WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 09:47:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Linux: Update vmayarascan to scan complete VMA blocks

Browse Source
This commit is contained in:
Mike Auty
2024-07-14 15:21:08 +01:00
parent 987ecaf5ed
commit d4585be7cf
1 changed files with 23 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/linux/vmayarascan.py
+23 -16
View File
@@ -33,9 +33,6 @@ class VmaYaraScan(interfaces.plugins.PluginInterface):
requirements.PluginRequirement(
name="yarascan", plugin=yarascan.YaraScan, version=(1, 2, 0)
),
requirements.VersionRequirement(
name="yarascanner", component=yarascan.YaraScanner, version=(2, 0, 0)
),
requirements.ModuleRequirement(
name="kernel",
description="Linux kernel",
@@ -69,19 +66,29 @@ class VmaYaraScan(interfaces.plugins.PluginInterface):
# get the proc_layer object from the context
proc_layer = self.context.layers[proc_layer_name]
# scan the process layer with the yarascanner
for offset, rule_name, name, value in proc_layer.scan(
context=self.context,
scanner=yarascan.YaraScanner(rules=rules),
sections=self.get_vma_maps(task),
):
yield 0, (
format_hints.Hex(offset),
task.tgid,
rule_name,
name,
value,
)
for start, end in self.get_vma_maps(task):
for match in rules.match(
data=proc_layer.read(start, end - start, True)
):
if yarascan.YaraScan.yara_returns_instances():
for match_string in match.strings:
for instance in match_string.instances:
yield 0, (
format_hints.Hex(instance.offset + start),
task.UniqueProcessId,
match.rule,
match_string.identifier,
instance.matched_data,
)
else:
for offset, name, value in match.strings:
yield 0, (
format_hints.Hex(offset + start),
task.tgid,
match.rule,
name,
value,
)
@staticmethod
def get_vma_maps(