From 6da80760508d14f0d8ba3dff934ffc7e55642a34 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 6 May 2017 14:02:09 +0100 Subject: [PATCH] Add in Regular Expression scanner. --- volatility/framework/layers/scanners.py | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/volatility/framework/layers/scanners.py b/volatility/framework/layers/scanners.py index 40ba6d87f..054360ba3 100644 --- a/volatility/framework/layers/scanners.py +++ b/volatility/framework/layers/scanners.py @@ -1,3 +1,5 @@ +import re + from volatility.framework.interfaces import layers @@ -15,3 +17,20 @@ class BytesScanner(layers.ScannerInterface): while find_pos >= 0: yield find_pos + data_offset find_pos = data.find(self.needle, find_pos + 1) + + +class RegExScanner(layers.ScannerInterface): + thread_safe = False + + def __init__(self, pattern, flags = 0): + super().__init__() + self.regex = re.compile(self._check_type(pattern, bytes), self._check_type(flags, int)) + + def __call__(self, data, data_offset): + """Runs through the data looking for the needle, and yields all offsets where the needle is found + """ + find_pos = self.regex.finditer(data) + find_pos = list(find_pos) + for match in find_pos: + offset = match.start() + yield offset + data_offset