Configuration Yara Rules

volatility3/framework/plugins/windows/mbrparser.py

@@ -2,13 +2,11 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 
-import datetime
 import logging
 
 from volatility3.framework import exceptions, interfaces, renderers
 from volatility3.framework.configuration import requirements
 from volatility3.framework.renderers import format_hints
-from volatility3.framework.symbols import intermed
 from volatility3.framework.symbols.windows.extensions import mbr
 from volatility3.plugins import yarascan
 
@@ -52,19 +50,13 @@ class MBRParser(interfaces.plugins.PluginInterface):
 
     def _generator(self):
         layer = self.context.layers[self.config['primary']]
-        rules = yarascan.YaraScan.process_yara_options({'yara_rules': '/\x55\xaa/'})
-        symbol_table = intermed.IntermediateSymbolTable.create(context = self.context,
-                                                               config_path = self.config_path,
-                                                               sub_path = "windows",
-                                                               filename = "mbr",
-                                                               class_types = {
-                                                                   'PARTITION_ENTRY': mbr.PARTITION_ENTRY,
-                                                               })
+        # TODO : YARA RULE HEX
+        rules = yarascan.YaraScan.process_yara_options({'yara_rules': "55 aa"})
 
         for offset, _rule_name, _name, _value in layer.scan(context = self.context,
                                                             scanner = yarascan.YaraScanner(rules = rules)):
             try:
-                yield 1, (format_hints.Hex(offset), _value)
+                yield 0, (format_hints.Hex(offset), _name)
 
             except exceptions.PagedInvalidAddressException:
                 pass
@@ -72,5 +64,5 @@ class MBRParser(interfaces.plugins.PluginInterface):
     def run(self):
         return renderers.TreeGrid([
             ('Offset', format_hints.Hex),
-            ('Record Type', str),
+            ("Name", str)
         ], self._generator())

volatility3/framework/symbols/windows/mbr.json

@@ -8,23 +8,49 @@
         },
         "format": "6.1.0"
     },
-    {
-        'PARTITION_ENTRY': [ 0x10, {
-            'BootableFlag': [0x0, ['char']],   # 0x80 is bootable
-            'StartingCHS': [0x1, ['array', 3, ['unsigned char']]],
-            'PartitionType': [0x4, ['char']],
-            'EndingCHS': [0x5, ['array', 3, ['unsigned char']]],
-            'StartingLBA': [0x8, ['unsigned int']],
-            'SizeInSectors': [0xc, ['int']],
-        }],
-        'PARTITION_TABLE': [ 0x200, {
-            'DiskSignature': [ 0x1b8, ['array', 4, ['unsigned char']]],
-            'Unused': [ 0x1bc, ['unsigned short']],
-            'Entry1': [ 0x1be, ['PARTITION_ENTRY']],
-            'Entry2': [ 0x1ce, ['PARTITION_ENTRY']],
-            'Entry3': [ 0x1de, ['PARTITION_ENTRY']],
-            'Entry4': [ 0x1ee, ['PARTITION_ENTRY']],
-            'Signature': [0x1fe, ['unsigned short']],
-        }]
-    }
+    "base_types": {
+        "unsigned long": {
+            "kind": "int", 
+            "size": 4, 
+            "signed": false, 
+            "endian": "little"
+        }, 
+        "unsigned long long": {
+            "kind": "int", 
+            "size": 8, 
+            "signed": false, 
+            "endian": "little"
+        }, 
+        "long": {
+            "kind": "int", 
+            "size": 4, 
+            "signed": true, 
+            "endian": "little"
+        },
+        "unsigned int": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        }, 
+        "unsigned short": {
+            "kind": "int", 
+            "size": 2, 
+            "signed": false, 
+            "endian": "little"
+        },
+        "unsigned char": {
+            "kind": "int", 
+            "size": 1, 
+            "signed": false, 
+            "endian": "little"
+        },
+        "wchar": {
+            "kind": "int", 
+            "size": 2, 
+            "signed": true, 
+            "endian": "little"
+        }
+      },
+      "symbols": {}
 }