WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 03:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Yarascan: Make generic yarascan just scan kernel memory.

Browse Source
This commit is contained in:
Mike Auty
2019-12-04 23:17:10 +00:00
committed by ikelos
parent f34958a16d
commit fa26dbf659
1 changed files with 1 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/yarascan.py
+1 -9
View File
@@ -34,7 +34,7 @@ class YaraScanner(interfaces.layers.ScannerInterface):
class YaraScan(plugins.PluginInterface):
"""Scans memory using yara rules (string or file)."""
"""Scans kernel memory using yara rules (string or file)."""
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
@@ -42,18 +42,10 @@ class YaraScan(plugins.PluginInterface):
requirements.TranslationLayerRequirement(name = 'primary',
description = "Memory layer for the kernel",
architectures = ["Intel32", "Intel64"]),
requirements.BooleanRequirement(name = "all",
description = "Scan both process and kernel memory",
default = False,
optional = True),
requirements.BooleanRequirement(name = "insensitive",
description = "Makes the search case insensitive",
default = False,
optional = True),
requirements.BooleanRequirement(name = "kernel",
description = "Scan kernel modules",
default = False,
optional = True),
requirements.BooleanRequirement(name = "wide",
description = "Match wide (unicode) strings",
default = False,