mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-12 04:37:38 +02:00
windows.vadregexscan: remove dependency on vadyarascan
This commit is contained in:
@@ -11,7 +11,7 @@ from volatility3.framework.configuration import requirements
|
||||
from volatility3.framework.interfaces import plugins
|
||||
from volatility3.framework.layers import scanners
|
||||
from volatility3.framework.renderers import format_hints
|
||||
from volatility3.plugins.windows import pslist, vadyarascan
|
||||
from volatility3.plugins.windows import pslist
|
||||
|
||||
vollog = logging.getLogger(__name__)
|
||||
|
||||
@@ -35,9 +35,6 @@ class VadRegExScan(plugins.PluginInterface):
|
||||
requirements.PluginRequirement(
|
||||
name="pslist", plugin=pslist.PsList, version=(2, 0, 0)
|
||||
),
|
||||
requirements.PluginRequirement(
|
||||
name="vadyarascan", plugin=vadyarascan.VadYaraScan, version=(1, 0, 0)
|
||||
),
|
||||
requirements.ListRequirement(
|
||||
name="pid",
|
||||
description="Filter on specific process IDs",
|
||||
@@ -70,7 +67,11 @@ class VadRegExScan(plugins.PluginInterface):
|
||||
proc_layer = self.context.layers[proc_layer_name]
|
||||
|
||||
# get process sections for scanning
|
||||
sections = vadyarascan.VadYaraScan.get_vad_maps(proc)
|
||||
sections = []
|
||||
for vad in proc.get_vad_root().traverse():
|
||||
base = vad.get_start()
|
||||
if vad.get_size():
|
||||
sections.append((base, vad.get_size()))
|
||||
|
||||
for offset in proc_layer.scan(
|
||||
context=self.context,
|
||||
|
||||
Reference in New Issue
Block a user