WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-17 20:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #477 from dadokkio/develop

Browse Source 
enable support for compiled rules in Yara
This commit is contained in:
ikelos
2021-03-15 22:54:55 +00:00
committed by GitHub
parent 0a7a749667 cd3ad1e067
commit c75bef2b05
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/yarascan.py
+3
View File
@@ -58,6 +58,7 @@ class YaraScan(plugins.PluginInterface):
description = "Yara rules (as a string)",
optional = True),
requirements.URIRequirement(name = "yara_file", description = "Yara rules (as a file)", optional = True),
requirements.URIRequirement(name = "yara_compiled_file", description = "Yara compiled rules (as a file)", optional = True),
requirements.IntRequirement(name = "max_size",
default = 0x40000000,
description = "Set the maximum size (default is 1GB)",
@@ -78,6 +79,8 @@ class YaraScan(plugins.PluginInterface):
rules = yara.compile(sources = {'n': 'rule r1 {{strings: $a = {} condition: $a}}'.format(rule)})
elif config.get('yara_file', None) is not None:
rules = yara.compile(file = resources.ResourceAccessor().open(config['yara_file'], "rb"))
elif config.get('yara_compiled_file', None) is not None:
rules = yara.load(file = resources.ResourceAccessor().open(config['yara_compiled_file'], "rb"))
else:
vollog.error("No yara rules, nor yara rules file were specified")
return rules