From 5c8bd3c9d9b303e5a626fda9742b020ed5db1637 Mon Sep 17 00:00:00 2001 From: Arcuri Davide Date: Fri, 12 Mar 2021 11:30:04 +0100 Subject: [PATCH 1/2] enable support for compiled rules --- volatility3/framework/plugins/yarascan.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/volatility3/framework/plugins/yarascan.py b/volatility3/framework/plugins/yarascan.py index 1c04e2311..b30279d82 100644 --- a/volatility3/framework/plugins/yarascan.py +++ b/volatility3/framework/plugins/yarascan.py @@ -58,6 +58,7 @@ class YaraScan(plugins.PluginInterface): description = "Yara rules (as a string)", optional = True), requirements.URIRequirement(name = "yara_file", description = "Yara rules (as a file)", optional = True), + requirements.URIRequirement(name = "yara_compiled_file", description = "Yara compiled rules (as a file)", optional = True), requirements.IntRequirement(name = "max_size", default = 0x40000000, description = "Set the maximum size (default is 1GB)", @@ -78,6 +79,8 @@ class YaraScan(plugins.PluginInterface): rules = yara.compile(sources = {'n': 'rule r1 {{strings: $a = {} condition: $a}}'.format(rule)}) elif config.get('yara_file', None) is not None: rules = yara.compile(file = resources.ResourceAccessor().open(config['yara_file'], "rb")) + elif config.get('yara_compiled_file', None) is not None: + rules = yara.load(file = resources.ResourceAccessor().open(config['yara_file'], "rb")) else: vollog.error("No yara rules, nor yara rules file were specified") return rules From cd3ad1e067f981c04e5b795c1bfa3550feafdfd1 Mon Sep 17 00:00:00 2001 From: dadokkio Date: Fri, 12 Mar 2021 13:09:38 +0100 Subject: [PATCH 2/2] fix config --- volatility3/framework/plugins/yarascan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/yarascan.py b/volatility3/framework/plugins/yarascan.py index b30279d82..b3c3acddf 100644 --- a/volatility3/framework/plugins/yarascan.py +++ b/volatility3/framework/plugins/yarascan.py @@ -80,7 +80,7 @@ class YaraScan(plugins.PluginInterface): elif config.get('yara_file', None) is not None: rules = yara.compile(file = resources.ResourceAccessor().open(config['yara_file'], "rb")) elif config.get('yara_compiled_file', None) is not None: - rules = yara.load(file = resources.ResourceAccessor().open(config['yara_file'], "rb")) + rules = yara.load(file = resources.ResourceAccessor().open(config['yara_compiled_file'], "rb")) else: vollog.error("No yara rules, nor yara rules file were specified") return rules