scan

Streaming YARA scan over selected memory regions.

Streaming YARA over selected regions — no huge buffers.
Default --committed-only is True.

Syntax

dmph scan <dump> --yara rules.yar
    [--region-type TYPE] [--writable-only] [--rwx-only] [--committed-only/--no-committed-only]

Examples

dmph scan process.dmp --yara cobalt.yar
dmph scan process.dmp --yara rules.yar --region-type PRIVATE --writable-only

Install YARA extras first: pip install -e .[yara]