[ #gddlZddlmZmZmZmZmZddlmZm Z ddl m Z ddl m Z ddlmZddlmZej$eZdZ ddlZd ZGddej<j>Z Gdde jBZ"y#e$rb ddlZed ej4j7d Dd kreej9d n#e$rej;dwxYwYwxYw)N)AnyDictIterableListTuple) interfaces renderers) requirements)plugins) resources) format_hintsFTc#2K|]}t|ywNint.0xs X/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/yarascan.py rs=AQ=.)zUsing yara-python modulezfNeither yara-x nor yara-python (>3.8.0) module not found, plugin (and dependent plugins) not availablec |eZdZdZd fd Zdededeeee e effdZ e dZ e dZ e d ZxZS) YaraScanner)rreturnct|| td||_trd|_ yt dt jjdDdk |_ y)Nz No rules provided to YaraScannerc32K|]}t|ywrrrs rrz'YaraScanner.__init__..3sGa3q6Grrr) super__init__ ValueError_rules USE_YARA_Xtupleyara __version__split st_object)selfrules __class__s rr%zYaraScanner.__init__+sg  =?@ @   G4+;+;+A+A#+FGG&PP data data_offsetc #Ktr|jj|jD]}|jD]o}|j D]^}|j |z|jd|j|j||j |j |jzf`qy|jj|D]}tjrV|jD]F}|jD]5}|j |z|j|j|j f7Hm|jD]\}}}||z|j||fyw)Nr)r2)r(r'scanmatching_rulespatternsmatchesoffset namespace identifierlengthmatchYaraScanyara_returns_instancesstrings instancesrule matched_data) r.r2r3r= match_stringinstancer9namevalues r__call__zYaraScanner.__call__6sB ))$/>>$)NNL$0$8$8$OOk9$/q1A1A0BC(33 8??X__3TU %9%3?***5224(- (4(>(>H (+ = % , 7 7 ( 5 5 #)?)605}}+e% 3UZZuMM0=6sE&E(cxtrtjd|dStjdd|diS)Nzrule r1 {strings: $a = z condition: $a}n)sources)r(yara_xcompiler*)rBs rget_rulezYaraScanner.get_ruleRsC >>$ &"||44"4= & &99"% & & &s&A4A44A=c"tjj|d5}tr:t j |j jcdddStj |cdddS#1swYyxYwrP) r rSrTr(rLrMreaddecoder*rXs r from_filezYaraScanner.from_fileash  ' ' ) . .x > )"~~bggi&6&6&89 ) )<z6Scans kernel memory using yara rules (string or file).)rrrrcZ|jtjddddggzS)zReturns the requirements needed to run yarascan directly, combining the TranslationLayerRequirement and the requirements from get_yarascan_option_requirements.primaryzMemory layer for the kernelIntel32Intel64)rF description architectures) get_yarascan_option_requirementsr TranslationLayerRequirementclss rget_requirementszYaraScan.get_requirementsps;335  4 49()4 9   r1c  tjddddtjddddtjdd d tjd d d tjd dd tjddddgS)zReturns the requirements needed for the command lines options used by yarascan. This can then also be used by other plugins that are using yarascan. This does not include a TranslationLayerRequirement or a ModuleRequirement. insensitivez!Makes the search case insensitiveFT)rFrmdefaultoptionalwidezMatch wide (unicode) strings yara_stringzYara rules (as a string))rFrmrw yara_filezYara rules (as a file)yara_compiled_filezYara compiled rules (as a file)max_sizei@z%Set the maximum size (default is 1GB))rFrvrmrw)r BooleanRequirementStringRequirementURIRequirementIntRequirementrqs rroz)YaraScan.get_yarascan_option_requirements|s  + +"?    + +:    * *"6   ' ' 4   ' ')=   ' '"C  =$ $ r1chtdtjjdDdk S)Nc32K|]}t|ywrrrs rrz2YaraScan.yara_returns_instances..sEAQErrr")r)r*r+r,rqs rr?zYaraScan.yara_returns_instancess,E)9)9)?)?)DEENNNr1configc8d}|jdW|d}|ddvrd|d}|jddr|dz }|jddr|d z }tj|}|S|jd E ZZ, - 9 LL!&)=">!?{:,W  226:N3OPE  LLL M r1c#<K|jt|j}|jj|jd}|j |jt |D]$\}}}}dtj||||ff&yw)Nrj)r/)contextscannerr) rdictrrlayersr5rr Hex)r.r/layerr9 rule_namerFrGs r _generatorzYaraScan._generators))$t{{*;< ##DKK $:;.3jjLL+E*B/9/ *FItUl&&v. 4GG G/ sBBctjdtjfdtfdtfdt fg|j S)NOffsetRule ComponentValue)r TreeGridr rrerdr)r.s rrunz YaraScan.runsK!!<++, c"%   OO   r1N)r`rarb__doc___required_framework_versionrcr(_yara_x classmethodrr configurationRequirementInterfacersroboolr?rrerrrrr1rr>r>is@"+HG  j&>&>&S&S!T    * j&&;; <* * XOtOO$sCx..H  r1r>)#loggingtypingrrrrrvolatility3.frameworkrr #volatility3.framework.configurationr volatility3.framework.interfacesr volatility3.framework.layersr volatility3.framework.renderersr getLoggerr`rr(rL ImportErrorr*r)r+r,rinforScannerInterfacerPluginInterfacer>rr1rrs 337<428   8 $  J$?)*##44?)Dn w&&n e   =!1!1!7!7!<= = F  /0  t    1 s+BC* AC  C* C$$C*)C*