diff --git a/volatility3/framework/plugins/linux/vmayarascan.py b/volatility3/framework/plugins/linux/vmayarascan.py index cda502a73..e1e3c1e2a 100644 --- a/volatility3/framework/plugins/linux/vmayarascan.py +++ b/volatility3/framework/plugins/linux/vmayarascan.py @@ -84,8 +84,12 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): renderers.LayerData( self.context, proc_layer_name, - instance.offset + start, - instance.matched_length, + instance.offset + + start + - abs(self.config["context_before"]), + instance.matched_length + + abs(self.config["context_before"]) + + abs(self.config["context_after"]), ), ) else: @@ -98,8 +102,12 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): renderers.LayerData( self.context, proc_layer_name, - offset + start, - len(value), + offset + + start + - abs(self.config["context_before"]), + len(value) + + abs(self.config["context_before"]) + + abs(self.config["context_after"]), ), ) else: @@ -114,8 +122,12 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): renderers.LayerData( self.context, proc_layer_name, - instance.offset + start, - instance.length, + instance.offset + + start + - abs(self.config["context_before"]), + instance.length + + abs(self.config["context_before"]) + + abs(self.config["context_after"]), ), ) diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py index 04b9aadd9..ef40be0cb 100644 --- a/volatility3/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -95,9 +95,11 @@ class VadYaraScan(interfaces.plugins.PluginInterface): ): layer_data = renderers.LayerData( context=self.context, - offset=offset, + offset=offset - abs(self.config["context_before"]), layer_name=layer.name, - length=len(value), + length=len(value) + + abs(self.config["context_before"]) + + abs(self.config["context_after"]), ) yield 0, ( format_hints.Hex(offset), diff --git a/volatility3/framework/plugins/yarascan.py b/volatility3/framework/plugins/yarascan.py index 49db2af02..5a5e6a0c7 100644 --- a/volatility3/framework/plugins/yarascan.py +++ b/volatility3/framework/plugins/yarascan.py @@ -169,6 +169,16 @@ class YaraScan(plugins.PluginInterface): description="Set the maximum size (default is 1GB)", optional=True, ), + requirements.IntRequirement( + name="context_before", + optional=True, + default=0, + ), + requirements.IntRequirement( + name="context_after", + optional=True, + default=0, + ), ] @classmethod @@ -208,9 +218,11 @@ class YaraScan(plugins.PluginInterface): ): layer_data = renderers.LayerData( context=self.context, - offset=offset, + offset=offset - abs(self.config["context_before"]), layer_name=layer.name, - length=len(value), + length=len(value) + + abs(self.config["context_before"]) + + abs(self.config["context_after"]), ) yield 0, (format_hints.Hex(offset), rule_name, name, layer_data)