🔎
QualityPython

YARA Signatures

by dariushoule

YARA Signatures is a Quality skill for Claude Code, published by dariushoule in x64dbg-skills.

203 stars16 forkson dariushoule/x64dbg-skillsAdded 2026/09/05Repository updated 2026/03/13
View source on GitHubDownload repo ZIP
claude-codemcpskillsx64dbg
Install in seconds
Install YARA Signatures
Copy YARA Signatures into your Claude Code skills folder. Run the command in your terminal, or review the source on GitHub before installing.
terminal
npx degit https://github.com/dariushoule/x64dbg-skills/tree/main/skills/yara-sigs ~/.claude/skills/yara-sigs

Requires Node.js. Downloads this skill only — not the rest of the repository — into your Claude Code skills folder.

Without Node.js

git clone https://github.com/dariushoule/x64dbg-skills.git

Clones the whole repository, then copy the skill’s own directory into your skills folder yourself.

In this catalog

Source file
skills/yara-sigs/SKILL.md in dariushoule/x64dbg-skills
Installs to
~/.claude/skills/yara-sigs
Collection
One of 8 skills cataloged from this repository
Category
Quality — 1662 skills

What YARA Signatures does

YARA Signatures scans a state snapshot's memory dumps with YARA rules to find packers, crypto constants, anti-debug techniques, and malware-family markers. Use it when you need to classify code or inspect modules in a debuggee snapshot.

YARA Signatures is cataloged under Quality on DirSkills. YARA Signatures comes from a repository tagged claude-code, mcp, skills and x64dbg.

Documentation

README

yara-sigs

Scan debuggee memory (via a state snapshot) against a large YARA signature database to identify packers, crypto constants, anti-debug tricks, malware families, and more.

Instructions

Follow these steps exactly:

1. Check prerequisites

Run pip show yara-python via Bash. If not installed, tell the user to run pip install yara-python and stop. Run git --version via Bash. If not installed, tell the user to install Git and stop.

2. Ensure the YARA signature database is available

Check if the directory ${CLAUDE_PLUGIN_ROOT}\yarasigs exists (use dir). If it does not exist, clone it:

git clone --recurse-submodules https://github.com/x64dbg/yarasigs "${CLAUDE_PLUGIN_ROOT}\yarasigs"

This is the opening of the README. Read the full README on GitHub.

Frequently asked about YARA Signatures

  • What else does dariushoule publish alongside YARA Signatures?

    YARA Signatures is one of 8 skills that DirSkills catalogs from dariushoule/x64dbg-skills, the repository it ships in. Its siblings there include Decompile, Find OEP and Shellcode Analyzer. Each one is a separate skill with its own page in this directory, installs the same way YARA Signatures does, and is maintained by dariushoule in that same repository. The rest of the collection is listed on the dariushoule/x64dbg-skills page.

  • How does YARA Signatures compare to other Quality skills?

    YARA Signatures ranks #1508 by stars among the 1662 Quality skills in this catalog. The most-starred ones next to it are Benchmark, Benchmark Optimization Loop and API Design Patterns. DirSkills ranks by the star count of the repository each skill ships in, so that order reflects how popular those repositories are rather than any review of YARA Signatures against them. Open each page to compare what they document and how they install.

More from dariushoule/x64dbg-skills

YARA Signatures is one of 8 skills cataloged on DirSkills from dariushoule/x64dbg-skills.

See all 8 skills →
🧩
49m ago

Decompile

Decompile turns a function in a debugged binary into C-like pseudocode using angr. Use it to inspect code when you have an address, symbol, or the current instruction pointer.
Quality
20316
🧭
49m ago

Find OEP

Find OEP traces packed or protected PE executables to locate the original entry point and capture a debugger state snapshot. Use it when a binary needs unpacking, anti-debug evasion, or handoff for reconstruction and analysis.
Quality
20316
🧩
49m ago

Shellcode Analyzer

Shellcode Analyzer loads a raw shellcode blob into x64dbg for unpacking, static review, and dynamic tracing. Use it when analyzing encoded or encrypted shellcode and identifying imports, anti-debugging, or payload behavior.
Quality
20316
🧪
49m ago

State Diff

State Diff compares two debuggee snapshots and reports register and memory changes between them. Use it to see what executed, what memory was modified, and what the changes suggest.
Quality
20316
💾
49m ago

State Snapshot

State Snapshot captures all committed memory regions and the full processor state from a live debuggee for offline analysis. Use it when you need a disk snapshot of memory and registers from x64dbg.
DevOps
20316
🔎
49m ago

Tracealyzer

Tracealyzer records x64dbg execution step-by-step into or over calls for a set count or stop condition, then analyzes the instruction log. Use it to inspect control flow, loops, and key instructions during debugging.
Quality
20316

More Quality skills

YARA Signatures is one of 1662 Quality skills cataloged on DirSkills, ranked #1508 by stars among them.

Browse all Quality skills →
⏱️
3w ago

Benchmark

Benchmark measures performance baselines, detects regressions before and after PRs, and compares stack alternatives for pages, APIs, and builds.
Quality
239.8K36.4K
⏱️
3w ago

Benchmark Optimization Loop

Benchmark Optimization Loop turns vague performance goals into a bounded, measured optimization process. Use it when asked to make something faster, benchmark latency/throughput/cost, or choose the best implementation by repeated measured tests.
Quality
239.8K36.4K
🔌
3w ago

API Design Patterns

API Design Patterns provides conventions and best practices for designing consistent REST APIs. Use it when creating endpoints, reviewing contracts, handling pagination, error responses, status codes, filtering, or versioning.
Quality
239.8K36.4K