Renaming .yara files to .yar (#24)

11 files changed, 25 insertions, 25 deletions

diff --git a/Makefile b/Makefile
index ddf79b7..b66e1db 100644
--- a/Makefile
+++ b/Makefile
@@ -10,16 +10,16 @@ clean:
 
 extract:
         cp -r debian php-malware-finder
-        git checkout php-malware-finder/common.yara
-        git checkout php-malware-finder/php.yara
-        git checkout php-malware-finder/asp.yara
+        git checkout php-malware-finder/common.yar
+        git checkout php-malware-finder/php.yar
+        git checkout php-malware-finder/asp.yar
 
 set_distribution:
         sed -e "s/##version/${DEBVER}/" -i php-malware-finder/debian/control php-malware-finder/debian/changelog
 
 check_distribution:
 ifeq ($(DEBVER),6)
-                sed -e '/too_many_chr/d'  -e '/b64_concat/d' -e 's/^import.*//g' -e 's/^include.*//g' -e 's/and\ not\ IsWhitelisted//g' -i php-malware-finder/common.yara
+                sed -e '/too_many_chr/d'  -e '/b64_concat/d' -e 's/^import.*//g' -e 's/^include.*//g' -e 's/and\ not\ IsWhitelisted//g' -i php-malware-finder/common.yar
 endif
 
 package: clean extract set_distribution check_distribution
diff --git a/README.md b/README.md
index 7ed97d3..0cb901a 100644
--- a/README.md
+++ b/README.md
@@ -47,7 +47,7 @@ both) category, and should re-read the previous sentence.
 ## How does it work?
 
 Detection is performed by crawling the filesystem and testing files against a
-[set]( https://github.com/nbs-system/php-malware-finder/blob/master/php.yara )
+[set]( https://github.com/nbs-system/php-malware-finder/blob/master/php.yar )
 of [YARA](https://plusvic.github.io/yara/) rules. Yes, it's that simple!
 
 
@@ -67,8 +67,8 @@ Usage phpmalwarefinder [-cfhtv] [-l (php|asp)] <file|folder> ...
 Or if you prefer to use `yara`:
 
 ```
-$ yara -r ./php.yara /var/www
-$ yara -r ./asp.yara /var/www
+$ yara -r ./php.yar /var/www
+$ yara -r ./asp.yar /var/www
 ```
 
 Please keep in mind that you should use at least YARA 3.4 because we're using
@@ -79,7 +79,7 @@ Ho, and by the way, you can run the comprehensive testsuite with `make test`.
 
 ## Whitelisting
 
-Check the [whitelist.yara]( https://github.com/nbs-system/php-malware-finder/blob/master/whitelist.yara ) file.
+Check the [whitelist.yar]( https://github.com/nbs-system/php-malware-finder/blob/master/whitelist.yar ) file.
 If you're lazy, you can generate whitelists for entire folders with the
 [generate_whitelist.py]( https://github.com/nbs-system/php-malware-finder/blob/master/generate_whitelist.py ) script.
 
diff --git a/debian/nbs-phpmalwarefinder.install b/debian/nbs-phpmalwarefinder.install
index 676b4aa..fb5e89a 100644
--- a/debian/nbs-phpmalwarefinder.install
+++ b/debian/nbs-phpmalwarefinder.install
@@ -1,6 +1,6 @@
-common.yara etc/phpmalwarefinder
-php.yara etc/phpmalwarefinder
-asp.yara etc/phpmalwarefinder
-whitelist.yara etc/phpmalwarefinder
+common.yar etc/phpmalwarefinder
+php.yar etc/phpmalwarefinder
+asp.yar etc/phpmalwarefinder
+whitelist.yar etc/phpmalwarefinder
 phpmalwarefinder usr/bin/
 docroot-check.sh usr/bin/
diff --git a/php-malware-finder/asp.yara b/php-malware-finder/asp.yar
index 26483a1..6af74fb 100644
--- a/php-malware-finder/asp.yara
+++ b/php-malware-finder/asp.yar
@@ -1,6 +1,6 @@
 import "hash"
-include "whitelist.yara"
-include "common.yara"
+include "whitelist.yar"
+include "common.yar"
 
 global private rule IsAsp
 {
diff --git a/php-malware-finder/bad_php.yara b/php-malware-finder/bad_php.yar
index 1fb185f..1fb185f 100644
--- a/php-malware-finder/bad_php.yara
+++ b/php-malware-finder/bad_php.yar
diff --git a/php-malware-finder/common.yara b/php-malware-finder/common.yar
index 38b6726..38b6726 100644
--- a/php-malware-finder/common.yara
+++ b/php-malware-finder/common.yar
diff --git a/php-malware-finder/docroot-check.sh b/php-malware-finder/docroot-check.sh
index fa67a11..11aa4f9 100644
--- a/php-malware-finder/docroot-check.sh
+++ b/php-malware-finder/docroot-check.sh
@@ -2,7 +2,7 @@
 
