/usr/lib/python2.7/dist-packages/rekall/plugins/darwin/yarascan.py is in python-rekall-core 1.6.0+dfsg-2.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 | from rekall.plugins import yarascanner
from rekall.plugins.common import scanners
from rekall.plugins.darwin import common
class DarwinYaraScan(yarascanner.YaraScanMixin,
scanners.BaseScannerPlugin,
common.ProcessFilterMixin,
common.AbstractDarwinCommand):
"""Scan using yara signatures."""
|