yapscan

Aug 12, 2022

Changes in this version

+ type PagemapEntry struct — linux/amd64

+ IsFilePage bool

+ IsPresent bool

+ IsSoftDirty bool

+ IsSwapped bool

+ PFN uint64

Aug 5, 2021

Changes in this version

+ type ProfilingInformation struct

+ FreeRAM uintptr

+ FreeSwap uintptr

+ LoadAvgFifteenMinutes float64

+ LoadAvgFiveMinutes float64

+ LoadAvgOneMinute float64

+ Time time.Time

type ScanningStatistics

+ ProfilingInformation []*ProfilingInformation

+ func (s *ScanningStatistics) StartProfiler(ctx context.Context, scanInterval time.Duration)

Jul 14, 2021

Changes in this version

type MemoryProfile

+ FreeSwap uintptr

Jul 7, 2021

Changes in this version

type MemorySegmentFilter

+ func NewRSSRatioFilter(ratio float64) MemorySegmentFilter

+ Description func() string

type ProcessScanner

+ func (s *ProcessScanner) EncounteredMemoryMappedFiles() []string

Jun 2, 2021

Changes in this version

type ScanningStatistics

+ NumberOfFileBytesScanned uint64

+ NumberOfMemoryBytesScanned uint64

+ func (s *ScanningStatistics) IncrementFilesScanned(numOfBytes uint64)

May 19, 2021

Changes in this version

+ type MemoryProfile struct

+ FreeRAM uintptr

+ Time time.Time

+ type ScanningStatistics struct

+ End time.Time

+ MemoryProfile []*MemoryProfile

+ NumberOfBytesScanned uint64

+ NumberOfFilesScanned uint64

+ NumberOfProcessesScanned uint64

+ NumberOfSegmentsScanned uint64

+ Start time.Time

+ func NewScanningStatistics() *ScanningStatistics

+ func (s *ScanningStatistics) Finalize()

+ func (s *ScanningStatistics) IncrementFileCount()

+ func (s *ScanningStatistics) IncrementMemorySegmentsScanned(numOfBytes uint64)

+ func (s *ScanningStatistics) IncrementNumberOfProcessesScanned()

+ func (s *ScanningStatistics) StartMemoryProfiler(ctx context.Context, scanInterval time.Duration)

type YaraScanner

+ func (s *YaraScanner) Statistics() *ScanningStatistics

Nov 13, 2020

Changes in this version

+ const RulesZIPPassword

+ var DefaultYaraRulesNamespace = ""

+ var ErrSkipped = errors.New("skipped")

+ var YaraRulesFileExtensions = []string

+ func AddressesFromMatches(matches []yara.MatchString, offset uint64) []uint64

+ func FormatSlice(format string, slice interface{}, args ...interface{}) []string

+ func IsYaraRulesFile(name string) bool

+ func Join(parts []string, defaultGlue, finalGlue string) string

+ func LoadYaraRules(path string, recurseIfDir bool) (*yara.Rules, error)

+ type FilterMatch struct

+ MSI *procIO.MemorySegmentInfo

+ Reason string

+ Result bool

+ type MemoryScanProgress struct

+ Dump []byte

+ Error error

+ Matches []yara.MatchRule

+ MemorySegment *procIO.MemorySegmentInfo

+ Process procIO.Process

+ type MemoryScanner interface

+ ScanMem func(buf []byte) (results []yara.MatchRule, err error)

+ type MemorySegmentFilter interface

+ Filter func(info *procIO.MemorySegmentInfo) *FilterMatch

+ func NewAndFilter(filters ...MemorySegmentFilter) MemorySegmentFilter

+ func NewFilterFromFunc(filter MemorySegmentFilterFunc, parameter interface{}, reasonTemplate string) MemorySegmentFilter

+ func NewMaxSizeFilter(size uintptr) MemorySegmentFilter

+ func NewMinSizeFilter(size uintptr) MemorySegmentFilter

+ func NewPermissionsFilter(perm procIO.Permissions) MemorySegmentFilter

+ func NewPermissionsFilterExact(perms []procIO.Permissions) MemorySegmentFilter

+ func NewStateFilter(states []procIO.State) MemorySegmentFilter

+ func NewTypeFilter(types []procIO.Type) MemorySegmentFilter

+ type MemorySegmentFilterFunc func(info *procIO.MemorySegmentInfo) bool

+ type ProcessScanner struct

+ func NewProcessScanner(proc procIO.Process, filter MemorySegmentFilter, scanner MemoryScanner) *ProcessScanner

+ func (s *ProcessScanner) Scan() (<-chan *MemoryScanProgress, error)

+ type Rules interface

+ ScanFile func(filename string, flags yara.ScanFlags, timeout time.Duration, ...) (err error)

+ ScanMem func(buf []byte, flags yara.ScanFlags, timeout time.Duration, cb yara.ScanCallback) (err error)

+ type YaraScanner struct

+ func NewYaraScanner(rules Rules) (*YaraScanner, error)

+ func (s *YaraScanner) ScanFile(filename string) ([]yara.MatchRule, error)

+ func (s *YaraScanner) ScanMem(buf []byte) ([]yara.MatchRule, error)