WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-26 16:12:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update for the new classmethod model.

Browse Source
This commit is contained in:
Mike Auty
2018-06-17 11:16:27 +01:00
committed by ikelos
parent a1caf8d149
commit f28ee6077e
2 changed files with 21 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/plugins/windows/vadyarascan.py
+11 -4
View File
@@ -2,7 +2,7 @@ import logging
import typing
import yara
from volatility.framework import interfaces, layers
from volatility.framework import interfaces, layers, renderers
from volatility.framework.renderers import format_hints
from volatility.framework.symbols.windows import extensions
from volatility.plugins import yarascan
@@ -15,7 +15,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
@classmethod
def get_requirements(cls):
return yarascan.YaraScan.get_requirements()
return yarascan.YaraScan.get_requirements() + pslist.PsList.get_requirements()
def _generator(self):
@@ -35,9 +35,12 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
else:
vollog.error("No yara rules, nor yara rules file were specified")
plugin = pslist.PsList(self.context, self.config_path)
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
for task in plugin.list_processes():
for task in pslist.PsList.list_processes(self.context,
self.config['primary'],
self.config['nt_symbols'],
filter = filter):
for offset, name in layer.scan(context = self.context,
scanner = yarascan.YaraScanner(rules = rules),
max_address = self.config['max_size'],
@@ -68,3 +71,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
yield [(layer_name, start, end - start)], end
return scan_iterator
def run(self):
return renderers.TreeGrid([('Offset', format_hints.Hex),
('Rule', str)], self._generator())
volatility/plugins/yarascan.py
+10 -5
View File
@@ -39,16 +39,20 @@ class YaraScan(plugins.PluginInterface):
architectures = ["Intel32", "Intel64"]),
requirements.BooleanRequirement(name = "all",
description = "Scan both process and kernel memory",
default = False),
default = False,
optional = True),
requirements.BooleanRequirement(name = "insensitive",
description = "Makes the search case insensitive",
default = False),
default = False,
optional = True),
requirements.BooleanRequirement(name = "kernel",
description = "Scan kernel modules",
default = False),
default = False,
optional = True),
requirements.BooleanRequirement(name = "wide",
description = "Match wide (unicode) strings",
default = False),
default = False,
optional = True),
requirements.StringRequirement(name = "yara_rules",
description = "Yara rules (as a string)",
optional = True),
@@ -57,7 +61,8 @@ class YaraScan(plugins.PluginInterface):
optional = True),
requirements.IntRequirement(name = "max_size",
default = 0x40000000,
description = "Set the maximum size (default is 1GB)")
description = "Set the maximum size (default is 1GB)",
optional = True)
]
def _generator(self):