Add in Regular Expression scanner.

volatility/framework/layers/scanners.py

@@ -1,3 +1,5 @@
+import re
+
 from volatility.framework.interfaces import layers
 
 
@@ -15,3 +17,20 @@ class BytesScanner(layers.ScannerInterface):
         while find_pos >= 0:
             yield find_pos + data_offset
             find_pos = data.find(self.needle, find_pos + 1)
+
+
+class RegExScanner(layers.ScannerInterface):
+    thread_safe = False
+
+    def __init__(self, pattern, flags = 0):
+        super().__init__()
+        self.regex = re.compile(self._check_type(pattern, bytes), self._check_type(flags, int))
+
+    def __call__(self, data, data_offset):
+        """Runs through the data looking for the needle, and yields all offsets where the needle is found
+        """
+        find_pos = self.regex.finditer(data)
+        find_pos = list(find_pos)
+        for match in find_pos:
+            offset = match.start()
+            yield offset + data_offset