Linux: Update linux.vmayarascan and yarascan so that command line options are taken from the base yarascan plugin

volatility3/framework/plugins/linux/vmayarascan.py

@@ -31,7 +31,7 @@ class VmaYaraScan(interfaces.plugins.PluginInterface):
                 name="pslist", plugin=pslist.PsList, version=(2, 0, 0)
             ),
             requirements.PluginRequirement(
-                name="yarascan", plugin=yarascan.YaraScan, version=(1, 1, 0)
+                name="yarascan", plugin=yarascan.YaraScan, version=(1, 2, 0)
             ),
             requirements.VersionRequirement(
                 name="yarascanner", component=yarascan.YaraScanner, version=(2, 0, 0)
@@ -43,17 +43,8 @@ class VmaYaraScan(interfaces.plugins.PluginInterface):
             ),
         ]
 
-        # get base yarascan requirements
-        yarascan_requirements = yarascan.YaraScan.get_requirements()
-
-        # remove TranslationLayerRequirement from the base yarascan requirements
-        # if this is not removed automagic will not find both the TranslationLayerRequirement
-        # for YaraScan and the ModuleRequirement for VmaYaraScan
-        yarascan_requirements = [
-            requirement
-            for requirement in yarascan_requirements
-            if not isinstance(requirement, requirements.TranslationLayerRequirement)
-        ]
+        # get base yarascan requirements for command line options
+        yarascan_requirements = yarascan.YaraScan.get_yarascan_option_requirements()
 
         # return the combined requirements
         return yarascan_requirements + vmayarascan_requirements
@@ -69,7 +60,6 @@ class VmaYaraScan(interfaces.plugins.PluginInterface):
             vmlinux_module_name=self.config["kernel"],
             filter_func=filter_func,
         ):
-
             # attempt to create a process layer for each task and skip those
             # that cannot (e.g. kernel threads)
             proc_layer_name = task.add_process_layer()

volatility3/framework/plugins/yarascan.py

@@ -61,19 +61,31 @@ class YaraScan(plugins.PluginInterface):
     """Scans kernel memory using yara rules (string or file)."""
 
     _required_framework_version = (2, 0, 0)
-    _version = (1, 1, 0)
+    _version = (1, 2, 0)
 
     # TODO: When the major version is bumped, take the opportunity to rename the yara_rules config to yara_string
     # or something that makes more sense
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
-        return [
+        """Returns the requirements needed to run yarascan directly, combining the TranslationLayerRequirement
+        and the requirements from get_yarascan_option_requirements."""
+        return cls.get_yarascan_option_requirements() + [
             requirements.TranslationLayerRequirement(
                 name="primary",
                 description="Memory layer for the kernel",
                 architectures=["Intel32", "Intel64"],
-            ),
+            )
+        ]
+
+    @classmethod
+    def get_yarascan_option_requirements(
+        cls,
+    ) -> List[interfaces.configuration.RequirementInterface]:
+        """Returns the requirements needed for the command lines options used by yarascan. This can
+        then also be used by other plugins that are using yarascan. This does not include a
+        TranslationLayerRequirement or a ModuleRequirement."""
+        return [
             requirements.BooleanRequirement(
                 name="insensitive",
                 description="Makes the search case insensitive",