WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-11 20:27:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

YaraScan: Add context bytes option

Browse Source 
Makes yarascan results' `LayerData` have a configurable context window
size.
This commit is contained in:
David McDonald
2025-05-05 10:07:27 -05:00
parent 6940af98ae
commit 01e234d78c
3 changed files with 36 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/linux/vmayarascan.py
+18 -6
View File
@@ -84,8 +84,12 @@ class VmaYaraScan(interfaces.plugins.PluginInterface):
renderers.LayerData(
self.context,
proc_layer_name,
instance.offset + start,
instance.matched_length,
instance.offset
+ start
- abs(self.config["context_before"]),
instance.matched_length
+ abs(self.config["context_before"])
+ abs(self.config["context_after"]),
),
)
else:
@@ -98,8 +102,12 @@ class VmaYaraScan(interfaces.plugins.PluginInterface):
renderers.LayerData(
self.context,
proc_layer_name,
offset + start,
len(value),
offset
+ start
- abs(self.config["context_before"]),
len(value)
+ abs(self.config["context_before"])
+ abs(self.config["context_after"]),
),
)
else:
@@ -114,8 +122,12 @@ class VmaYaraScan(interfaces.plugins.PluginInterface):
renderers.LayerData(
self.context,
proc_layer_name,
instance.offset + start,
instance.length,
instance.offset
+ start
- abs(self.config["context_before"]),
instance.length
+ abs(self.config["context_before"])
+ abs(self.config["context_after"]),
),
)
volatility3/framework/plugins/windows/vadyarascan.py
+4 -2
View File
@@ -95,9 +95,11 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
):
layer_data = renderers.LayerData(
context=self.context,
offset=offset,
offset=offset - abs(self.config["context_before"]),
layer_name=layer.name,
length=len(value),
length=len(value)
+ abs(self.config["context_before"])
+ abs(self.config["context_after"]),
)
yield 0, (
format_hints.Hex(offset),
volatility3/framework/plugins/yarascan.py
+14 -2
View File
@@ -169,6 +169,16 @@ class YaraScan(plugins.PluginInterface):
description="Set the maximum size (default is 1GB)",
optional=True,
),
requirements.IntRequirement(
name="context_before",
optional=True,
default=0,
),
requirements.IntRequirement(
name="context_after",
optional=True,
default=0,
),
]
@classmethod
@@ -208,9 +218,11 @@ class YaraScan(plugins.PluginInterface):
):
layer_data = renderers.LayerData(
context=self.context,
offset=offset,
offset=offset - abs(self.config["context_before"]),
layer_name=layer.name,
length=len(value),
length=len(value)
+ abs(self.config["context_before"])
+ abs(self.config["context_after"]),
)
yield 0, (format_hints.Hex(offset), rule_name, name, layer_data)