Add convenience method for YaraScanner

volatility3/framework/plugins/yarascan.py

@@ -101,6 +101,25 @@
                 return yara_x.compile(fp.read().decode())
             return yara.compile(file=fp)
 
+    @classmethod
+    def from_text(cls, rule) -> yara.Rules:
+        """Initialize a Yara Rules object from one or more rules in string format.
+
+        You can provide rules in single-line or multi-line:
+        rule = "rule dummy { condition: true }"
+        rules = '''
+            rule dummy {
+                condition: true
+            }
+            rule dummy2 {
+                condition: true
+            }
+        '''
+        """
+        if USE_YARA_X:
+            return yara_x.compile(source=formatted_rule)
+        return yara.compile(source=formatted_rule)
+
 
 class YaraScan(plugins.PluginInterface):
     """Scans kernel memory using yara rules (string or file)."""