From edecd647033413a6f9d9b93e8be9efd2b7e777a4 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 14 Apr 2020 23:45:08 +0100 Subject: [PATCH] Yarascan: Fixes #209 by returning matched strings --- volatility/framework/plugins/windows/vadyarascan.py | 11 ++++++----- volatility/framework/plugins/yarascan.py | 10 +++++----- 2 files changed, 11 insertions(+), 10 deletions(-) diff --git a/volatility/framework/plugins/windows/vadyarascan.py b/volatility/framework/plugins/windows/vadyarascan.py index d77809a7f..aae2e0bc0 100644 --- a/volatility/framework/plugins/windows/vadyarascan.py +++ b/volatility/framework/plugins/windows/vadyarascan.py @@ -75,10 +75,10 @@ class VadYaraScan(interfaces.plugins.PluginInterface): filter_func = filter_func): layer_name = task.add_process_layer() layer = self.context.layers[layer_name] - for offset, name in layer.scan(context = self.context, - scanner = yarascan.YaraScanner(rules = rules), - sections = self.get_vad_maps(task)): - yield (0, (format_hints.Hex(offset), task.UniqueProcessId, name)) + for offset, name, value in layer.scan(context = self.context, + scanner = yarascan.YaraScanner(rules = rules), + sections = self.get_vad_maps(task)): + yield (0, (format_hints.Hex(offset), task.UniqueProcessId, name, value)) @staticmethod def get_vad_maps(task: interfaces.objects.ObjectInterface) -> Iterable[Tuple[int, int]]: @@ -98,4 +98,5 @@ class VadYaraScan(interfaces.plugins.PluginInterface): yield (start, end - start) def run(self): - return renderers.TreeGrid([('Offset', format_hints.Hex), ('Pid', int), ('Rule', str)], self._generator()) + return renderers.TreeGrid([('Offset', format_hints.Hex), ('Pid', int), ('Rule', str), ('Value', bytes)], + self._generator()) diff --git a/volatility/framework/plugins/yarascan.py b/volatility/framework/plugins/yarascan.py index ca552a8da..245993b23 100644 --- a/volatility/framework/plugins/yarascan.py +++ b/volatility/framework/plugins/yarascan.py @@ -27,10 +27,10 @@ class YaraScanner(interfaces.layers.ScannerInterface): super().__init__() self._rules = rules - def __call__(self, data: bytes, data_offset: int) -> Iterable[Tuple[int, str]]: + def __call__(self, data: bytes, data_offset: int) -> Iterable[Tuple[int, str, bytes]]: for match in self._rules.match(data = data): for offset, name, value in match.strings: - yield (offset + data_offset, name) + yield (offset + data_offset, name, value) class YaraScan(plugins.PluginInterface): @@ -78,8 +78,8 @@ class YaraScan(plugins.PluginInterface): else: vollog.error("No yara rules, nor yara rules file were specified") - for offset, name in layer.scan(context = self.context, scanner = YaraScanner(rules = rules)): - yield (0, (format_hints.Hex(offset), name)) + for offset, name, value in layer.scan(context = self.context, scanner = YaraScanner(rules = rules)): + yield (0, (format_hints.Hex(offset), name, value)) def run(self): - return renderers.TreeGrid([('Offset', format_hints.Hex), ('Rule', str)], self._generator()) + return renderers.TreeGrid([('Offset', format_hints.Hex), ('Rule', str), ('Value', bytes)], self._generator())