self, rule_path_or_text, sample_dir, clean_dir=None):
        """Test YARA rule for detection and false positive rates."""
        if os.path.isfile(rule_path_or_text):
            rules = yara.compile(filepath=rule_path_or_text)
        else:
            rules = yara.compile(source=rule_path_or_text)

        results = {
            "true_positives": 0,
            "false_negatives": 0,
            "false_positives": 0,
            "true_negatives": 0,
            "scan_time": 0,
            "details": [],
        }

        # Scan malware samples
        start = time.perf_counter()
        for f in Path(sample_dir).rglob('*'):
            if f.is_file():
                try:
                    matches = rules.match(str(f))
                    if matches:
                        results["true_positives"] += 1
                    else:
                        results["false_negatives"] += 1
                        results["details"].append(
                            {"file": str(f), "result": "FALSE_NEGATIVE"}
                        )
                except Exception:
                    pass

        # Scan clean files
        if clean_dir:
            for f in Path(clean_dir).rglob('*'):
                if f.is_file():
                    try:
                        matches = rules.match(str(f))
                        if matches:
                            results["false_positives"] += 1
                            results["details"].append(
                                {"file": str(f), "result": "FALSE_POSITIVE"}
                            )
                        else:
                            results["true_negatives"] += 1
                    except Exception:
                        pass

        results["scan_time"] = time.perf_counter() - start

        total_samples = results["true_positives"] + results["false_negatives"]
        if total_samples > 0:
            results["detection_rate"] = round(
                results["true_positives"] / total_samples * 100, 2
            )

        total_clean = results["false_positives"] + results["true_negatives"]
        if total_clean > 0:
            results["fp_rate"] = round(
                results["false_positives"] / total_clean * 100, 4
            )

        return results


def main():
    parser = argparse.ArgumentParser(
        description="YARA Rule Development Framework"
    )
    parser.add_argument("--analyze", help="Analyze sample for YARA patterns")
    parser.add_argument("--generate", action="store_true",
                        help="Generate rule from analysis")
    parser.add_argument("--name", default="MalwareDetection",
                        help="Rule name")
    parser.add_argument("--test", help="Test YARA rule file")
    parser.add_argument("--samples", help="Malware samples directory")
    parser.add_argument("--clean", help="Clean files directory")
    parser.add_argument("--output", help="Output rule file")

    args = parser.parse_args()
    builder = YaraRuleBuilder()

    if args.analyze:
        analysis = builder.analyze_sample(args.analyze)
        print(json.dumps(analysis, indent=2, default=str))

        if args.generate:
            rule = builder.generate_rule(args.name)
            print(f"\n{rule}")
            if args.output:
                with open(args.output, 'w') as f:
                    f.write(rule)
                print(f"[+] Rule saved to {args.output}")

    elif args.test and args.samples:
        results = builder.test_rule(args.test, args.samples, args.clean)
        print(json.dumps(results, indent=2))

    else:
        parser.print_help()


if __name__ == "__main__":
    main()