Skip to content

Add convenience method for YaraScanner #1859

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: develop
Choose a base branch
from
Open

Add convenience method for YaraScanner #1859

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1a2e0df
Add convenience method for YaraScanner
JSCU-CNI Jun 27, 2025
3a1f0ab
Add docstring to from_text method
JSCU-CNI Jul 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions volatility3/framework/plugins/yarascan.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,6 +101,13 @@ def from_file(cls, filepath):
return yara_x.compile(fp.read().decode())
return yara.compile(file=fp)

@classmethod
def from_text(cls, rule):
formatted_rule = rule.replace("\n", "")
Copy link
Member

@ikelos ikelos Jul 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why are we stripping all new line characters, and is there any situation in which that could change the meaning of the rule?

Copy link
Member

@ikelos ikelos Jul 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It also feels like get_rule could be modified to call this after wrapping its parameter into simple rule text?

Copy link
Author

@JSCU-CNI JSCU-CNI Jul 11, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

New line stripping: good point! The docs of yara-python contains an example with a single line rule hence I replaced the newlines. I tested it with ~20 rules, and the newline can be included without any problems. I removed the replace line of code.

The source vs sources thing: the main difference is the namespacing. Theoretically we could check whether the given rule is a string or a dict and use source and sources accordingly. Don't prefer that though because of it's implicitness. The function name from_text is also clear in that it requires text, and not a dict.

The get_rule currently uses namespaces while from_text does not. I don't think it'd be wise to change it to use from_text because that would result in a backwards incompatible change. What do you think?

Copy link
Member

@ikelos ikelos Jul 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, fair enough. Looks good then, thanks! 5:)

if USE_YARA_X:
return yara_x.compile(source=formatted_rule)
return yara.compile(source=formatted_rule)


class YaraScan(plugins.PluginInterface):
"""Scans kernel memory using yara rules (string or file)."""
Expand Down