> ## Documentation Index
> Fetch the complete documentation index at: https://witchking.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# scan

> Streaming YARA scan over selected memory regions.

**Streaming YARA** over selected regions — no huge buffers.\
Default `--committed-only` is **True**.

## Syntax

```bash theme={null}
dmph scan <dump> --yara rules.yar
    [--region-type TYPE] [--writable-only] [--rwx-only] [--committed-only/--no-committed-only]
```

## Examples

```bash theme={null}
dmph scan process.dmp --yara cobalt.yar
dmph scan process.dmp --yara rules.yar --region-type PRIVATE --writable-only
```

> [!NOTE]
>
> Install YARA extras first: `pip install -e .[yara]`


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.