Process Pattern Scanner

A command-line utility that scans running processes for suspicious patterns using pattern matching rules.

Capabilities

Process Memory Scanning

• Scans a process by PID and returns all matching rule names @test
• Returns an empty list when no patterns match @test

Rule Loading

• Loads pattern matching rules from a file path @test

Error Handling

• Raises an exception when attempting to scan a non-existent process @test
• Raises an exception when the rules file does not exist @test

Implementation

@generates

API

def scan_process(pid: int, rules_file: str) -> list[str]:
    """
    Scans a process's memory for patterns defined in a rules file.

    Args:
        pid: The process ID to scan
        rules_file: Path to the file containing pattern matching rules

    Returns:
        A list of rule names that matched (empty list if no matches)

    Raises:
        ValueError: If the rules file does not exist
        RuntimeError: If the process does not exist or cannot be accessed
    """
    pass

Dependencies { .dependencies }

yara-python { .dependency }

Provides pattern matching and process scanning capabilities.

@satisfied-by