diff --git a/volatility3/framework/plugins/yarascan.py b/volatility3/framework/plugins/yarascan.py index 040a50c1af..eecabd20d6 100644 --- a/volatility3/framework/plugins/yarascan.py +++ b/volatility3/framework/plugins/yarascan.py @@ -101,6 +101,25 @@ def from_file(cls, filepath): return yara_x.compile(fp.read().decode()) return yara.compile(file=fp) + @classmethod + def from_text(cls, rule) -> yara.Rules: + """Initialize a Yara Rules object from one or more rules in string format. + + You can provide rules in single-line or multi-line: + rule = "rule dummy { condition: true }" + rules = ''' + rule dummy { + condition: true + } + rule dummy2 { + condition: true + } + ''' + """ + if USE_YARA_X: + return yara_x.compile(source=formatted_rule) + return yara.compile(source=formatted_rule) + class YaraScan(plugins.PluginInterface): """Scans kernel memory using yara rules (string or file)."""