mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-10 03:37:39 +02:00
generator overhead
This commit is contained in:
@@ -46,14 +46,12 @@ class RegExScan(plugins.PluginInterface):
|
||||
),
|
||||
]
|
||||
|
||||
def _generator(self, regex_pattern):
|
||||
regex_pattern = bytes(regex_pattern, "UTF-8")
|
||||
compiled_pattern = re.compile(regex_pattern)
|
||||
vollog.debug(f"RegEx Pattern: {regex_pattern}")
|
||||
maxsize = self.config.get("maxsize", self.MAXSIZE_DEFAULT)
|
||||
def _generator(self, compiled_pattern, raw_pattern, maxsize):
|
||||
vollog.debug(f"RegEx Pattern: {raw_pattern}")
|
||||
layer = self.context.layers[self.config["primary"]]
|
||||
|
||||
for offset in layer.scan(
|
||||
context=self.context, scanner=scanners.RegExScanner(regex_pattern)
|
||||
context=self.context, scanner=scanners.RegExScanner(raw_pattern)
|
||||
):
|
||||
result_data = layer.read(offset, maxsize, pad=True)
|
||||
|
||||
@@ -74,11 +72,37 @@ class RegExScan(plugins.PluginInterface):
|
||||
yield 0, (format_hints.Hex(offset), text_result, bytes_result)
|
||||
|
||||
def run(self):
|
||||
pattern = self.config.get("pattern")
|
||||
|
||||
# Handle pattern encoding robustly
|
||||
if isinstance(pattern, str):
|
||||
try:
|
||||
raw_pattern = pattern.encode("utf-8")
|
||||
except UnicodeEncodeError:
|
||||
raw_pattern = pattern.encode("latin1", errors="replace")
|
||||
else:
|
||||
raw_pattern = pattern
|
||||
|
||||
try:
|
||||
compiled_pattern = re.compile(raw_pattern)
|
||||
except re.error as e:
|
||||
vollog.error(f"Invalid regex pattern: {e}")
|
||||
return renderers.TreeGrid(
|
||||
[
|
||||
("Offset", format_hints.Hex),
|
||||
("Text", str),
|
||||
("Hex", bytes),
|
||||
],
|
||||
[],
|
||||
)
|
||||
|
||||
maxsize = self.config.get("maxsize", self.MAXSIZE_DEFAULT)
|
||||
|
||||
return renderers.TreeGrid(
|
||||
[
|
||||
("Offset", format_hints.Hex),
|
||||
("Text", str),
|
||||
("Hex", bytes),
|
||||
],
|
||||
self._generator(self.config.get("pattern")),
|
||||
self._generator(compiled_pattern, raw_pattern, maxsize),
|
||||
)
|
||||
|
||||
Reference in New Issue
Block a user