diff --git a/volatility3/framework/plugins/regexscan.py b/volatility3/framework/plugins/regexscan.py index 4df00a583..e95986899 100644 --- a/volatility3/framework/plugins/regexscan.py +++ b/volatility3/framework/plugins/regexscan.py @@ -46,14 +46,12 @@ class RegExScan(plugins.PluginInterface): ), ] - def _generator(self, regex_pattern): - regex_pattern = bytes(regex_pattern, "UTF-8") - compiled_pattern = re.compile(regex_pattern) - vollog.debug(f"RegEx Pattern: {regex_pattern}") - maxsize = self.config.get("maxsize", self.MAXSIZE_DEFAULT) + def _generator(self, compiled_pattern, raw_pattern, maxsize): + vollog.debug(f"RegEx Pattern: {raw_pattern}") layer = self.context.layers[self.config["primary"]] + for offset in layer.scan( - context=self.context, scanner=scanners.RegExScanner(regex_pattern) + context=self.context, scanner=scanners.RegExScanner(raw_pattern) ): result_data = layer.read(offset, maxsize, pad=True) @@ -74,11 +72,37 @@ class RegExScan(plugins.PluginInterface): yield 0, (format_hints.Hex(offset), text_result, bytes_result) def run(self): + pattern = self.config.get("pattern") + + # Handle pattern encoding robustly + if isinstance(pattern, str): + try: + raw_pattern = pattern.encode("utf-8") + except UnicodeEncodeError: + raw_pattern = pattern.encode("latin1", errors="replace") + else: + raw_pattern = pattern + + try: + compiled_pattern = re.compile(raw_pattern) + except re.error as e: + vollog.error(f"Invalid regex pattern: {e}") + return renderers.TreeGrid( + [ + ("Offset", format_hints.Hex), + ("Text", str), + ("Hex", bytes), + ], + [], + ) + + maxsize = self.config.get("maxsize", self.MAXSIZE_DEFAULT) + return renderers.TreeGrid( [ ("Offset", format_hints.Hex), ("Text", str), ("Hex", bytes), ], - self._generator(self.config.get("pattern")), + self._generator(compiled_pattern, raw_pattern, maxsize), )