Class WinPhysicalYaraScanner

source code

An experimental yara scanner over the physical address space.

Yara does not provide a streaming interface, which means that when we scan
for yara rules we can only ever match strings within the same buffer. This
is a problem for physical address space scanning because each page (although
it might appear to be contiguous) usually comes from a different
process/mapped file.

Therefore we need a more intelligent way to apply yara signatures on the
physical address space:

1. The original set of yara rules is converted into a single rule with all
the strings from all the rules in it. The rule has a condition "any of them"
which will match any string appearing in the scanned buffer.

2. This rule is then applied over the physical address space.

3. For each hit we derive a context and add the hit to the context.

4. Finally we test all the rules within the same context with the original
rule set.

A mixin for those plugins requiring a physical address space.

Args:
  physical_address_space: The physical address space to use. If not
    specified we use the following options:

    1) session.physical_address_space,

    2) Guess using the load_as() plugin,

    3) Use session.kernel_address_space.base.