# Path: processing/volatility/vol.py
# class VolatilityModule(ProcessingModule):
#     """Abstract class for Processing Modules that rely on volatility.
# 
#     This class takes care of the necessary setup actions to use a Volatility
#     plugin from Python.
#     """
# 
#     acts_on = "memory_dump"
# 
#     named_configs = {
#         "volatility": {
#             "description": "Configure volatility integration.",
#             "config": [
#                 {
#                     "name": "plugins",
#                     "type": "str",
#                     "default": None,
#                     "description": "Path of additional volatility plugins",
#                 },
#             ],
#         }
#     }
# 
#     def initialize(self):
#         # Check dependencies
#         if not HAVE_VOLATILITY:
#             raise ModuleInitializationError(self, "Missing dependency: volatility")
# 
#         # Make sure installed volatility is compatible
#         volatility.framework.require_interface_version(2, 0, 0)
# 
#         # Create the context and list plugins
#         self.vol_ctx = contexts.Context()
# 
#         volatility.plugins.__path__ = constants.PLUGINS_PATH
# 
#         if self.volatility.plugins and os.path.isdir(self.volatility.plugins):
#             volatility.plugins.__path__.append(self.volatility.plugins)
# 
#         volatility.framework.import_files(volatility.plugins, True)
#         self.plugins = volatility.framework.list_plugins()
# 
#     def needs_plugin(self, plugins):
#         """Indicate that this module needs specific volatility plugins.
# 
#         Only useful when outside of the default scenario.
# 
#         Args:
#             plugins: a string or list of strings containing volatility plugins
#                 names.
# 
#         Raises:
#             ModuleInitializationError: when one of the plugins is not
#             available."""
#         for plugin in iterify(plugins):
#             if plugin not in self.plugins:
#                 raise ModuleInitializationError(self, "volatility plugin '{}' needed".format(plugin))
# 
#     def configure_plugin(self, plugin_name, **kwargs):
#         """Configure and return a plugin
# 
#         Args:
#             plugin_name: name of the plugin to configure, as a string.
#             **kwargs: configuration options passed to the plugin
# 
#         Returns:
#             The instantiated and configure volatility plugin.
#         """
#         plugin = self.plugins[plugin_name]
# 
#         # Set arguments
#         for key, value in kwargs.items():
#             config_path = path_join("plugins", plugin.__name__, key)
#             self.vol_ctx.config[config_path] = value
# 
#         # Filter automagics
#         available_automagics = automagic.available(self.vol_ctx)
#         automagics = automagic.choose_automagic(available_automagics, plugin)
# 
#         # Instantiate the plugin
#         return volplugins.construct_plugin(
#             self.vol_ctx,
#             automagics,
#             plugin,
#             "plugins",
#             MuteProgress(),
#             FileHandlerInterface,
#         )
# 
#     def run_plugin(self, plugin_name, **kwargs):
#         """Run a specific Volatility Plugin.
# 
#         Only useful when outside of the default scenario.
# 
#         Args:
#             plugin_name: name of the plugin to run, as a string.
# 
#         Returns:
#             The plugin's result, as a list of dict objects
#         """
#         plugin_instance = self.configure_plugin(plugin_name, **kwargs)
# 
#         # Run the plugin and return results
#         return self._convert(plugin_instance.run())
# 
#     def each(self, target):
#         self.vol_ctx.config["automagic.LayerStacker.single_location"] = "file://{}".format(target)
# 
#         return self.each_dump()
# 
#     def each_dump(self):
#         """To implement. Define actions that should be taken against each dump.
# 
#         When called, Volatility is already configured, and points at the
#         correct memory dump.
# 
#         ``self.vol_ctx`` contains the Volatility context.
#         ``self.plugins`` contains available plugin classes.
#         """
#         raise NotImplementedError
# 
#     def _convert(self, results):
#         """Convert TreeGrid plugin results into a list of dict objects.
# 
#         Args:
#             results: TreeGrid: results of a plugin execution
# 
#         Returns:
#             The results, formatted as a list of dict objects.
#         """
#         columns = [column.name for column in results.columns]
#         formatted_results = []
# 
#         def visitor(node, _):
#             node_results = {}
# 
#             for offset in range(len(columns)):
#                 node_results[columns[offset]] = node.values[offset]
# 
#             formatted_results.append(node_results)
# 
#         results.populate(visitor)
# 
#         return formatted_results


