Test a rule against a sample#

The Tests view inside the YARA editor lets you check what a rule does against arbitrary text or hex bytes, without scanning a file. It is the fastest way to iterate on a rule's strings and condition.

Switch to the Tests view#

Inside the editor, click the TESTS toggle in the header bar. The source view collapses and the Tests panel slides up. Click EDITOR to go back.

Test inputs#

The Test inputs card has two ways to feed a sample.

• Sample text: a free-text field. Type or paste any text. The card head shows the character count.
• Hex bytes: paste hex from another tool into the same field. The field detects bytes by their format and shows the parsed sequence underneath with a length, for example 16 bytes. These bytes feed the rule the same way the file's bytes do.

A Run sample button runs every rule in the open pack against the sample.

The Results card#

The Results card summarises the run.

• Matched is Yes or No.
• Rules matched is the count of rules that fired.
• Rules total is the count of rules in the pack.
• String hits is the total count of individual string hits across all rules.
• Execution is how long the run took, in milliseconds.

Rule breakdown#

The Rule breakdown card lists every rule in the pack with its match status.

• A green MATCHED badge means the rule fired. The hit count gives the number of string variables that hit.
• A grey NO MATCH badge with 0 hits means the rule did not fire.

Click a row to expand it. The expanded row shows every string variable in the rule and which ones hit. Each variable has a leading $, with a binary or text icon and a hit count on the right. Use this view to see which string in your rule does the work, and which strings are dead weight.