Various: Update yarascan plugins to output LayerData instead of just bytes

Author: ikelos

volatility3/framework/plugins/linux/vmayarascan.py

@@ -17,8 +17,8 @@
 class VmaYaraScan(interfaces.plugins.PluginInterface):
     """Scans all virtual memory areas for tasks using yara."""
 
-    _required_framework_version = (2, 4, 0)
-    _version = (1, 0, 3)
+    _required_framework_version = (2, 22, 0)
+    _version = (1, 0, 4)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
@@ -97,12 +97,18 @@ def _generator(self):
                 for offset, rule_name, name, value in scanner(
                     proc_layer.read(start, size, pad=True), start
                 ):
+                    layer_data = renderers.LayerData(
+                        context=self.context,
+                        offset=offset,
+                        layer_name=proc_layer.name,
+                        length=len(value),
+                    )
                     yield 0, (
                         format_hints.Hex(offset),
                         task.tgid,
                         rule_name,
                         name,
-                        value,
+                        layer_data,
                     )
 
     @classmethod
@@ -130,7 +136,7 @@ def run(self):
                 ("PID", int),
                 ("Rule", str),
                 ("Component", str),
-                ("Value", bytes),
+                ("Value", renderers.LayerData),
             ],
             self._generator(),
         )

volatility3/framework/plugins/windows/vadyarascan.py

@@ -17,8 +17,8 @@
 class VadYaraScan(interfaces.plugins.PluginInterface):
     """Scans all the Virtual Address Descriptor memory maps using yara."""
 
-    _required_framework_version = (2, 4, 0)
-    _version = (1, 1, 2)
+    _required_framework_version = (2, 22, 0)
+    _version = (1, 1, 3)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
@@ -93,12 +93,18 @@ def _generator(self):
                 for offset, rule_name, name, value in scanner(
                     layer.read(start, size, pad=True), start
                 ):
+                    layer_data = renderers.LayerData(
+                        context=self.context,
+                        offset=offset,
+                        layer_name=layer.name,
+                        length=len(value),
+                    )
                     yield 0, (
                         format_hints.Hex(offset),
                         task.UniqueProcessId,
                         rule_name,
                         name,
-                        value,
+                        layer_data,
                     )
 
     @classmethod
@@ -126,7 +132,7 @@ def run(self):
                 ("PID", int),
                 ("Rule", str),
                 ("Component", str),
-                ("Value", bytes),
+                ("Value", renderers.LayerData),
             ],
             self._generator(),
         )

volatility3/framework/plugins/yarascan.py

@@ -105,8 +105,8 @@ def from_file(cls, filepath):
 class YaraScan(plugins.PluginInterface):
     """Scans kernel memory using yara rules (string or file)."""
 
-    _required_framework_version = (2, 0, 0)
-    _version = (2, 0, 0)
+    _required_framework_version = (2, 22, 0)
+    _version = (2, 0, 1)
     _yara_x = USE_YARA_X
 
     @classmethod
@@ -201,15 +201,21 @@ def _generator(self):
         for offset, rule_name, name, value in layer.scan(
             context=self.context, scanner=YaraScanner(rules=rules)
         ):
-            yield 0, (format_hints.Hex(offset), rule_name, name, value)
+            layer_data = renderers.LayerData(
+                context=self.context,
+                offset=offset,
+                layer_name=layer.name,
+                length=len(value),
+            )
+            yield 0, (format_hints.Hex(offset), rule_name, name, layer_data)
 
     def run(self):
         return renderers.TreeGrid(
             [
                 ("Offset", format_hints.Hex),
                 ("Rule", str),
                 ("Component", str),
-                ("Value", bytes),
+                ("Value", renderers.LayerData),
             ],
             self._generator(),
         )