
    Xf                        d dl Z d dlmZmZmZmZmZ d dlmZm	Z	 d dl
mZ d dlmZ d dlmZ d dlmZ  e j        e          Z	 d dlZ ed ej                            d	          D                       d
k     ren# e$ r e                    d            w xY w G d dej        j                  Z G d dej                  ZdS )    N)AnyDictIterableListTuple)
interfaces	renderers)requirements)plugins)	resources)format_hintsc                 ,    g | ]}t          |          S  int.0xs     X/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/yarascan.py
<listcomp>r      s    :::c!ff:::    .)      zSPython Yara (>3.8.0) module not found, plugin (and dependent plugins) not availablec                   X     e Zd ZdZd fdZdededeeee	e	ef                  fdZ
 xZS )	YaraScanner   r   r   returnNc                     t                                                       |t          d          || _        t	          d t
          j                            d          D                       dk      | _        d S )Nz No rules provided to YaraScannerc                 ,    g | ]}t          |          S r   r   r   s     r   r   z(YaraScanner.__init__.<locals>.<listcomp>%   s    #P#P#PqCFF#P#P#Pr   r   )   r   )	super__init__
ValueError_rulestupleyara__version__split	st_object)selfrules	__class__s     r   r$   zYaraScanner.__init__    sw    =?@@@"#P#PD4D4J4J34O4O#P#P#PQQ U
 
 
r   datadata_offsetc              #      K   | j                             |          D ][}| j        r4|j        D ]+}|j        D ]!}|j        |z   |j        |j        |j        fV  ",=|j        D ]\  }}}||z   |j        ||fV  \d S )N)r/   )	r&   matchr+   strings	instancesoffsetrule
identifiermatched_data)	r,   r/   r0   r2   match_stringinstancer5   namevalues	            r   __call__zYaraScanner.__call__*   s       [&&D&11 	J 	JE~ J$)M  L$0$:  $Ok9!J(3$1	     ,1= J J'FD%!K/T5IIIIIJ	J 	Jr   )r   N)__name__
__module____qualname___versionr$   bytesr   r   r   strr=   __classcell__)r.   s   @r   r   r      s        H
 
 
 
 
 
JJ(+J	%S#u,-	.J J J J J J J Jr   r   c                       e Zd ZdZdZdZedeej	        j
                 fd            Zedeej	        j
                 fd            Zedeeef         fd            Zd	 Zd
 ZdS )YaraScanz6Scans kernel memory using yara rules (string or file).r   )   r   r   r   c                 `    |                                  t          j        ddddg          gz   S )zReturns the requirements needed to run yarascan directly, combining the TranslationLayerRequirement
        and the requirements from get_yarascan_option_requirements.primaryzMemory layer for the kernelIntel32Intel64)r;   descriptionarchitectures) get_yarascan_option_requirementsr
   TranslationLayerRequirementclss    r   get_requirementszYaraScan.get_requirementsE   sE     335549()4  9
 
 	
r   c                    t          j        dddd          t          j        dddd          t          j        dd	d
          t          j        ddd
          t          j        ddd
          t          j        dddd          gS )zReturns the requirements needed for the command lines options used by yarascan. This can
        then also be used by other plugins that are using yarascan. This does not include a
        TranslationLayerRequirement or a ModuleRequirement.insensitivez!Makes the search case insensitiveFT)r;   rL   defaultoptionalwidezMatch wide (unicode) strings
yara_ruleszYara rules (as a string))r;   rL   rV   	yara_filezYara rules (as a file)yara_compiled_filezYara compiled rules (as a file)max_sizei   @z%Set the maximum size (default is 1GB))r;   rU   rL   rV   )r
   BooleanRequirementStringRequirementURIRequirementIntRequirementrP   s    r   rN   z)YaraScan.get_yarascan_option_requirementsQ   s     +"?	   +:	   *!/ITX   ' .FQU  
 ')=  
 '"C	  5 
  	
r   configc                    d }|                     dd           j|d         }|d         dvrd| d}|                     dd          r|dz  }|                     dd          r|d	z  }t          j        d
d| di          }n|                     dd           t          j        |d                   }n|                     dd           At          j        t          j                                        |d         d                    }nq|                     dd           At          j        t          j                                        |d         d                    }nt                              d           |S )NrX   r   ){/"caseFz nocaserW   z wide asciinzrule r1 {strings: $a = z condition: $a})sourcesyara_source)sourcerY   rb)filerZ   z1No yara rules, nor yara rules file were specified)	getr(   compiler   ResourceAccessoropenloadvollogerror)rQ   r`   r-   r6   s       r   process_yara_optionszYaraScan.process_yara_optionsz   s   ::lD))5,'DAwj(("4{{{zz&%(( "	!zz&%(( &%LOOOOP  EE ZZt,,8L}(=>>>EEZZT**6L/1166vk7JDQQ  EE ZZ,d33?I/1166/0$   EE LLLMMMr   c              #   .  K   |                      t          | j                            }| j        j        | j        d                  }|                    | j        t          |                    D ]#\  }}}}dt          j        |          |||ffV  $d S )NrI   )r-   )contextscannerr   )	rs   dictr`   ru   layersscanr   r   Hex)r,   r-   layerr5   	rule_namer;   r<   s          r   
_generatorzYaraScan._generator   s      ))$t{*;*;<<#DK	$:;.3jjL+E*B*B*B /9 /
 /
 	H 	H*FItU l&v..	4GGGGGG	H 	Hr   c                     t          j        dt          j        fdt          fdt          fdt
          fg|                                           S )NOffsetRule	ComponentValue)r	   TreeGridr   rz   rC   rB   r}   )r,   s    r   runzYaraScan.run   sM    !<+,c"% 	 OO
 
 	
r   N)r>   r?   r@   __doc___required_framework_versionrA   classmethodr   r   configurationRequirementInterfacerR   rN   r   rC   r   rs   r}   r   r   r   r   rF   rF   <   s        @@"+H
 	
j&>&S!T 	
 	
 	
 [	
 &
	j&;	<&
 &
 &
 [&
P $sCx.    [:H H H	
 	
 	
 	
 	
r   rF   ) loggingtypingr   r   r   r   r   volatility3.frameworkr   r	   #volatility3.framework.configurationr
    volatility3.framework.interfacesr   volatility3.framework.layersr   volatility3.framework.renderersr   	getLoggerr>   rq   r(   r'   r)   r*   ImportErrorinforx   ScannerInterfacer   PluginInterfacerF   r   r   r   <module>r      s  
  3 3 3 3 3 3 3 3 3 3 3 3 3 3 7 7 7 7 7 7 7 7 < < < < < < 4 4 4 4 4 4 2 2 2 2 2 2 8 8 8 8 8 8		8	$	$	
KKKu::d.44S99:::;;fDD E 
 
 

KK]   
	
J J J J J*#4 J J J@n
 n
 n
 n
 n
w& n
 n
 n
 n
 n
s   7A< <B