feat: process scanning #384

JonathanAnbary · 2025-06-24T14:45:53Z

Implemented Process scanning in lib (not accessible from cli yet) for linux and windows.
the semantics of the scan are as follows:

string are searched in each memory region of the scanned process separately, and results are combined.
modules are not ran, and conditions that depend on offsets evaluate to undefined (behaving as though the length of the scanned data is 0).

JonathanAnbary · 2025-06-24T18:21:05Z

I fixed the clippy errors (sorry about that).
In regards to the macos issues I also think I fixed it (by that I mean that it should compile not that I implemented process scanning) but I dont have a way to test it (Im working from linux, and cross compiling to macos seems like a pain) unless some one has a decent flake.nix/shell.nix for cargo with cross compilation to darwin.

JonathanAnbary · 2025-06-25T06:48:42Z

Ok, pretty sure I actually fixed the clippy errors now (switched to using the toolchain thats listed at the top of the clippy job).
in regards to the macos, I also fixed the error that was reported in the job but I dont actually have a way to test it.
Ill be trying to setup cross compilation for macos from my linux machine, and if that works Ill at least be able to ensure that it compiles.

secDre4mer

Thank you for implementing this (as this was the main thing I was missing from yara-x so far).

Regarding MacOS: If you need something tested on a MacOS, I'd be glad to help out.

secDre4mer · 2025-06-25T06:43:02Z

lib/src/scanner/mod.rs

+            .set(self.wasm_store.as_context_mut(), Val::I32(1))
+            .unwrap();
+
+        // Set the global variable `filesize` to the size of the total memroy regions.


Possibly this should be something the caller can choose? YARA uses "memory iterators", which have a similar option.

that sounds good, the only thing Im not sure about is how to set a wasm global to undefined.
adding a method to the DataIter trait is probably the way to do this.

lib/src/models.rs

lib/src/scanner/proc/linux.rs

JonathanAnbary · 2025-06-25T07:13:18Z

Regarding MacOS: If you need something tested on a MacOS, I'd be glad to help out.

If you could try compiling the branch for macos and inform me if any issues that arise that would be great (macos is not implemented so dont expect to be able to scan processes, I just want to make sure that it compiles).

secDre4mer · 2025-06-25T07:42:07Z

It compiles on MacOS. There are some warnings about unused code (warning: method scan_many_impl is never used and similar), but that is expected since without process scanning, these are superfluous for MacOS right now.

JonathanAnbary · 2025-06-25T13:03:16Z

@plusvic would it be possible to run the checks now?
I'm pretty sure it should pass now.

JonathanAnbary · 2025-06-25T16:57:39Z

I am happy to report that my hat is delicious.
I fixed the test, and then compiled and tested with windows-msvc (previously was using windows-gnu).
Its a bit of a weird test and it honestly might be better to just remove it but I wanted to make sure that the match content was not being duplicated for overlapping matches and this test (scan_proc_overlapping_matches) was the only way I could think of doing that.
Ill be happy if you can rerun the tests, Hopefully for the last time...

…f another process in order to scan it

… vector

…iterators)

…mory scanner

… processes memory into our own memory at once

… file

…ad moving on to next region

…efficient)

…ux (although of course, scan_proc wont be available)

…e now does not match itself

JonathanAnbary · 2025-07-05T11:15:27Z

Hi @plusvic.
I'd love to know what needs to be done in order to get this merged as soon as possible :)

plusvic · 2025-07-07T12:07:58Z

Hi @JonathanAnbary, it will take me some time before I can look into this thoroughly. As this is a big feature with a lot of implications from the API standpoint, I want to be very careful with it. My preliminary assessment is that this is unlikely to be merged as is. I would like to avoid at all cost to have all the OS-dependent code merged into the yara-x crate. I will probably think about a generic API that allows implementing process scanning on top of it, but leaving the memory reading stuff to the user of the API.

gustavo-iniguez-goya · 2025-09-08T18:11:56Z

Aupa @plusvic !

If you eventually add this feature, consider parsing /proc/<pid>/exe and other files (stat, status, ...), in order to scan for red flags on Linux, like processes masquerading as kernel threads, or processes executed from locations like /dev/shm, /tmp, /memfd, /var/tmp, etc.

plusvic · 2025-09-26T07:44:26Z

After merging #459 we already have an API for scanning memory blocks that could support process memory scanning on top of it. For the time being I don't plan to implement the OS-dependent memory reading logic. If that's ever implemented, I envision it as a separate crate that abstracts you from the details of reading the memory of another process given the process ID. I guess some other Rust crates can benefit from having such an API in a stand-alone crate.

With the new block scanning API, and some other crate that reads memory from external processes, implementing process scanning should be fairly trivial.

