Merge branch 'master' of https://github.com/wolfvan/YaraRET

README.md

@@ -1,16 +1,7 @@
-```
-██╗   ██╗ █████╗ ██████╗  █████╗ ██████╗ ███████╗████████╗
-╚██╗ ██╔╝██╔══██╗██╔══██╗██╔══██╗██╔══██╗██╔════╝╚══██╔══╝
- ╚████╔╝ ███████║██████╔╝███████║██████╔╝█████╗     ██║   
-  ╚██╔╝  ██╔══██║██╔══██╗██╔══██║██╔══██╗██╔══╝     ██║   
-   ██║   ██║  ██║██║  ██║██║  ██║██║  ██║███████╗   ██║   
-   ╚═╝   ╚═╝  ╚═╝╚═╝  ╚═╝╚═╝  ╚═╝╚═╝  ╚═╝╚══════╝   ╚═╝
-```
 
+# YaraRET
 
-
-
-#Introduction
+# Introduction
 
 YaraRET is a carving tool based in Radare2 and Yara and written in Go. It provides 58 magic number's yara rules for detecting 58 types of files.
 
@@ -29,7 +20,7 @@ For a compiled bin, you can download last release from Github.
 
 Also, you can  download git repo and build it.
 
-######Dependencies
+####Dependencies
 
 Yara
 Radare2
@@ -87,6 +78,7 @@ For a complex analysis, YaraRET provides a shell mode which allows an analysis a
 
  This tool was introduced in this talk at r2con 2018
  https://www.youtube.com/watch?v=trLVw9J-mfw
+
  https://github.com/radareorg/r2con2018/blob/master/talks/08-YaraRET/NotAnotherRET.pdf
 
- The command reference it's at 
+ The command reference it's at 

docs/index.md

@@ -0,0 +1,85 @@
+
+
+
+
+
+#Introduction
+
+YaraRET is a carving tool based in Radare2 and Yara and written in Go. It provides 58 magic number's yara rules for detecting 58 types of files.
+
+This tool is based on the idea of a first stage detecting files using its magic numbers and a second stage, selecting or discarding those detected files using Yara, IoC or its entropy value.
+ After that, it is able to generate the hash, the ssdeep (and check it over anothers).
+ Also provides an integration with VirusTotal.
+
+
+In order to deal with forensics cases based on weak clues, YaraRET provides different modes for raw disk handling.
+
+
+
+#Install
+
+For a compiled bin, you can download last release from Github.
+
+Also, you can  download git repo and build it.
+
+######Dependencies
+
+Yara
+Radare2
+
+	github.com/abiosoft/ishell
+	github.com/docopt/docopt-go
+	github.com/glaslos/ssdeep
+	github.com/hillu/go-yara
+	github.com/radare/r2pipe-go
+	github.com/williballenthin/govt
+
+
+
+
+
+# Usage
+
+YaraRET provides diferent modes for handling different forensics cases. 
+
+ If you are interested in get a file from a yara rule, you can execute the following command:
+
+
+
+	$  ./yaraRET yara myYaraRule rawdisk myRaw maxsize 3000 
+
+
+
+If you are interested in get a file from an IoC like a domain or hash from any kind of file like STIX or txt
+
+	$ ./yaraRET ioc ./myIOC.stix rawdisk myRaw maxsize 3000
+
+
+
+
+For a complex analysis, YaraRET provides a shell mode which allows an analysis at the tool's opening 
+
+	$  ./yaraRET rawdisk myRaw shell 
+
+
+	>> start all
+	>> set pe
+	>> show -
+
+
+# Features
+
+- Radare2 integration
+- SSdeep distance checking
+- VirusTotal API integration
+- Scripting
+- YaraForensics Ruleset
+- Entropy
+- Boot Sector analysis
+
+
+ This tool was introduced in this talk at r2con 2018
+ https://www.youtube.com/watch?v=trLVw9J-mfw
+ https://github.com/radareorg/r2con2018/blob/master/talks/08-YaraRET/NotAnotherRET.pdf
+
+ The command reference it's at