volatilityfoundation / volatilityfoundation/volatility3

Ability to change how byte results are displayed

Open
#317 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Python
Stars
4.4k
Forks
705
Avg merge
1d 10h
Merged PRs (30d)
3

Description

Yarascan(windows.vadyarascan) of volatility3(beta) only shows hexdump of search string.

A sample run would look like the following:

>python3 vol.py -f sample.mem windows.vadyarascan.VadYaraScan --yara-rules="gmail"
Volatility 3 Framework 1.1.0-beta.1
Progress:    0.00		Scanning primary2 using PdbSignatureScanner
Offset	Pid	Rule	Component	Value

0x2222060f52f	68	r1	$a	67 6d 61 69 6c
0x2222071132f	68	r1	$a	67 6d 61 69 6c
0x22220884a6f	68	r1	$a	67 6d 61 69 6c
0x259a52339da	568	r1	$a	67 6d 61 69 6c
0x247a4291d64	1624	r1	$a	67 6d 61 69 6c
0x247a4532db4	1624	r1	$a	67 6d 61 69 6c
0x247a4534840	1624	r1	$a	67 6d 61 69 6c
---snip---

By the way, in volatility2.6, it is displayed as follows.

>python vol.py -f sample.mem --profile="Win10x64_18362" yarascan --yara-rules="gmail" -s 64
Volatility Foundation Volatility Framework 2.6.1
Rule: r1
Owner: Process Registry Pid 68
0x2222060f52f  67 6d 61 69 6c 2e 63 6f 6d a0 ff ff ff 6e 6b 20   gmail.com....nk.
0x2222060f53f  00 85 6e 43 95 83 77 d6 01 02 00 00 00 c8 e4 f3   ..nC..w.........
0x2222060f54f  03 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff   ................
0x2222060f55f  ff 01 00 00 00 d0 e8 34 01 e0 6d 33 01 ff ff ff   .......4..m3....
Rule: r1
Owner: Process Registry Pid 68
0x22220884a6f  67 6d 61 69 6c 2e 63 6f 6d f8 ff ff ff 30 45 00   gmail.com....0E.
0x22220884a7f  00 80 ff ff ff 6e 6b 20 00 ed f4 3c c5 83 77 d6   .....nk....<..w.
0x22220884a8f  01 02 00 00 00 60 2e 00 00 00 00 00 00 00 00 00   .....`..........
0x22220884a9f  00 ff ff ff ff ff ff ff ff 01 00 00 00 c0 8f 05   ................
Rule: r1
Owner: Process Registry Pid 68
0x2222071132f  67 6d 61 69 6c 2e 63 6f 6d f0 ff ff ff 6c 68 01   gmail.com....lh.
0x2222071133f  00 c8 02 03 00 f4 3d f4 b6 e0 ff ff ff 76 6b 08   ......=......vk.
0x2222071134f  00 16 00 00 00 68 03 03 00 01 00 00 00 01 00 00   .....h..........
0x2222071135f  00 4b 65 79 77 6f 72 64 73 e0 ff ff ff 41 00 73   .Keywords....A.s
---snip---

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the windows.vadyarascan.VadYaraScan entry point and run the sample vol.py command to inspect its current byte-result output. Compare the result with the Volatility 2.6 example and determine how a configurable display should select surrounding bytes and text. Done means the plugin supports the requested display choice without changing the default output.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cli
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.