JonathanAnbary mentioned this pull request Jun 24, 2025

Feature-Request: scan processes via PID #199

Open

JonathanAnbary changed the title ~~Process scanning~~ feat: process scanning Jun 24, 2025

secDre4mer reviewed Jun 25, 2025

View reviewed changes

lib/src/scanner/proc/linux.rs Outdated Show resolved Hide resolved

JonathanAnbary mentioned this pull request Jun 25, 2025

Feature Request: support something like yr_scanner_scan_mem_blocks #308

Open

JonathanAnbary added 19 commits July 5, 2025 13:50

working on porting a poc of the scan_proc on linux

74bfd11

poc for linux process scanning

8f58abb

added comment in regards to weird failure when trying to read vvars o…

edf3a40

…f another process in order to scan it

moved the process memory loading into separate module

f8cf45e

wip, added winapi dependency to facilitate windows process scanning

28a7fb9

wip, implementing the windows process scanning

d9b1955

wip, windows process scanning

ca822aa

wip, code for windows process scanning

2524e9f

cross compiles to windows

f420270

working linux, still not tested windows

a135dbf

working windows process reading, oom if actually trying to use single…

cb3d427

… vector

working on windows (dont like the solution, this should be done with …

3ab5ea4

…iterators)

fixed linux process scanning regressions

e8a766e

seperated the linux and windows process scanning into different files

e4c7916

changed to using a streaming-iterator internally in the linux proc me…

d7a13fb

…mory scanner

cleaned up linux proc scanner

43801a1

cleaned up the windows implementation

0198d94

using the windows crate and not the winapi crate

6745e03

fixed compilation on linux

1a028b3

JonathanAnbary added 21 commits July 5, 2025 13:50

fixed test for linux

eaf00a7

windows proc scanning compiles successfully

bb403d8

working process scanning on linux without copying the entire targeted…

f7ff9ae

… processes memory into our own memory at once

mapping mapped files instead of reading from the processes memory

18cbaf5

wip, process scanning on linux has issue with reading from non mapped…

ce5dd80

… file

working linux scanning, need to consider reusing the vector

a61c345

got the windows proc scanning working

c74851e

not ending iteration over process memory when failing to fetch, inste…

e60393d

…ad moving on to next region

reusing existing vector and limiting max vector size

d685c47

poc for saving match content in the case of fragmented scanning (not …

1ad93f3

…efficient)

wip, working process scanning with saving match results

820837b

wip, working sparse scanned data saving for match content

777127a

not doing anchored patterns when scanning processes

b1cbafa

added cfg to ensure compilation will still succedd on non windows/lin…

3ce7416

…ux (although of course, scan_proc wont be available)

removing flake.nix, before creating PR

283b823

cleaned up code before submitting PR

1ed23bb

fixed so that macos will pass + some clippy errors

972ee17

fixed clippy warnings (for the correct rust version this time)

f0f6772

excluding process scanning tests when not targeting windows/linux

c678c00

CR fixes

e2ff4e8

changed the process scanning deduplicated match content test, the rul…

8760d29

…e now does not match itself

JonathanAnbary force-pushed the scan_process branch from acb3a7e to 8760d29 Compare July 5, 2025 11:11

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: process scanning #384

feat: process scanning #384

JonathanAnbary commented Jun 24, 2025

Uh oh!

JonathanAnbary commented Jun 24, 2025

Uh oh!

JonathanAnbary commented Jun 25, 2025

Uh oh!

secDre4mer left a comment

Uh oh!

secDre4mer Jun 25, 2025

Uh oh!

JonathanAnbary Jun 25, 2025

Uh oh!

Uh oh!

Uh oh!

JonathanAnbary commented Jun 25, 2025

Uh oh!

secDre4mer commented Jun 25, 2025

Uh oh!

JonathanAnbary commented Jun 25, 2025

Uh oh!

JonathanAnbary commented Jun 25, 2025

Uh oh!

JonathanAnbary commented Jul 5, 2025

Uh oh!

plusvic commented Jul 7, 2025

Uh oh!

gustavo-iniguez-goya commented Sep 8, 2025

Uh oh!

plusvic commented Sep 26, 2025

Uh oh!

Uh oh!

feat: process scanning #384

Are you sure you want to change the base?

feat: process scanning #384

Conversation

JonathanAnbary commented Jun 24, 2025

Uh oh!

JonathanAnbary commented Jun 24, 2025

Uh oh!

JonathanAnbary commented Jun 25, 2025

Uh oh!

secDre4mer left a comment

Choose a reason for hiding this comment

Uh oh!

secDre4mer Jun 25, 2025

Choose a reason for hiding this comment

Uh oh!

JonathanAnbary Jun 25, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

JonathanAnbary commented Jun 25, 2025

Uh oh!

secDre4mer commented Jun 25, 2025

Uh oh!

JonathanAnbary commented Jun 25, 2025

Uh oh!

JonathanAnbary commented Jun 25, 2025

Uh oh!

JonathanAnbary commented Jul 5, 2025

Uh oh!

plusvic commented Jul 7, 2025

Uh oh!

gustavo-iniguez-goya commented Sep 8, 2025

Uh oh!

plusvic commented Sep 26, 2025

Uh oh!

Uh oh!