WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-17 20:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Various: Update yarascan plugins to output LayerData instead of just bytes

Browse Source
This commit is contained in:
Mike Auty
2025-03-23 00:42:13 +00:00
parent 6f599fa645
commit e86981c880
3 changed files with 30 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/linux/vmayarascan.py
+10 -4
View File
@@ -17,8 +17,8 @@ vollog = logging.getLogger(__name__)
class VmaYaraScan(interfaces.plugins.PluginInterface):
"""Scans all virtual memory areas for tasks using yara."""
_required_framework_version = (2, 4, 0)
_version = (1, 0, 3)
_required_framework_version = (2, 22, 0)
_version = (1, 0, 4)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
@@ -97,12 +97,18 @@ class VmaYaraScan(interfaces.plugins.PluginInterface):
for offset, rule_name, name, value in scanner(
proc_layer.read(start, size, pad=True), start
):
layer_data = renderers.LayerData(
context=self.context,
offset=offset,
layer_name=proc_layer.name,
length=len(value),
)
yield 0, (
format_hints.Hex(offset),
task.tgid,
rule_name,
name,
value,
layer_data,
)
@classmethod
@@ -130,7 +136,7 @@ class VmaYaraScan(interfaces.plugins.PluginInterface):
("PID", int),
("Rule", str),
("Component", str),
("Value", bytes),
("Value", renderers.LayerData),
],
self._generator(),
)
volatility3/framework/plugins/windows/vadyarascan.py
+10 -4
View File
@@ -17,8 +17,8 @@ vollog = logging.getLogger(__name__)
class VadYaraScan(interfaces.plugins.PluginInterface):
"""Scans all the Virtual Address Descriptor memory maps using yara."""
_required_framework_version = (2, 4, 0)
_version = (1, 1, 2)
_required_framework_version = (2, 22, 0)
_version = (1, 1, 3)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
@@ -93,12 +93,18 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
for offset, rule_name, name, value in scanner(
layer.read(start, size, pad=True), start
):
layer_data = renderers.LayerData(
context=self.context,
offset=offset,
layer_name=layer.name,
length=len(value),
)
yield 0, (
format_hints.Hex(offset),
task.UniqueProcessId,
rule_name,
name,
value,
layer_data,
)
@classmethod
@@ -126,7 +132,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
("PID", int),
("Rule", str),
("Component", str),
("Value", bytes),
("Value", renderers.LayerData),
],
self._generator(),
)
volatility3/framework/plugins/yarascan.py
+10 -4
View File
@@ -105,8 +105,8 @@ class YaraScanner(interfaces.layers.ScannerInterface):
class YaraScan(plugins.PluginInterface):
"""Scans kernel memory using yara rules (string or file)."""
_required_framework_version = (2, 0, 0)
_version = (2, 0, 0)
_required_framework_version = (2, 22, 0)
_version = (2, 0, 1)
_yara_x = USE_YARA_X
@classmethod
@@ -201,7 +201,13 @@ class YaraScan(plugins.PluginInterface):
for offset, rule_name, name, value in layer.scan(
context=self.context, scanner=YaraScanner(rules=rules)
):
yield 0, (format_hints.Hex(offset), rule_name, name, value)
layer_data = renderers.LayerData(
context=self.context,
offset=offset,
layer_name=layer.name,
length=len(value),
)
yield 0, (format_hints.Hex(offset), rule_name, name, layer_data)
def run(self):
return renderers.TreeGrid(
@@ -209,7 +215,7 @@ class YaraScan(plugins.PluginInterface):
("Offset", format_hints.Hex),
("Rule", str),
("Component", str),
("Value", bytes),
("Value", renderers.LayerData),
],
self._generator(),
)