From 2f7e6ed60d61ba59380fe63d0795cab71139849b Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Sat, 28 Jul 2012 15:35:18 +0000 Subject: [PATCH] malfind and yarascan should not bt if the specified output directory doesn't exist or if its a file - spotted by attrc --- volatility/plugins/malware/malfind.py | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/volatility/plugins/malware/malfind.py b/volatility/plugins/malware/malfind.py index ec2381e9..e0fddcf1 100644 --- a/volatility/plugins/malware/malfind.py +++ b/volatility/plugins/malware/malfind.py @@ -453,6 +453,9 @@ class YaraScan(taskmods.DllList): def render_text(self, outfd, data): + if self._config.DUMP_DIR and not os.path.isdir(self._config.DUMP_DIR): + debug.error(self._config.DUMP_DIR + " is not a directory") + for o, addr, hit, content in data: outfd.write("Rule: {0}\n".format(hit.rule)) @@ -513,6 +516,10 @@ class Malfind(vadinfo.VADDump): return True def render_text(self, outfd, data): + + if self._config.DUMP_DIR and not os.path.isdir(self._config.DUMP_DIR): + debug.error(self._config.DUMP_DIR + " is not a directory") + for task in data: for vad, address_space in task.get_vads(vad_filter = task._injection_filter):