From 88bddbd5965d895e0a787b2d237fb1ed4a4c973c Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 15 Mar 2021 22:56:40 +0000 Subject: [PATCH] Windows: Clarify separate yara compiled method --- volatility3/framework/plugins/yarascan.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/volatility3/framework/plugins/yarascan.py b/volatility3/framework/plugins/yarascan.py index b3c3acddf..ca8a91f84 100644 --- a/volatility3/framework/plugins/yarascan.py +++ b/volatility3/framework/plugins/yarascan.py @@ -58,6 +58,8 @@ class YaraScan(plugins.PluginInterface): description = "Yara rules (as a string)", optional = True), requirements.URIRequirement(name = "yara_file", description = "Yara rules (as a file)", optional = True), + # This additional requirement is to follow suit with upstream, who feel that compiled rules could potentially be used to execute malicious code + # As such, there's a separate option to run compiled files, as happened with yara-3.9 and later requirements.URIRequirement(name = "yara_compiled_file", description = "Yara compiled rules (as a file)", optional = True), requirements.IntRequirement(name = "max_size", default = 0x40000000,