import os
from enum import Enum
from fame.common.utils import list_value, tempdir
from fame.common.exceptions import ModuleInitializationError
from .vol import VolatilityModule
    from volatility.plugins import yarascan
    from volatility.plugins.windows import pslist
    from hexdump import hexdump
        # Check dependencies
        if not HAVE_VOLATILITY:
            raise ModuleInitializationError(self, "Missing dependency: volatility")

        if not HAVE_HEXDUMP:
            raise ModuleInitializationError(self, "Missing dependency: hexdump")

        self.needs_plugin("windows.vadyarascan.VadYaraScan")
        self.results = []

    def each_dump(self):
        self.ignored_rules = list_value(self.ignored_rules)

        # Create file containing rules
        tmpdir = tempdir()
        rules_path = os.path.join(tmpdir, "rules")
        rules = open(rules_path, "w")
        rules.write(self.rules)
        rules.close()

        # Build a VadYaraScan plugin instance
        vad_yara_scan = self.configure_plugin(
            "windows.vadyarascan.VadYaraScan", yara_file="file://{}".format(rules_path)
        )

        rules = yarascan.YaraScan.process_yara_options(dict(vad_yara_scan.config))
        for task in pslist.PsList.list_processes(
            context=vad_yara_scan.context,
            layer_name=vad_yara_scan.config["primary"],
            symbol_table=vad_yara_scan.config["nt_symbols"],

