vyre

GPU bytecode condition engine. The first GPU-native rule condition evaluator.

What it does

vyre compiles boolean rule conditions to bytecode and evaluates them on GPU compute shaders. Where traditional rule engines (YARA, Sigma) evaluate conditions sequentially on CPU, vyre dispatches thousands of rules simultaneously across GPU threads.

Architecture

Frontend (YARA/SURGE) --> vyre::Program (bytecode) --> GPU Shader --> Vec<bool>

vyre is the execution engine only. It does not parse rules. Frontends like yaragpu (YARA compatibility) or surgec (GPU-native SURGE format) compile their respective rule languages to vyre::Program bytecode.

Bytecode ISA

49 opcodes covering:

• Boolean logic (AND, OR, NOT)
• Comparison (EQ, NEQ, LT, GT, LTE, GTE)
• Arithmetic (ADD, SUB, MUL, DIV, MOD, bitwise)
• String matching (matched, count, offset, length, at, in)
• File metadata (filesize, entropy, PE headers, entry point)
• Control flow (FOR-ANY, FOR-ALL, FOR-N with bounded iteration)

GPU Pipeline

Three-pass evaluation:

1. Scatter - Map pattern matches to per-rule bitmaps
2. Evaluate - Execute bytecode programs (one GPU thread per rule)
3. Readback - Sparse collection of fired rules via atomic append

GPU Only

vyre requires a GPU (wgpu). There is no CPU fallback by design. If you need CPU rule evaluation, use YARA directly. vyre exists because GPU evaluation is 1000x faster at internet scale.

License

GPL-2.0-only