WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-13 21:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1201 from volatilityfoundation/issues/issue1200

Browse Source 
Windows: Fix vadyarascan sanity check and bad documentation
This commit is contained in:
ikelos
2024-07-21 13:11:51 +01:00
committed by GitHub
parent 6043e740ca a5cf635fd8
commit d494df2673
1 changed files with 4 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/vadyarascan.py
+4 -5
View File
@@ -56,7 +56,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None))
sanity_check = 0x1000 * 0x1000 * 0x1000
sanity_check = 1024 * 1024 * 1024 # 1 GB
for task in pslist.PsList.list_processes(
context=self.context,
@@ -66,15 +66,14 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
):
layer_name = task.add_process_layer()
layer = self.context.layers[layer_name]
for start, end in self.get_vad_maps(task):
size = end - start
for start, size in self.get_vad_maps(task):
if size > sanity_check:
vollog.warn(
f"VAD at 0x{start:x} over sanity-check size, not scanning"
)
continue
for match in rules.match(data=layer.read(start, end - start, True)):
for match in rules.match(data=layer.read(start, size, True)):
if yarascan.YaraScan.yara_returns_instances():
for match_string in match.strings:
for instance in match_string.instances:
@@ -106,7 +105,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
task: The EPROCESS object of which to traverse the vad tree
Returns:
An iterable of tuples containing start and end addresses for each descriptor
An iterable of tuples containing start and size for each descriptor
"""
vad_root = task.get_vad_root()
for vad in vad_root.traverse():