# Path: processing/volatility/vol.py
# class VolatilityModule(ProcessingModule):
#     """Abstract class for Processing Modules that rely on volatility.
# 
#     This class takes care of the necessary setup actions to use a Volatility
#     plugin from Python.
#     """
# 
#     acts_on = "memory_dump"
# 
#     named_configs = {
#         "volatility": {
#             "description": "Configure volatility integration.",
#             "config": [
#                 {
#                     "name": "plugins",
#                     "type": "str",
#                     "default": None,
#                     "description": "Path of additional volatility plugins",
#                 },
#             ],
#         }
#     }
# 
#     def initialize(self):
#         # Check dependencies
#         if not HAVE_VOLATILITY:
#             raise ModuleInitializationError(self, "Missing dependency: volatility")
# 
#         # Make sure installed volatility is compatible
#         volatility.framework.require_interface_version(2, 0, 0)
# 
#         # Create the context and list plugins
#         self.vol_ctx = contexts.Context()
# 
#         volatility.plugins.__path__ = constants.PLUGINS_PATH
# 
#         if self.volatility.plugins and os.path.isdir(self.volatility.plugins):
#             volatility.plugins.__path__.append(self.volatility.plugins)
# 
#         volatility.framework.import_files(volatility.plugins, True)
#         self.plugins = volatility.framework.list_plugins()
# 
#     def needs_plugin(self, plugins):
#         """Indicate that this module needs specific volatility plugins.
# 
#         Only useful when outside of the default scenario.
# 
#         Args:
#             plugins: a string or list of strings containing volatility plugins
#                 names.
# 
#         Raises:
#             ModuleInitializationError: when one of the plugins is not
#             available."""
#         for plugin in iterify(plugins):
#             if plugin not in self.plugins:
#                 raise ModuleInitializationError(self, "volatility plugin '{}' needed".format(plugin))
# 
#     def configure_plugin(self, plugin_name, **kwargs):
#         """Configure and return a plugin
# 
#         Args:
#             plugin_name: name of the plugin to configure, as a string.
#             **kwargs: configuration options passed to the plugin
# 
#         Returns:
#             The instantiated and configure volatility plugin.
#         """
#         plugin = self.plugins[plugin_name]
# 
#         # Set arguments
#         for key, value in kwargs.items():
#             config_path = path_join("plugins", plugin.__name__, key)
#             self.vol_ctx.config[config_path] = value
# 
#         # Filter automagics
#         available_automagics = automagic.available(self.vol_ctx)
#         automagics = automagic.choose_automagic(available_automagics, plugin)
# 
#         # Instantiate the plugin
#         return volplugins.construct_plugin(
#             self.vol_ctx,
#             automagics,
#             plugin,
#             "plugins",
#             MuteProgress(),
#             FileHandlerInterface,
#         )
# 
#     def run_plugin(self, plugin_name, **kwargs):
#         """Run a specific Volatility Plugin.
# 
#         Only useful when outside of the default scenario.
# 
#         Args:
#             plugin_name: name of the plugin to run, as a string.
# 
#         Returns:
#             The plugin's result, as a list of dict objects
#         """
#         plugin_instance = self.configure_plugin(plugin_name, **kwargs)
# 
#         # Run the plugin and return results
#         return self._convert(plugin_instance.run())
# 
#     def each(self, target):
#         self.vol_ctx.config["automagic.LayerStacker.single_location"] = "file://{}".format(target)
# 
#         return self.each_dump()
# 
#     def each_dump(self):
#         """To implement. Define actions that should be taken against each dump.
# 
#         When called, Volatility is already configured, and points at the
#         correct memory dump.
# 
#         ``self.vol_ctx`` contains the Volatility context.
#         ``self.plugins`` contains available plugin classes.
#         """
#         raise NotImplementedError
# 
#     def _convert(self, results):
#         """Convert TreeGrid plugin results into a list of dict objects.
# 
#         Args:
#             results: TreeGrid: results of a plugin execution
# 
#         Returns:
#             The results, formatted as a list of dict objects.
#         """
#         columns = [column.name for column in results.columns]
#         formatted_results = []
# 
#         def visitor(node, _):
#             node_results = {}
# 
#             for offset in range(len(columns)):
#                 node_results[columns[offset]] = node.values[offset]
# 
#             formatted_results.append(node_results)
# 
#         results.populate(visitor)
# 
#         return formatted_results


# Path: processing/volatility/mem_yara.py
import os
from enum import Enum
from fame.common.utils import list_value, tempdir
from fame.common.exceptions import ModuleInitializationError
from .vol import VolatilityModule
    from volatility.plugins import yarascan
    from volatility.plugins.windows import pslist
    from hexdump import hexdump

        # Check dependencies
        if not HAVE_VOLATILITY:
            raise ModuleInitializationError(self, "Missing dependency: volatility")

        if not HAVE_HEXDUMP:
            raise ModuleInitializationError(self, "Missing dependency: hexdump")

        self.needs_plugin("windows.vadyarascan.VadYaraScan")
        self.results = []

    def each_dump(self):
        self.ignored_rules = list_value(self.ignored_rules)

        # Create file containing rules
        tmpdir = tempdir()
        rules_path = os.path.join(tmpdir, "rules")
        rules = open(rules_path, "w")
        rules.write(self.rules)
        rules.close()

        # Build a VadYaraScan plugin instance
        vad_yara_scan = self.configure_plugin(
            "windows.vadyarascan.VadYaraScan", yara_file="file://{}".format(rules_path)
        )

        rules = yarascan.YaraScan.process_yara_options(dict(vad_yara_scan.config))
        for task in pslist.PsList.list_processes(
            context=vad_yara_scan.context,
            layer_name=vad_yara_scan.config["primary"],
            symbol_table=vad_yara_scan.config["nt_symbols"],

        ):