From 09b0c8e406ec1aaf49a87a99fc86523fce36ff69 Mon Sep 17 00:00:00 2001 From: Eve Date: Fri, 12 May 2023 13:30:32 +0100 Subject: [PATCH] Linux: Update linux.vmayarascan and yarascan so that command line options are taken from the base yarascan plugin --- .../framework/plugins/linux/vmayarascan.py | 16 +++------------- volatility3/framework/plugins/yarascan.py | 18 +++++++++++++++--- 2 files changed, 18 insertions(+), 16 deletions(-) diff --git a/volatility3/framework/plugins/linux/vmayarascan.py b/volatility3/framework/plugins/linux/vmayarascan.py index f0d42f6e3..8e4174c12 100644 --- a/volatility3/framework/plugins/linux/vmayarascan.py +++ b/volatility3/framework/plugins/linux/vmayarascan.py @@ -31,7 +31,7 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): name="pslist", plugin=pslist.PsList, version=(2, 0, 0) ), requirements.PluginRequirement( - name="yarascan", plugin=yarascan.YaraScan, version=(1, 1, 0) + name="yarascan", plugin=yarascan.YaraScan, version=(1, 2, 0) ), requirements.VersionRequirement( name="yarascanner", component=yarascan.YaraScanner, version=(2, 0, 0) @@ -43,17 +43,8 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): ), ] - # get base yarascan requirements - yarascan_requirements = yarascan.YaraScan.get_requirements() - - # remove TranslationLayerRequirement from the base yarascan requirements - # if this is not removed automagic will not find both the TranslationLayerRequirement - # for YaraScan and the ModuleRequirement for VmaYaraScan - yarascan_requirements = [ - requirement - for requirement in yarascan_requirements - if not isinstance(requirement, requirements.TranslationLayerRequirement) - ] + # get base yarascan requirements for command line options + yarascan_requirements = yarascan.YaraScan.get_yarascan_option_requirements() # return the combined requirements return yarascan_requirements + vmayarascan_requirements @@ -69,7 +60,6 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): vmlinux_module_name=self.config["kernel"], filter_func=filter_func, ): - # attempt to create a process layer for each task and skip those # that cannot (e.g. kernel threads) proc_layer_name = task.add_process_layer() diff --git a/volatility3/framework/plugins/yarascan.py b/volatility3/framework/plugins/yarascan.py index 1c8467689..11c708607 100644 --- a/volatility3/framework/plugins/yarascan.py +++ b/volatility3/framework/plugins/yarascan.py @@ -61,19 +61,31 @@ class YaraScan(plugins.PluginInterface): """Scans kernel memory using yara rules (string or file).""" _required_framework_version = (2, 0, 0) - _version = (1, 1, 0) + _version = (1, 2, 0) # TODO: When the major version is bumped, take the opportunity to rename the yara_rules config to yara_string # or something that makes more sense @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: - return [ + """Returns the requirements needed to run yarascan directly, combining the TranslationLayerRequirement + and the requirements from get_yarascan_option_requirements.""" + return cls.get_yarascan_option_requirements() + [ requirements.TranslationLayerRequirement( name="primary", description="Memory layer for the kernel", architectures=["Intel32", "Intel64"], - ), + ) + ] + + @classmethod + def get_yarascan_option_requirements( + cls, + ) -> List[interfaces.configuration.RequirementInterface]: + """Returns the requirements needed for the command lines options used by yarascan. This can + then also be used by other plugins that are using yarascan. This does not include a + TranslationLayerRequirement or a ModuleRequirement.""" + return [ requirements.BooleanRequirement( name="insensitive", description="Makes the search case insensitive",