Volatility plugin to extract config file from memory : Crashes after yara compile function

Question

I am trying to write a Volatility plugin to extract configuration file used by a malware from memory dump. However, when I run this plugin (without 'sudo') without root privileges the plugin crashes at the line yara.compile. If I run this plugin with 'sudo', code after yara.compile line is not getting executed. I am not sure why yara.compile is causing this problem. Could someone help me with this? Following is the code I have written:

import volatility.plugins.common as common 
import volatility.utils as utils
import volatility.win32.tasks as tasks 
import volatility.debug as debug
import volatility.plugins.malware.malfind as malfind
import volatility.conf as conf
import volatility.plugins.taskmods as taskmods

try:
    import yara
    HAS_YARA = True
except ImportError:
    HAS_YARA = False

YARA_SIGS = {
    'malware_conf' : 'rule malware_conf {strings: $a = /<settings/ condition: $a}'
}

class malwarescan(taskmods.PSList):

    def get_vad_base(self, task, address):
        for vad in task.VadRoot.traverse():
            if address >= vad.Start and address < vad.End:
                return vad.Start
        return None

    def calculate(self):
        if not HAS_YARA:
            debug.error('Yara must be installed for this plugin')
        print "in calculate function"
        kernel_space = utils.load_as(self._config)
        print "before yara compile"
        rules = yara.compile(sources=YARA_SIGS)
        print "after yara compile"
        for process in tasks.pslist(kernel_space):
             if "IEXPLORE.EXE".lower() == process.ImageFileName.lower():
                 scanner = malfind.VadYaraScanner(task=process, rules=rules)
                 for hit, address in scanner.scan():
                     vad_base_addr = self.get_vad_base(process, address)
                     yield process, address



    def render_text(self, outfd, data):
        for process, address in data:

            outfd.write("Process: {0}, Pid: {1}\n".format(process.ImageFileName, process.UniqueProcessId))

So when I run this plugin with root privilege, I dont see the line "print 'after yara compile'" gets executed. What could be the reason? Thank you.

score 1 · Answer 1 · answered Aug 06 '15 at 15:26

I installed "yara" through "pip". If you install yara through pip, you actually get yara-ctypes (https://github.com/mjdorma/yara-ctypes) which is a bit different than yara-python. So I uninstalled yara-ctypes and installed yara-python. Then it worked.

Volatility plugin to extract config file from memory : Crashes after yara compile function

1 Answers1