volatility3/volatility/framework/layers/scanners.py

import re

from volatility.framework.interfaces import layers


class BytesScanner(layers.ScannerInterface):
    thread_safe = True

    def __init__(self, needle):
        super().__init__()
        self.needle = self._check_type(needle, bytes)

    def __call__(self, data, data_offset):
        """Runs through the data looking for the needle, and yields all offsets where the needle is found
        """
        find_pos = data.find(self.needle)
        while find_pos >= 0:
            yield find_pos + data_offset
            find_pos = data.find(self.needle, find_pos + 1)


class RegExScanner(layers.ScannerInterface):
    thread_safe = False

    def __init__(self, pattern, flags = 0):
        super().__init__()
        self.regex = re.compile(self._check_type(pattern, bytes), self._check_type(flags, int))

    def __call__(self, data, data_offset):
        """Runs through the data looking for the needle, and yields all offsets where the needle is found
        """
        find_pos = self.regex.finditer(data)
        find_pos = list(find_pos)
        for match in find_pos:
            offset = match.start()
            yield offset + data_offset