0

我正在尝试编写一个 Volatility 插件来从内存转储中提取恶意软件使用的配置文件。但是，当我在没有 root 权限的情况下运行这个插件（没有“sudo”）时，插件在 yara.compile 行崩溃。如果我使用 'sudo' 运行此插件，则 yara.compile 行之后的代码不会被执行。我不确定为什么 yara.compile 会导致这个问题。有人可以帮我解决这个问题吗？以下是我编写的代码：

import volatility.plugins.common as common 
import volatility.utils as utils
import volatility.win32.tasks as tasks 
import volatility.debug as debug
import volatility.plugins.malware.malfind as malfind
import volatility.conf as conf
import volatility.plugins.taskmods as taskmods

try:
    import yara
    HAS_YARA = True
except ImportError:
    HAS_YARA = False

YARA_SIGS = {
    'malware_conf' : 'rule malware_conf {strings: $a = /<settings/ condition: $a}'
}

class malwarescan(taskmods.PSList):

    def get_vad_base(self, task, address):
        for vad in task.VadRoot.traverse():
            if address >= vad.Start and address < vad.End:
                return vad.Start
        return None

    def calculate(self):
        if not HAS_YARA:
            debug.error('Yara must be installed for this plugin')
        print "in calculate function"
        kernel_space = utils.load_as(self._config)
        print "before yara compile"
        rules = yara.compile(sources=YARA_SIGS)
        print "after yara compile"
        for process in tasks.pslist(kernel_space):
             if "IEXPLORE.EXE".lower() == process.ImageFileName.lower():
                 scanner = malfind.VadYaraScanner(task=process, rules=rules)
                 for hit, address in scanner.scan():
                     vad_base_addr = self.get_vad_base(process, address)
                     yield process, address



    def render_text(self, outfd, data):
        for process, address in data:

            outfd.write("Process: {0}, Pid: {1}\n".format(process.ImageFileName, process.UniqueProcessId))

因此，当我以 root 权限运行此插件时，我没有看到“print 'after yara compile'”行被执行。可能是什么原因？谢谢你。

4

1 回答 1

1

我通过“pip”安装了“yara”。如果通过 pip 安装 yara，实际上会得到 yara-ctypes ( https://github.com/mjdorma/yara-ctypes )，它与 ​​yara-python 有点不同。所以我卸载了 yara-ctypes 并安装了 yara-python。然后它起作用了。

于 2015-08-06T15:26:26.907 回答