WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 03:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Yarascan: Fixes #209 by returning matched strings

Browse Source
This commit is contained in:
Mike Auty
2020-04-14 23:45:08 +01:00
parent 15d26ce415
commit edecd64703
2 changed files with 11 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/vadyarascan.py
+6 -5
View File
@@ -75,10 +75,10 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
filter_func = filter_func):
layer_name = task.add_process_layer()
layer = self.context.layers[layer_name]
for offset, name in layer.scan(context = self.context,
scanner = yarascan.YaraScanner(rules = rules),
sections = self.get_vad_maps(task)):
yield (0, (format_hints.Hex(offset), task.UniqueProcessId, name))
for offset, name, value in layer.scan(context = self.context,
scanner = yarascan.YaraScanner(rules = rules),
sections = self.get_vad_maps(task)):
yield (0, (format_hints.Hex(offset), task.UniqueProcessId, name, value))
@staticmethod
def get_vad_maps(task: interfaces.objects.ObjectInterface) -> Iterable[Tuple[int, int]]:
@@ -98,4 +98,5 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
yield (start, end - start)
def run(self):
return renderers.TreeGrid([('Offset', format_hints.Hex), ('Pid', int), ('Rule', str)], self._generator())
return renderers.TreeGrid([('Offset', format_hints.Hex), ('Pid', int), ('Rule', str), ('Value', bytes)],
self._generator())
volatility/framework/plugins/yarascan.py
+5 -5
View File
@@ -27,10 +27,10 @@ class YaraScanner(interfaces.layers.ScannerInterface):
super().__init__()
self._rules = rules
def __call__(self, data: bytes, data_offset: int) -> Iterable[Tuple[int, str]]:
def __call__(self, data: bytes, data_offset: int) -> Iterable[Tuple[int, str, bytes]]:
for match in self._rules.match(data = data):
for offset, name, value in match.strings:
yield (offset + data_offset, name)
yield (offset + data_offset, name, value)
class YaraScan(plugins.PluginInterface):
@@ -78,8 +78,8 @@ class YaraScan(plugins.PluginInterface):
else:
vollog.error("No yara rules, nor yara rules file were specified")
for offset, name in layer.scan(context = self.context, scanner = YaraScanner(rules = rules)):
yield (0, (format_hints.Hex(offset), name))
for offset, name, value in layer.scan(context = self.context, scanner = YaraScanner(rules = rules)):
yield (0, (format_hints.Hex(offset), name, value))
def run(self):
return renderers.TreeGrid([('Offset', format_hints.Hex), ('Rule', str)], self._generator())
return renderers.TreeGrid([('Offset', format_hints.Hex), ('Rule', str), ('Value', bytes)], self._generator())