WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 19:57:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Yarascan: Bump plugin to include rule name (issue/PR #253)

Browse Source 
In order to try to version control the scanner, a version number was
added to the yarascan plugin along with a method for calling the
scanner.
This commit is contained in:
Mike Auty
2020-07-13 10:52:04 +01:00
parent 10f6231c87
commit 1b774bc69d
2 changed files with 20 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/vadyarascan.py
+8 -7
View File
@@ -44,6 +44,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
description = "Set the maximum size (default is 1GB)",
optional = True),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)),
requirements.PluginRequirement(name = 'yarascan', plugin = yarascan.YaraScan, version = (2, 0, 0)),
requirements.IntRequirement(name = 'pid',
description = "Process ID to include (all other processes are excluded)",
optional = True)
@@ -74,11 +75,11 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
symbol_table = self.config['nt_symbols'],
filter_func = filter_func):
layer_name = task.add_process_layer()
layer = self.context.layers[layer_name]
for offset, name, value in layer.scan(context = self.context,
scanner = yarascan.YaraScanner(rules = rules),
sections = self.get_vad_maps(task)):
yield (0, (format_hints.Hex(offset), task.UniqueProcessId, name, value))
for offset, rule_name, name, value in yarascan.YaraScan.scan(context = self.context,
layer_name = layer_name,
rules = rules,
sections = self.get_vad_maps(task)):
yield 0, (format_hints.Hex(offset), task.UniqueProcessId, rule_name, name, value)
@staticmethod
def get_vad_maps(task: interfaces.objects.ObjectInterface) -> Iterable[Tuple[int, int]]:
@@ -98,5 +99,5 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
yield (start, end - start)
def run(self):
return renderers.TreeGrid([('Offset', format_hints.Hex), ('Pid', int), ('Rule', str), ('Value', bytes)],
self._generator())
return renderers.TreeGrid([('Offset', format_hints.Hex), ('Pid', int), ('Rule', str), ('Component', str),
('Value', bytes)], self._generator())
volatility/framework/plugins/yarascan.py
+12 -5
View File
@@ -30,12 +30,14 @@ class YaraScanner(interfaces.layers.ScannerInterface):
def __call__(self, data: bytes, data_offset: int) -> Iterable[Tuple[int, str, bytes]]:
for match in self._rules.match(data = data):
for offset, name, value in match.strings:
yield (offset + data_offset, name, value)
yield (offset + data_offset, match.rule, name, value)
class YaraScan(plugins.PluginInterface):
"""Scans kernel memory using yara rules (string or file)."""
_version = (2, 0, 0)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
return [
@@ -62,7 +64,6 @@ class YaraScan(plugins.PluginInterface):
def _generator(self):
layer = self.context.layers[self.config['primary']]
rules = None
if self.config.get('yara_rules', None) is not None:
rule = self.config['yara_rules']
@@ -78,8 +79,14 @@ class YaraScan(plugins.PluginInterface):
else:
vollog.error("No yara rules, nor yara rules file were specified")
for offset, name, value in layer.scan(context = self.context, scanner = YaraScanner(rules = rules)):
yield (0, (format_hints.Hex(offset), name, value))
for offset, rule_name, name, value in self.scan(self.context, self.config['primary'], rules):
yield 0, (format_hints.Hex(offset), rule_name, name, value)
@classmethod
def scan(cls, context: interfaces.context.ContextInterface, layer_name: str, rules, sections = None):
layer = context.layers[layer_name]
yield from layer.scan(context = context, scanner = YaraScanner(rules = rules), sections = sections)
def run(self):
return renderers.TreeGrid([('Offset', format_hints.Hex), ('Rule', str), ('Value', bytes)], self._generator())
return renderers.TreeGrid([('Offset', format_hints.Hex), ('Rule', str), ('Component', str), ('Value', bytes)],
self._generator())