WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-29 04:54:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

Yarascan: Fixes #209 by returning matched strings

Browse Source
This commit is contained in:
Mike Auty
2020-04-14 23:45:08 +01:00
parent 15d26ce415
commit edecd64703
2 changed files with 11 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/vadyarascan.py
+6 -5
View File
@@ -75,10 +75,10 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
filter_func = filter_func):
layer_name = task.add_process_layer()
layer = self.context.layers[layer_name]
for offset, name in layer.scan(context = self.context,
scanner = yarascan.YaraScanner(rules = rules),
sections = self.get_vad_maps(task)):
yield (0, (format_hints.Hex(offset), task.UniqueProcessId, name))
for offset, name, value in layer.scan(context = self.context,
scanner = yarascan.YaraScanner(rules = rules),
sections = self.get_vad_maps(task)):
yield (0, (format_hints.Hex(offset), task.UniqueProcessId, name, value))
@staticmethod
def get_vad_maps(task: interfaces.objects.ObjectInterface) -> Iterable[Tuple[int, int]]:
@@ -98,4 +98,5 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
yield (start, end - start)
def run(self):
return renderers.TreeGrid([('Offset', format_hints.Hex), ('Pid', int), ('Rule', str)], self._generator())
return renderers.TreeGrid([('Offset', format_hints.Hex), ('Pid', int), ('Rule', str), ('Value', bytes)],
self._generator())