From 07701fc4cf9385422f9d06b89cf64640e6a76b0d Mon Sep 17 00:00:00 2001 From: eve Date: Mon, 18 Nov 2024 18:32:51 +0000 Subject: [PATCH] windows.vadregexscan: remove dependency on vadyarascan --- volatility3/framework/plugins/windows/vadregexscan.py | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/plugins/windows/vadregexscan.py b/volatility3/framework/plugins/windows/vadregexscan.py index 8d17c469c..206c9faae 100644 --- a/volatility3/framework/plugins/windows/vadregexscan.py +++ b/volatility3/framework/plugins/windows/vadregexscan.py @@ -11,7 +11,7 @@ from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.layers import scanners from volatility3.framework.renderers import format_hints -from volatility3.plugins.windows import pslist, vadyarascan +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) @@ -35,9 +35,6 @@ class VadRegExScan(plugins.PluginInterface): requirements.PluginRequirement( name="pslist", plugin=pslist.PsList, version=(2, 0, 0) ), - requirements.PluginRequirement( - name="vadyarascan", plugin=vadyarascan.VadYaraScan, version=(1, 0, 0) - ), requirements.ListRequirement( name="pid", description="Filter on specific process IDs", @@ -70,7 +67,11 @@ class VadRegExScan(plugins.PluginInterface): proc_layer = self.context.layers[proc_layer_name] # get process sections for scanning - sections = vadyarascan.VadYaraScan.get_vad_maps(proc) + sections = [] + for vad in proc.get_vad_root().traverse(): + base = vad.get_start() + if vad.get_size(): + sections.append((base, vad.get_size())) for offset in proc_layer.scan( context=self.context,