From 0030129ff8b440f8f3e43870f87d697b3847baa6 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Fri, 29 Nov 2024 08:43:04 +0000
Subject: [PATCH] Make suggested fixes to reduce loops and ignore insane
 sections

---
 .../framework/plugins/linux/vmayarascan.py    | 25 +++++++++--------
 .../framework/plugins/windows/vadyarascan.py  | 28 ++++++++++++-------
 2 files changed, 31 insertions(+), 22 deletions(-)

diff --git a/volatility3/framework/plugins/linux/vmayarascan.py b/volatility3/framework/plugins/linux/vmayarascan.py
index 3d8eb603b..89210be69 100644
--- a/volatility3/framework/plugins/linux/vmayarascan.py
+++ b/volatility3/framework/plugins/linux/vmayarascan.py
@@ -71,20 +71,21 @@ class VmaYaraScan(interfaces.plugins.PluginInterface):
             # get the proc_layer object from the context
             proc_layer = self.context.layers[proc_layer_name]
 
-            vma_maps = list(self.get_vma_maps(task))
-            insane_vma_maps = [
-                start for (start, size) in vma_maps if size > sanity_check
-            ]
-            for start in insane_vma_maps:
-                vollog.debug(f"VMA at 0x{start:x} over sanity-check size, not scanning")
+            max_vma_size = 0
+            vma_maps_to_scan = []
+            for start, size in self.get_vma_maps(task):
+                if size > sanity_check:
+                    vollog.debug(
+                        f"VMA at 0x{start:x} over sanity-check size, not scanning"
+                    )
+                    continue
+                max_vma_size = max(max_vma_size, size)
+                vma_maps_to_scan.append((start, size))
 
-            if not vma_maps:
-                vollog.warning(f"No VMAs were found for task {task.pid}, aborting")
+            if not vma_maps_to_scan:
+                vollog.warning(f"No VMAs were found for task {task.tgid}, not scanning")
                 continue
 
-            max_vma_size: int = max(
-                [size for (start, size) in vma_maps if size <= sanity_check]
-            )
             scanner = yarascan.YaraScanner(rules=rules)
             scanner.chunk_size = max_vma_size
 
@@ -92,7 +93,7 @@ class VmaYaraScan(interfaces.plugins.PluginInterface):
             for offset, rule_name, name, value in proc_layer.scan(
                 context=self.context,
                 scanner=scanner,
-                sections=vma_maps,
+                sections=vma_maps_to_scan,
             ):
                 yield 0, (
                     format_hints.Hex(offset),
diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py
index 65006bdc2..a67b8dc0b 100644
--- a/volatility3/framework/plugins/windows/vadyarascan.py
+++ b/volatility3/framework/plugins/windows/vadyarascan.py
@@ -70,16 +70,24 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
             layer_name = task.add_process_layer()
             layer = self.context.layers[layer_name]
 
-            vad_maps = list(self.get_vad_maps(task))
-            insane_vad_maps = [
-                start for (start, size) in vad_maps if size > sanity_check
-            ]
-            for start in insane_vad_maps:
-                vollog.debug(f"VAD at 0x{start:x} over sanity-check size, not scanning")
+            max_vad_size = 0
+            vad_maps_to_scan = []
+
+            for start, size in self.get_vad_maps(task):
+                if size > sanity_check:
+                    vollog.debug(
+                        f"VAD at 0x{start:x} over sanity-check size, not scanning"
+                    )
+                    continue
+                max_vad_size = max(max_vad_size, size)
+                vad_maps_to_scan.append((start, size))
+
+            if not vad_maps_to_scan:
+                vollog.warning(
+                    f"No VADs were found for task {task.UniqueProcessID}, not scanning"
+                )
+                continue
 
-            max_vad_size: int = max(
-                [size for (start, size) in vad_maps if size <= sanity_check]
-            )
             scanner = yarascan.YaraScanner(rules=rules)
             scanner.chunk_size = max_vad_size
 
@@ -87,7 +95,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
             for offset, rule_name, name, value in layer.scan(
                 context=self.context,
                 scanner=scanner,
-                sections=vad_maps,
+                sections=vad_maps_to_scan,
             ):
                 yield 0, (
                     format_hints.Hex(offset),