:% fddlmZmZmZddlmZmZddlmZddl m Z ddl m Z ddl mZGddejjZd S) )IterableListTuple) interfaces renderers) requirements) format_hints)yarascan)pslistceZdZdZdZdZedeej j fdZ dZ e dejjdeeeeffdZd Zd S) VmaYaraScanz4Scans all virtual memory areas for tasks using yara.)r)rrreturnc ttjdtddtjdtjdtjdt jd tjd t j d tj d d gdg}t j }||zS)Npidz9Process IDs to include (all other processes are excluded)T)name element_type descriptionoptionalr )rrr)rpluginversionr )rrr yarascanner)r componentrkernelz Linux kernel)Intel32Intel64AArch64)rr architectures) rListRequirementintPluginRequirementr PsListr YaraScanVersionRequirement YaraScannerModuleRequirement get_yarascan_option_requirements)clsvmayarascan_requirementsyarascan_requirementss a/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/vmayarascan.pyget_requirementszVmaYaraScan.get_requirementss  ( W      *fmY     *(99     +"h.BI     **???   !$  0!) 1 R R T T%'???c#rKtjt|j}t j|jdd}t j |j |jd|D]}| }|s|j j |}| |j tj|||D])\}}}} dt!j||j||| ffV*dS)Nrr)contextvmlinux_module_name filter_func)rules)r1scannersectionsr)r r%process_yara_optionsdictconfigr r$create_pid_filterget list_tasksr1add_process_layerlayersscanr' get_vma_mapsr Hextgid) selfr4r3taskproc_layer_name proc_layeroffset rule_namervalues r- _generatorzVmaYaraScan._generator4sW!66tDK7H7HIIm55dkooeT6R6RSS M,,L $ H 5#-    D#4466O" ,_=J3=//  ,5999**4003B33  . 4  $V,,I    r/rDc#K|jr6|jD]}|j|jz }|j|fVdSdS)aCreates a map of start/end addresses for each virtual memory area in a task. Args: task: The task object of which to read the vmas from Returns: An iterable of tuples containing start and end addresses for each descriptor N)mm get_vma_itervm_endvm_start)rDvmavm_sizes r-r@zVmaYaraScan.get_vma_mapsVsg 7 .w++-- . .*s|3|W----- . . . .r/ctjdtjfdtfdt fdt fdt fg|S)NOffsetPIDRule ComponentValue)rTreeGridr rAr"strbytesrJ)rCs r-runzVmaYaraScan.rungsT!<+,  c"%   OO     r/N)__name__ __module__ __qualname____doc___required_framework_version_version classmethodrr configurationRequirementInterfacer.rJ staticmethodobjectsObjectInterfacerrr"r@r[r/r-r r s>>"+H@j&>&S!T@@@[@>   D. 0. %S/ "...\.      r/r N)typingrrrvolatility3.frameworkrr#volatility3.framework.configurationrvolatility3.framework.renderersr volatility3.pluginsr volatility3.plugins.linuxr pluginsPluginInterfacer rhr/r-rqs )(((((((((77777777<<<<<<888888((((((,,,,,,c c c c c *$4c c c c c r/