 PATH=/usr/bin:/bin:/sbin:/usr/sbin
 apache_confdir="/etc/apache2/sites-available"
-pmf_conf="/etc/phpmalwarefinder/php.yara"
+pmf_conf="/etc/phpmalwarefinder/php.yar"
 pmf_cachedir="/tmp"
 
 # grab the different document roots to scan each and everyone of them
diff --git a/php-malware-finder/generate_whitelist.py b/php-malware-finder/generate_whitelist.py
index ca9fa2d..4a8a6c5 100644
--- a/php-malware-finder/generate_whitelist.py
+++ b/php-malware-finder/generate_whitelist.py
@@ -19,7 +19,7 @@ if not os.path.isdir(sys.argv[2]):
     print '%s is not a folder !' % sys.argv[2]
     sys.exit(1)
 
-rules = yara.compile('./php.yara', includes=True, error_on_warning=True)
+rules = yara.compile('./php.yar', includes=True, error_on_warning=True)
 
 output_list = list()
 
diff --git a/php-malware-finder/php.yara b/php-malware-finder/php.yar
index 1370543..06e1827 100644
--- a/php-malware-finder/php.yara
+++ b/php-malware-finder/php.yar
@@ -1,6 +1,6 @@
 import "hash"
-include "whitelist.yara"
-include "common.yara"
+include "whitelist.yar"
+include "common.yar"
 
 /*
     Detect:
diff --git a/php-malware-finder/phpmalwarefinder b/php-malware-finder/phpmalwarefinder
index db87349..1f8073f 100755
--- a/php-malware-finder/phpmalwarefinder
+++ b/php-malware-finder/phpmalwarefinder
@@ -2,7 +2,7 @@
 
 
 YARA=$(type -P yara)
-CONFIG_PATH='/etc/phpmalwarefinder/common.yara'
+CONFIG_PATH='/etc/phpmalwarefinder/common.yar'
 IONICE_BIN=$(type -P ionice)
 NICE_BIN=$(type -P nice)
 FORMAT="php"
@@ -20,10 +20,10 @@ fi
 if [ ! -f "$CONFIG_PATH" ]
 then
     OLD_PATH=$CONFIG_PATH
-    CONFIG_PATH='./common.yara'
+    CONFIG_PATH='./common.yar'
     if [ ! -f "$CONFIG_PATH" ]
     then
-        echo "Unable to find 'common.yara' in $OLD_PATH, and in the current directory."
+        echo "Unable to find 'common.yar' in $OLD_PATH, and in the current directory."
         exit 0
     fi
 fi
@@ -42,12 +42,12 @@ fi
 
 update_rules() {
   SITE="https://raw.githubusercontent.com/nbs-system/php-malware-finder/master/php-malware-finder/"
-  RULES_FILES=('asp.yara' 'common.yara' 'bad_php.yara' 'php.yara'
-  'whitelist.yara')
+  RULES_FILES=('asp.yar' 'common.yar' 'bad_php.yar' 'php.yar'
+  'whitelist.yar')
   CONFIG_DIR="/etc/phpmalwarefinder/"
 
   if [ ! -d $CONFIG_DIR ]; then
-      if [ ! -f ./common.yara ]; then
+      if [ ! -f ./common.yar ]; then
           echo "no rules in $CONFIG_DIR or ./, exiting"
           exit 1
       else
@@ -182,7 +182,7 @@ one_line_trick "$@"
 
 # Include correct yara rule
 CONFIG_PATH=${CONFIG_PATH%/*}/
-OPTS="${OPTS} -r ${CONFIG_PATH}${FORMAT}.yara"
+OPTS="${OPTS} -r ${CONFIG_PATH}${FORMAT}.yar"
 
 # Execute rules
 ${NICE} ${NICE_OPTS} $YARA $OPTS "$@"
diff --git a/php-malware-finder/whitelist.yara b/php-malware-finder/whitelist.yar
index 3aab9c5..3aab9c5 100644
--- a/php-malware-finder/whitelist.yara
+++ b/php-malware-finder/whitelist.yar