Modify our rules to match the YARA format to increase popularity

### [qep 1]

### Abstract

Change the existing rule format to the Yara format.

### Why YARA

According to our existing rules, it is used in **JSON** format. However, This format is not popular in malware detection. If other contributors want to come in and make a contribution, they must understand our format of establishing rules, which can be time-consuming, and there is no standardized format to follow. Also, through the use of the **YARA** format, it not only increases the universality, but it can also apply the **YARA** rules provided by others, which can attract more users and contributors.

### Pros

1. The more popular format in the malware detection area.
2. It can be used to detect which packer is.
3. It can be used to detect signature in .so file.
4. It supports hexadecimal strings, which are useful for defining raw bytes; Text strings; Regular expressions.
5. Maybe it can avoid the situation that androguard is not maintained by using Yara.

### Cons

1. It is based on signature-based detection, so the hacker can use some technique to bypass it.
2. issue that we still need to disassemble apk for zip format and parse the xml file [issue](https://github.com/VirusTotal/yara/issues/1145).
3. koodous also thought of the same method, but then no longer maintained, [androguard-yara](https://github.com/Koodous/androguard-yara).

### Usage

Suppose we have a rule as below:

```
rule sendLocation_SMS {

meta:
description = "Send Location via SMS"
yscore = 4
API_1_class = "Landroid/telephony/TelephonyManager"
API_1_method = "getCellLocation"
API_2_class = "Landroid/telephony/SmsManager"
API_2_method = "sendTextMessage"

strings:
// A string to match -- default is ascii
$permission_1 = "android.permission.SEND_SMS" nocase
$permission_2 = "android.permission.ACCESS_COARSE_LOCATION" nocase
$permission_3 = "android.permission.ACCESS_FINE_LOCATION" nocase

condition:
// The condition to match
$permission_1 and $permission_2 and $permission_3
}

```

### Python Code

```python
import yara

rules = yara.compile(filepath="rule.yara")

# show information of a rule
for rule in rules:
print(rule.identifier)
print(rule.meta)
print(rule.tags)

matches = rules.match(data='apk, android.permission.SEND_SMS, android.permission.ACCESS_FINE_LOCATION, android.permission.ACCESS_COARSE_LOCATION')

print("----scanning----")

print(f"meta: {matches[0].meta}")
print(f"tags: {matches[0].tags}")
print(f"namespace: {matches[0].namespace}")
print(f"strings: {matches[0].strings}")
print(f"rule: {matches[0].rule}")
```

### Output

> sendLocation_SMS
{'description': 'Send Location via SMS', 'yscore': 4, 'API_1_class': 'Landroid/telephony/TelephonyManager', 'API_1_method': 'getCellLocation', 'API_2_class': 'Landroid/telephony/SmsManager', 'API_2_method': 'sendTextMessage'}
[]
----scanning----
meta: {'description': 'Send Location via SMS', 'yscore': 4, 'API_1_class': 'Landroid/telephony/TelephonyManager', 'API_1_method': 'getCellLocation', 'API_2_class': 'Landroid/telephony/SmsManager', 'API_2_method': 'sendTextMessage'}
tags: []
namespace: default
strings: [(5, '$permission_1', b'android.permission.SEND_SMS'), (75, '$permission_2', b'android.permission.ACCESS_COARSE_LOCATION'), (34, '$permission_3', b'android.permission.ACCESS_FINE_LOCATION')]
rule: sendLocation_SMS