YARA rule linter & formatter

Paste rules to check them against common performance and hygiene heuristics, alongside YARA-X's own errors and warnings. Heuristics are rules of thumb: a finding is a prompt to look, not a verdict.

Heuristics (Heuristic)

1 rules · 6 warnings · 2 hints

hint · bad_example · line 1, column 1
Missing meta: description, author, date, reference. Good metadata makes rules maintainable and shareable.
warning · bad_example · line 4, column 1
$a is shorter than 4 bytes: it yields a weak atom and slows every scan. Make it longer or combine it with a stronger string.
warning · bad_example · line 5, column 1
$h has no run of 2 fixed bytes: YARA cannot pick a good atom. Anchor it with fixed bytes.
hint · bad_example · line 5, column 1
$h starts with a wildcard, jump or alternation: start with fixed bytes where possible.
warning · bad_example · line 6, column 1
$r starts with .* or similar: this is slow and unnecessary (regexes are not anchored).
warning · bad_example · line 7, column 1
$x is shorter than 4 bytes: it yields a weak atom and slows every scan. Make it longer or combine it with a stronger string.
warning · bad_example · line 7, column 1
$x is short and uses xor/base64: these modifiers expand into many variants; short strings then match noise and cost time.
warning · bad_example · line 9, column 1
Hashing or entropy over the whole file (0, filesize) is expensive: guard it with filesize and cheaper conditions first.

YARA-X diagnostics

No findings.