Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix up vmayarascan and vadyarascan to use yarascan properly #1371

Open
wants to merge 2 commits into
base: develop
Choose a base branch
from
Open

Fix up vmayarascan and vadyarascan to use yarascan properly #1371

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bec6bc6
Fix up vmayarascan and vadyarascan to use yarascan properly
ikelos Nov 28, 2024
0030129
Make suggested fixes to reduce loops and ignore insane sections
ikelos Nov 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
59 changes: 36 additions & 23 deletions volatility3/framework/plugins/linux/vmayarascan.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#

import logging
from typing import Iterable, List, Tuple

from volatility3.framework import interfaces, renderers
Expand All @@ -10,6 +11,8 @@
from volatility3.plugins import yarascan
from volatility3.plugins.linux import pslist

vollog = logging.getLogger(__name__)


class VmaYaraScan(interfaces.plugins.PluginInterface):
"""Scans all virtual memory areas for tasks using yara."""
Expand Down Expand Up @@ -50,6 +53,8 @@ def _generator(self):
# use yarascan to parse the yara options provided and create the rules
rules = yarascan.YaraScan.process_yara_options(dict(self.config))

sanity_check = 1024 * 1024 * 1024 # 1 GB

# filter based on the pid option if provided
filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None))
for task in pslist.PsList.list_tasks(
Expand All @@ -66,29 +71,37 @@ def _generator(self):
# get the proc_layer object from the context
proc_layer = self.context.layers[proc_layer_name]

for start, end in self.get_vma_maps(task):
for match in rules.match(
data=proc_layer.read(start, end - start, True)
):
if yarascan.YaraScan.yara_returns_instances():
for match_string in match.strings:
for instance in match_string.instances:
yield 0, (
format_hints.Hex(instance.offset + start),
task.UniqueProcessId,
match.rule,
match_string.identifier,
instance.matched_data,
)
else:
for offset, name, value in match.strings:
yield 0, (
format_hints.Hex(offset + start),
task.tgid,
match.rule,
name,
value,
)
max_vma_size = 0
vma_maps_to_scan = []
for start, size in self.get_vma_maps(task):
if size > sanity_check:
vollog.debug(
f"VMA at 0x{start:x} over sanity-check size, not scanning"
)
continue
max_vma_size = max(max_vma_size, size)
vma_maps_to_scan.append((start, size))

if not vma_maps_to_scan:
vollog.warning(f"No VMAs were found for task {task.tgid}, not scanning")
continue

scanner = yarascan.YaraScanner(rules=rules)
scanner.chunk_size = max_vma_size

# scan the process layer with the yarascanner
for offset, rule_name, name, value in proc_layer.scan(
context=self.context,
scanner=scanner,
sections=vma_maps_to_scan,
):
yield 0, (
format_hints.Hex(offset),
task.tgid,
rule_name,
name,
value,
)

@staticmethod
def get_vma_maps(
Expand Down
69 changes: 32 additions & 37 deletions volatility3/framework/plugins/windows/vadyarascan.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,9 @@ def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]
requirements.PluginRequirement(
name="pslist", plugin=pslist.PsList, version=(2, 0, 0)
),
requirements.VersionRequirement(
name="yarascanner", component=yarascan.YaraScanner, version=(2, 0, 0)
),
requirements.PluginRequirement(
name="yarascan", plugin=yarascan.YaraScan, version=(2, 0, 0)
),
Expand Down Expand Up @@ -66,49 +69,41 @@ def _generator(self):
):
layer_name = task.add_process_layer()
layer = self.context.layers[layer_name]

max_vad_size = 0
vad_maps_to_scan = []

for start, size in self.get_vad_maps(task):
if size > sanity_check:
vollog.debug(
f"VAD at 0x{start:x} over sanity-check size, not scanning"
)
continue

data = layer.read(start, size, True)
if not yarascan.YaraScan._yara_x:
for match in rules.match(data=data):
if yarascan.YaraScan.yara_returns_instances():
for match_string in match.strings:
for instance in match_string.instances:
yield 0, (
format_hints.Hex(instance.offset + start),
task.UniqueProcessId,
match.rule,
match_string.identifier,
instance.matched_data,
)
else:
for offset, name, value in match.strings:
yield 0, (
format_hints.Hex(offset + start),
task.UniqueProcessId,
match.rule,
name,
value,
)
else:
for match in rules.scan(data).matching_rules:
for match_string in match.patterns:
for instance in match_string.matches:
yield 0, (
format_hints.Hex(instance.offset + start),
task.UniqueProcessId,
f"{match.namespace}.{match.identifier}",
match_string.identifier,
data[
instance.offset : instance.offset
+ instance.length
],
)
max_vad_size = max(max_vad_size, size)
vad_maps_to_scan.append((start, size))

if not vad_maps_to_scan:
vollog.warning(
f"No VADs were found for task {task.UniqueProcessID}, not scanning"
)
continue

scanner = yarascan.YaraScanner(rules=rules)
scanner.chunk_size = max_vad_size

# scan the process layer with the yarascanner
for offset, rule_name, name, value in layer.scan(
context=self.context,
scanner=scanner,
sections=vad_maps_to_scan,
):
yield 0, (
format_hints.Hex(offset),
task.UniqueProcessId,
rule_name,
name,
value,
)

@staticmethod
def get_vad_maps(
Expand Down
Loading