WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-17 20:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

use one class with flag

Browse Source
This commit is contained in:
Davide Arcuri
2024-08-07 10:38:29 +02:00
parent f740146f69
commit 10376a2687
5 changed files with 38 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1 -1
View File
@@ -20,7 +20,7 @@ more details.
## Requirements
Volatility 3 requires Python 3.7.3 or later. To install the most minimal set of dependencies (some plugins will not work) use a command such as:
Volatility 3 requires Python 3.8.0 or later. To install the most minimal set of dependencies (some plugins will not work) use a command such as:
```shell
pip3 install -r requirements-minimal.txt
pyproject.toml
+1 -1
View File
@@ -6,7 +6,7 @@ readme = "README.md"
authors = [
{ name = "Volatility Foundation", email = "volatility@volatilityfoundation.org" },
]
requires-python = ">=3.7.3"
requires-python = ">=3.8.0"
license = { text = "VSL" }
dynamic = ["dependencies", "optional-dependencies", "version"]
volatility3/framework/__init__.py
+1 -1
View File
@@ -7,7 +7,7 @@ import glob
import sys
import zipfile
required_python_version = (3, 7, 3)
required_python_version = (3, 8, 0)
if (
sys.version_info.major != required_python_version[0]
or sys.version_info.minor < required_python_version[1]
volatility3/framework/plugins/windows/vadyarascan.py
+3 -4
View File
@@ -73,8 +73,9 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
)
continue
data = layer.read(start, size, True)
if not yarascan.YaraScan._yara_x:
for match in rules.match(data=layer.read(start, size, True)):
for match in rules.match(data=data):
if yarascan.YaraScan.yara_returns_instances():
for match_string in match.strings:
for instance in match_string.instances:
@@ -95,9 +96,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
value,
)
else:
data = layer.read(start, size, True)
results = rules.scan(data)
for match in results.matching_rules:
for match in rules.scan(data).matching_rules:
for match_string in match.patterns:
for instance in match_string.matches:
yield 0, (
volatility3/framework/plugins/yarascan.py
+32 -49
View File
@@ -36,7 +36,7 @@ except ImportError:
raise
class BaseYaraScanner(interfaces.layers.ScannerInterface):
class YaraScanner(interfaces.layers.ScannerInterface):
_version = (2, 1, 0)
# yara.Rules isn't exposed, so we can't type this properly
@@ -45,32 +45,44 @@ class BaseYaraScanner(interfaces.layers.ScannerInterface):
if rules is None:
raise ValueError("No rules provided to YaraScanner")
self._rules = rules
class YaraPythonScanner(BaseYaraScanner):
def __init__(self, rules) -> None:
super().__init__(rules)
self.st_object = not tuple(int(x) for x in yara.__version__.split(".")) < (4, 3)
self.st_object = (
None
if USE_YARA_X
else not tuple(int(x) for x in yara.__version__.split(".")) < (4, 3)
)
def __call__(
self, data: bytes, data_offset: int
) -> Iterable[Tuple[int, str, str, bytes]]:
for match in self._rules.match(data=data):
if YaraScan.yara_returns_instances():
for match_string in match.strings:
for instance in match_string.instances:
if USE_YARA_X:
for match in self._rules.scan(data).matching_rules:
for match_string in match.patterns:
for instance in match_string.matches:
yield (
instance.offset + data_offset,
match.rule,
f"{match.namespace}.{match.identifier}",
match_string.identifier,
instance.matched_data,
data[instance.offset : instance.offset + instance.length],
)
else:
for offset, name, value in match.strings:
yield (offset + data_offset, match.rule, name, value)
else:
for match in self._rules.match(data=data):
if YaraScan.yara_returns_instances():
for match_string in match.strings:
for instance in match_string.instances:
yield (
instance.offset + data_offset,
match.rule,
match_string.identifier,
instance.matched_data,
)
else:
for offset, name, value in match.strings:
yield (offset + data_offset, match.rule, name, value)
@staticmethod
def get_rule(rule):
if USE_YARA_X:
return yara_x.compile(f"rule r1 {{strings: $a = {rule} condition: $a}}")
return yara.compile(
sources={"n": f"rule r1 {{strings: $a = {rule} condition: $a}}"}
)
@@ -78,47 +90,18 @@ class YaraPythonScanner(BaseYaraScanner):
@staticmethod
def from_compiled_file(filepath):
with resources.ResourceAccessor().open(filepath, "rb") as fp:
if USE_YARA_X:
return yara_x.Rules.deserialize_from(file=fp)
return yara.load(file=fp)
@staticmethod
def from_file(filepath):
with resources.ResourceAccessor().open(filepath, "rb") as fp:
if USE_YARA_X:
return yara_x.compile(fp.read().decode())
return yara.compile(file=fp)
class YaraXScanner(BaseYaraScanner):
def __call__(
self, data: bytes, data_offset: int
) -> Iterable[Tuple[int, str, str, bytes]]:
results = self._rules.scan(data)
for match in results.matching_rules:
for match_string in match.patterns:
for instance in match_string.matches:
yield (
instance.offset + data_offset,
f"{match.namespace}.{match.identifier}",
match_string.identifier,
data[instance.offset : instance.offset + instance.length],
)
@staticmethod
def get_rule(rule):
return yara_x.compile(f"rule r1 {{strings: $a = {rule} condition: $a}}")
@staticmethod
def from_compiled_file(filepath):
with resources.ResourceAccessor().open(filepath, "rb") as fp:
return yara_x.Rules.deserialize_from(file=fp)
@staticmethod
def from_file(filepath):
with resources.ResourceAccessor().open(filepath, "rb") as fp:
return yara_x.compile(fp.read().decode())
YaraScanner = YaraXScanner if USE_YARA_X else YaraPythonScanner
class YaraScan(plugins.PluginInterface):
"""Scans kernel memory using yara rules (string or file)."""