diff --git a/volatility/framework/plugins/windows/vadyarascan.py b/volatility/framework/plugins/windows/vadyarascan.py index aae2e0bc0..922788132 100644 --- a/volatility/framework/plugins/windows/vadyarascan.py +++ b/volatility/framework/plugins/windows/vadyarascan.py @@ -44,6 +44,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface): description = "Set the maximum size (default is 1GB)", optional = True), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), + requirements.PluginRequirement(name = 'yarascan', plugin = yarascan.YaraScan, version = (2, 0, 0)), requirements.IntRequirement(name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True) @@ -74,11 +75,11 @@ class VadYaraScan(interfaces.plugins.PluginInterface): symbol_table = self.config['nt_symbols'], filter_func = filter_func): layer_name = task.add_process_layer() - layer = self.context.layers[layer_name] - for offset, name, value in layer.scan(context = self.context, - scanner = yarascan.YaraScanner(rules = rules), - sections = self.get_vad_maps(task)): - yield (0, (format_hints.Hex(offset), task.UniqueProcessId, name, value)) + for offset, rule_name, name, value in yarascan.YaraScan.scan(context = self.context, + layer_name = layer_name, + rules = rules, + sections = self.get_vad_maps(task)): + yield 0, (format_hints.Hex(offset), task.UniqueProcessId, rule_name, name, value) @staticmethod def get_vad_maps(task: interfaces.objects.ObjectInterface) -> Iterable[Tuple[int, int]]: @@ -98,5 +99,5 @@ class VadYaraScan(interfaces.plugins.PluginInterface): yield (start, end - start) def run(self): - return renderers.TreeGrid([('Offset', format_hints.Hex), ('Pid', int), ('Rule', str), ('Value', bytes)], - self._generator()) + return renderers.TreeGrid([('Offset', format_hints.Hex), ('Pid', int), ('Rule', str), ('Component', str), + ('Value', bytes)], self._generator()) diff --git a/volatility/framework/plugins/yarascan.py b/volatility/framework/plugins/yarascan.py index 245993b23..a24eb028b 100644 --- a/volatility/framework/plugins/yarascan.py +++ b/volatility/framework/plugins/yarascan.py @@ -30,12 +30,14 @@ class YaraScanner(interfaces.layers.ScannerInterface): def __call__(self, data: bytes, data_offset: int) -> Iterable[Tuple[int, str, bytes]]: for match in self._rules.match(data = data): for offset, name, value in match.strings: - yield (offset + data_offset, name, value) + yield (offset + data_offset, match.rule, name, value) class YaraScan(plugins.PluginInterface): """Scans kernel memory using yara rules (string or file).""" + _version = (2, 0, 0) + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ @@ -62,7 +64,6 @@ class YaraScan(plugins.PluginInterface): def _generator(self): - layer = self.context.layers[self.config['primary']] rules = None if self.config.get('yara_rules', None) is not None: rule = self.config['yara_rules'] @@ -78,8 +79,14 @@ class YaraScan(plugins.PluginInterface): else: vollog.error("No yara rules, nor yara rules file were specified") - for offset, name, value in layer.scan(context = self.context, scanner = YaraScanner(rules = rules)): - yield (0, (format_hints.Hex(offset), name, value)) + for offset, rule_name, name, value in self.scan(self.context, self.config['primary'], rules): + yield 0, (format_hints.Hex(offset), rule_name, name, value) + + @classmethod + def scan(cls, context: interfaces.context.ContextInterface, layer_name: str, rules, sections = None): + layer = context.layers[layer_name] + yield from layer.scan(context = context, scanner = YaraScanner(rules = rules), sections = sections) def run(self): - return renderers.TreeGrid([('Offset', format_hints.Hex), ('Rule', str), ('Value', bytes)], self._generator()) + return renderers.TreeGrid([('Offset', format_hints.Hex), ('Rule', str), ('Component', str), ('Value', bytes)], + self._generator())