volatilityfoundation/volatility — pull request #131 by hiddenillusion (2014-12-02 12:45:36+00:00)
Title: Malfind : added -A, -C & modified -W

Added:
~ '-C' for case insensitive YARA searches
~ '-A' for searching both process & kernel memory in one run of the
plugin
~ '_scan_kernel_memory()' & '_scan_process_memory()' to YaraScan class
due to the new '-A' switch

Modified:
~ '-W' now adds 'ascii' to YARA rule so both are searched when WIDE is
chosen

I got tired of having to run yarascan twice (once for kernel and once for process) so I created a switch and two functions to provide the ability to scan each individually still or to scan both in one execution of the plugin. I also added a '-C' switch because sometimes I have a keyword for the '-Y' switch that I want case insensitive and only way to do it was via supplying a rules files to '-y'... just found this more convenient. The modification to '-W' may be worthless to some but I again found myself doing two passes (one for ascii and one for wide) so chances are doing a wide scan I'd also want to do an ascii scan - but everyone's needs are different.

Feel free to accept, modify or discard - just figured I'd bring them up as suggestions at least as others might find them helpful as well.