Abstract

A YARA rule is easy to distribute, but the malware sample used to demonstrate a positive match is not. This complicates safe storage, continuous integration, disaster-recovery exercises, and reproducible scanner validation. Constructing a replacement fixture requires more than embedding literals: YARA conditions can combine alternatives, counts, offsets, integer reads, and executable-container constraints, while the resulting file should not reproduce malware behavior. Our insight is that positive validation is existential: it requires one file-level member of a rules match set, not reconstruction of the originating sample. We present Aray, a deterministic-first YARA interpreter and positive-fixture synthesizer. Models may propose constructive normalizations or typed extraction fallbacks, but never backend source or binary structure. Conventional code canonicalizes and validates normalized rules for syntax, rule identity, retained declarations and modifiers, supported count expansions, and fixed witnesses derived from regex and variable-hex declarations. It then performs extraction, routing, collision-checked layout, and ELF, PE, or generic serialization; only residual normalization semantics reach a bounded model judge. We evaluated Aray over 416 selected public-rule entries. Normalization accepted 182 entries without model assistance and 234 after model normalization. Constructibility preflight admitted 406 entries, and every admitted fixture matched its associated up-stream original rule. This yields 406/416 (97.6%) overall and 406/406 among constructible rules, with ten expected preflight dispositions and zero `yara_mismatch` or construction failures. An unreachable endpoint confirmed zero model invocations during realization. The original-rule oracle therefore provides direct source-rule validation for every generated fixture; proving implication for all possible files is a separate, stronger objective. Two anchored-regex failures discovered with this corpus were repaired before the final run; the reported figures are therefore post-fix systems results, not a held-out estimate of normalization generalization.