Home

Vovk - Advanced Dynamic Yara Rule Generator

What is Vovk?

Vovk is a WinDbg extension (plugin) that can be used to create Yara Rules. More on Vovk here.

What's special about Vovk?

Vovk is a dynamic analysis framework that can be used as a module with the debugger (WinDBG). Vovk consists of is a DLL (the extension), built using both WdbgExts and DbgEng frameworks and an executable (EXE) that creates the actual ruleset. Yara rules created using Vovk are based on 'dynamic' analysis, aka 'unpacked malware' as it is used as a part of the debugger. The resulting rules are very accurate and specific to the files being analysed.