WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-08 02:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Make suggested fixes to reduce loops and ignore insane sections

Browse Source
This commit is contained in:
Mike Auty
2024-11-29 08:43:04 +00:00
parent bec6bc6594
commit 0030129ff8
2 changed files with 31 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/linux/vmayarascan.py
+13 -12
View File
@@ -71,20 +71,21 @@ class VmaYaraScan(interfaces.plugins.PluginInterface):
# get the proc_layer object from the context
proc_layer = self.context.layers[proc_layer_name]
vma_maps = list(self.get_vma_maps(task))
insane_vma_maps = [
start for (start, size) in vma_maps if size > sanity_check
]
for start in insane_vma_maps:
vollog.debug(f"VMA at 0x{start:x} over sanity-check size, not scanning")
max_vma_size = 0
vma_maps_to_scan = []
for start, size in self.get_vma_maps(task):
if size > sanity_check:
vollog.debug(
f"VMA at 0x{start:x} over sanity-check size, not scanning"
)
continue
max_vma_size = max(max_vma_size, size)
vma_maps_to_scan.append((start, size))
if not vma_maps:
vollog.warning(f"No VMAs were found for task {task.pid}, aborting")
if not vma_maps_to_scan:
vollog.warning(f"No VMAs were found for task {task.tgid}, not scanning")
continue
max_vma_size: int = max(
[size for (start, size) in vma_maps if size <= sanity_check]
)
scanner = yarascan.YaraScanner(rules=rules)
scanner.chunk_size = max_vma_size
@@ -92,7 +93,7 @@ class VmaYaraScan(interfaces.plugins.PluginInterface):
for offset, rule_name, name, value in proc_layer.scan(
context=self.context,
scanner=scanner,
sections=vma_maps,
sections=vma_maps_to_scan,
):
yield 0, (
format_hints.Hex(offset),
volatility3/framework/plugins/windows/vadyarascan.py
+18 -10
View File
@@ -70,16 +70,24 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
layer_name = task.add_process_layer()
layer = self.context.layers[layer_name]
vad_maps = list(self.get_vad_maps(task))
insane_vad_maps = [
start for (start, size) in vad_maps if size > sanity_check
]
for start in insane_vad_maps:
vollog.debug(f"VAD at 0x{start:x} over sanity-check size, not scanning")
max_vad_size = 0
vad_maps_to_scan = []
for start, size in self.get_vad_maps(task):
if size > sanity_check:
vollog.debug(
f"VAD at 0x{start:x} over sanity-check size, not scanning"
)
continue
max_vad_size = max(max_vad_size, size)
vad_maps_to_scan.append((start, size))
if not vad_maps_to_scan:
vollog.warning(
f"No VADs were found for task {task.UniqueProcessID}, not scanning"
)
continue
max_vad_size: int = max(
[size for (start, size) in vad_maps if size <= sanity_check]
)
scanner = yarascan.YaraScanner(rules=rules)
scanner.chunk_size = max_vad_size
@@ -87,7 +95,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
for offset, rule_name, name, value in layer.scan(
context=self.context,
scanner=scanner,
sections=vad_maps,
sections=vad_maps_to_scan,
):
yield 0, (
format_hints.Hex(offset),