WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-28 12:34:53 +02:00
Code Issues Packages Projects Releases Wiki Activity

Core: Refactor versioning and associated requirements

Browse Source
This commit is contained in:
Mike Auty
2020-07-29 20:18:03 +01:00
committed by ikelos
parent 2c39489790
commit 3eb463475b
6 changed files with 61 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/vadyarascan.py
+7 -6
View File
@@ -7,7 +7,6 @@ from typing import Iterable, List, Tuple
from volatility.framework import interfaces, renderers
from volatility.framework.configuration import requirements
from volatility.framework.layers import resources
from volatility.framework.renderers import format_hints
from volatility.plugins import yarascan
from volatility.plugins.windows import pslist
@@ -44,7 +43,9 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
description = "Set the maximum size (default is 1GB)",
optional = True),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)),
requirements.PluginRequirement(name = 'yarascan', plugin = yarascan.YaraScan, version = (2, 0, 0)),
requirements.PluginRequirement(name = 'yarascan', plugin = yarascan.YaraScan, version = (1, 0, 0)),
requirements.VersionRequirement(name = 'yarascanner', component = yarascan.YaraScanner,
version = (2, 0, 0)),
requirements.ListRequirement(name = 'pid',
element_type = int,
description = "Process IDs to include (all other processes are excluded)",
@@ -62,10 +63,10 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
symbol_table = self.config['nt_symbols'],
filter_func = filter_func):
layer_name = task.add_process_layer()
for offset, rule_name, name, value in yarascan.YaraScan.scan(context = self.context,
layer_name = layer_name,
rules = rules,
sections = self.get_vad_maps(task)):
layer = self.context.layers[layer_name]
for offset, rule_name, name, value in layer.scan(context = self.context,
scanner = yarascan.YaraScanner(rules = rules),
sections = self.get_vad_maps(task)):
yield 0, (format_hints.Hex(offset), task.UniqueProcessId, rule_name, name, value)
@staticmethod
volatility/framework/plugins/yarascan.py
+5 -16
View File
@@ -21,6 +21,7 @@ except ImportError:
class YaraScanner(interfaces.layers.ScannerInterface):
_version = (2, 0, 0)
# yara.Rules isn't exposed, so we can't type this properly
def __init__(self, rules) -> None:
@@ -36,7 +37,7 @@ class YaraScanner(interfaces.layers.ScannerInterface):
class YaraScan(plugins.PluginInterface):
"""Scans kernel memory using yara rules (string or file)."""
_version = (2, 0, 0)
_version = (1, 0, 0)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
@@ -80,24 +81,12 @@ class YaraScan(plugins.PluginInterface):
vollog.error("No yara rules, nor yara rules file were specified")
return rules
@classmethod
def scan(cls,
context: interfaces.context.ContextInterface,
layer_name: str,
rules,
sections: Iterable[Tuple[int, int]] = None):
if rules is None:
return
layer = context.layers[layer_name]
yield from layer.scan(context = context, scanner = YaraScanner(rules = rules), sections = sections)
def _generator(self):
rules = self.process_yara_options(dict(self.config))
for offset, rule_name, name, value in self.scan(context = self.context, layer_name = self.config['primary'],
rules = rules):
yield (0, (format_hints.Hex(offset), rule_name, name, value))
layer = self.context.layers[self.config['primary']]
for offset, rule_name, name, value in layer.scan(context = self.context, scanner = YaraScanner(rules = rules)):
yield 0, (format_hints.Hex(offset), rule_name, name, value)
def run(self):
return renderers.TreeGrid([('Offset', format_hints.Hex), ('Rule', str), ('Component', str), ('Value', bytes)],