volatilityfoundation / volatilityfoundation/volatility3
Ability to change how byte results are displayed
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 4.4k
- Forks
- 705
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 3
Description
Yarascan(windows.vadyarascan) of volatility3(beta) only shows hexdump of search string.
A sample run would look like the following:
>python3 vol.py -f sample.mem windows.vadyarascan.VadYaraScan --yara-rules="gmail"
Volatility 3 Framework 1.1.0-beta.1
Progress: 0.00 Scanning primary2 using PdbSignatureScanner
Offset Pid Rule Component Value
0x2222060f52f 68 r1 $a 67 6d 61 69 6c
0x2222071132f 68 r1 $a 67 6d 61 69 6c
0x22220884a6f 68 r1 $a 67 6d 61 69 6c
0x259a52339da 568 r1 $a 67 6d 61 69 6c
0x247a4291d64 1624 r1 $a 67 6d 61 69 6c
0x247a4532db4 1624 r1 $a 67 6d 61 69 6c
0x247a4534840 1624 r1 $a 67 6d 61 69 6c
---snip---
By the way, in volatility2.6, it is displayed as follows.
>python vol.py -f sample.mem --profile="Win10x64_18362" yarascan --yara-rules="gmail" -s 64
Volatility Foundation Volatility Framework 2.6.1
Rule: r1
Owner: Process Registry Pid 68
0x2222060f52f 67 6d 61 69 6c 2e 63 6f 6d a0 ff ff ff 6e 6b 20 gmail.com....nk.
0x2222060f53f 00 85 6e 43 95 83 77 d6 01 02 00 00 00 c8 e4 f3 ..nC..w.........
0x2222060f54f 03 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ................
0x2222060f55f ff 01 00 00 00 d0 e8 34 01 e0 6d 33 01 ff ff ff .......4..m3....
Rule: r1
Owner: Process Registry Pid 68
0x22220884a6f 67 6d 61 69 6c 2e 63 6f 6d f8 ff ff ff 30 45 00 gmail.com....0E.
0x22220884a7f 00 80 ff ff ff 6e 6b 20 00 ed f4 3c c5 83 77 d6 .....nk....<..w.
0x22220884a8f 01 02 00 00 00 60 2e 00 00 00 00 00 00 00 00 00 .....`..........
0x22220884a9f 00 ff ff ff ff ff ff ff ff 01 00 00 00 c0 8f 05 ................
Rule: r1
Owner: Process Registry Pid 68
0x2222071132f 67 6d 61 69 6c 2e 63 6f 6d f0 ff ff ff 6c 68 01 gmail.com....lh.
0x2222071133f 00 c8 02 03 00 f4 3d f4 b6 e0 ff ff ff 76 6b 08 ......=......vk.
0x2222071134f 00 16 00 00 00 68 03 03 00 01 00 00 00 01 00 00 .....h..........
0x2222071135f 00 4b 65 79 77 6f 72 64 73 e0 ff ff ff 41 00 73 .Keywords....A.s
---snip---
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the windows.vadyarascan.VadYaraScan entry point and run the sample vol.py command to inspect its current byte-result output. Compare the result with the Volatility 2.6 example and determine how a configurable display should select surrounding bytes and text. Done means the plugin supports the requested display choice without changing the default output.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cli
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100