diff --git a/volatility/plugins/windows/vadyarascan.py b/volatility/plugins/windows/vadyarascan.py index a6664e3a7..7147bace9 100644 --- a/volatility/plugins/windows/vadyarascan.py +++ b/volatility/plugins/windows/vadyarascan.py @@ -2,7 +2,7 @@ import logging import typing import yara -from volatility.framework import interfaces, layers +from volatility.framework import interfaces, layers, renderers from volatility.framework.renderers import format_hints from volatility.framework.symbols.windows import extensions from volatility.plugins import yarascan @@ -15,7 +15,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface): @classmethod def get_requirements(cls): - return yarascan.YaraScan.get_requirements() + return yarascan.YaraScan.get_requirements() + pslist.PsList.get_requirements() def _generator(self): @@ -35,9 +35,12 @@ class VadYaraScan(interfaces.plugins.PluginInterface): else: vollog.error("No yara rules, nor yara rules file were specified") - plugin = pslist.PsList(self.context, self.config_path) + filter = pslist.PsList.create_filter([self.config.get('pid', None)]) - for task in plugin.list_processes(): + for task in pslist.PsList.list_processes(self.context, + self.config['primary'], + self.config['nt_symbols'], + filter = filter): for offset, name in layer.scan(context = self.context, scanner = yarascan.YaraScanner(rules = rules), max_address = self.config['max_size'], @@ -68,3 +71,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface): yield [(layer_name, start, end - start)], end return scan_iterator + + def run(self): + return renderers.TreeGrid([('Offset', format_hints.Hex), + ('Rule', str)], self._generator()) diff --git a/volatility/plugins/yarascan.py b/volatility/plugins/yarascan.py index c09358760..897391621 100644 --- a/volatility/plugins/yarascan.py +++ b/volatility/plugins/yarascan.py @@ -39,16 +39,20 @@ class YaraScan(plugins.PluginInterface): architectures = ["Intel32", "Intel64"]), requirements.BooleanRequirement(name = "all", description = "Scan both process and kernel memory", - default = False), + default = False, + optional = True), requirements.BooleanRequirement(name = "insensitive", description = "Makes the search case insensitive", - default = False), + default = False, + optional = True), requirements.BooleanRequirement(name = "kernel", description = "Scan kernel modules", - default = False), + default = False, + optional = True), requirements.BooleanRequirement(name = "wide", description = "Match wide (unicode) strings", - default = False), + default = False, + optional = True), requirements.StringRequirement(name = "yara_rules", description = "Yara rules (as a string)", optional = True), @@ -57,7 +61,8 @@ class YaraScan(plugins.PluginInterface): optional = True), requirements.IntRequirement(name = "max_size", default = 0x40000000, - description = "Set the maximum size (default is 1GB)") + description = "Set the maximum size (default is 1GB)", + optional = True) ] def _generator(self):