From fa26dbf6598de23989836c1d0ed7e3a5f29c4e7a Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 4 Dec 2019 23:14:06 +0000 Subject: [PATCH] Yarascan: Make generic yarascan just scan kernel memory. --- volatility/framework/plugins/yarascan.py | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/volatility/framework/plugins/yarascan.py b/volatility/framework/plugins/yarascan.py index 9f6a3267e..ca552a8da 100644 --- a/volatility/framework/plugins/yarascan.py +++ b/volatility/framework/plugins/yarascan.py @@ -34,7 +34,7 @@ class YaraScanner(interfaces.layers.ScannerInterface): class YaraScan(plugins.PluginInterface): - """Scans memory using yara rules (string or file).""" + """Scans kernel memory using yara rules (string or file).""" @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -42,18 +42,10 @@ class YaraScan(plugins.PluginInterface): requirements.TranslationLayerRequirement(name = 'primary', description = "Memory layer for the kernel", architectures = ["Intel32", "Intel64"]), - requirements.BooleanRequirement(name = "all", - description = "Scan both process and kernel memory", - default = False, - optional = True), requirements.BooleanRequirement(name = "insensitive", description = "Makes the search case insensitive", default = False, optional = True), - requirements.BooleanRequirement(name = "kernel", - description = "Scan kernel modules", - default = False, - optional = True), requirements.BooleanRequirement(name = "wide", description = "Match wide (unicode) strings", default = False,