volatilityfoundation/volatility — pull request #141 by hiddenillusion (2014-12-03 04:32:39+00:00)
Title: Malfind : added -A, -C & modified -W

Added:
~ '-C' for case insensitive YARA searches
~ '-A' for searching both process & kernel memory in one run of the plugin
~ '_scan_kernel_memory()' & '_scan_process_memory()' to YaraScan class due to the new '-A' switch

Modified:
~ '-W' now adds 'ascii' to YARA rule so both are searched when WIDE is chosen

single pull for https://github.com/volatilityfoundation/volatility/pull/131 ; easier this way