{"action":"created","issue":{"url":"https://api.github.com/repos/VirusTotal/yara/issues/349","repository_url":"https://api.github.com/repos/VirusTotal/yara","labels_url":"https://api.github.com/repos/VirusTotal/yara/issues/349/labels{/name}","comments_url":"https://api.github.com/repos/VirusTotal/yara/issues/349/comments","events_url":"https://api.github.com/repos/VirusTotal/yara/issues/349/events","html_url":"https://github.com/VirusTotal/yara/issues/349","id":109114722,"number":349,"title":"[Feature] Real Virtual Addresses of String Matches in Process Scans","user":{"login":"jhumble","id":7214826,"avatar_url":"https://avatars.githubusercontent.com/u/7214826?v=3","gravatar_id":"","url":"https://api.github.com/users/jhumble","html_url":"https://github.com/jhumble","followers_url":"https://api.github.com/users/jhumble/followers","following_url":"https://api.github.com/users/jhumble/following{/other_user}","gists_url":"https://api.github.com/users/jhumble/gists{/gist_id}","starred_url":"https://api.github.com/users/jhumble/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jhumble/subscriptions","organizations_url":"https://api.github.com/users/jhumble/orgs","repos_url":"https://api.github.com/users/jhumble/repos","events_url":"https://api.github.com/users/jhumble/events{/privacy}","received_events_url":"https://api.github.com/users/jhumble/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2015-09-30T15:19:37Z","updated_at":"2016-07-29T12:59:10Z","closed_at":"2015-09-30T16:43:56Z","body":"It would be highly useful to get back the actual virtual addresses of matches for process scans. Currently, the string offsets returned seems to be just the offsets into the current block being scanned, but the address of the block itself is absent.\r\n\r\nAs far as I can tell, the block structure being passed around in the code does have an address member, it would just need to be pushed into the string tuple returned to python. If it were, we could do all kinds of interesting things like leveraging psutil.memory_maps to identify which loaded library or section of memory a match occurred in. \r\n\r\n"},"comment":{"url":"https://api.github.com/repos/VirusTotal/yara/issues/comments/236173597","html_url":"https://github.com/VirusTotal/yara/issues/349#issuecomment-236173597","issue_url":"https://api.github.com/repos/VirusTotal/yara/issues/349","id":236173597,"user":{"login":"wxsBSD","id":1394879,"avatar_url":"https://avatars.githubusercontent.com/u/1394879?v=3","gravatar_id":"","url":"https://api.github.com/users/wxsBSD","html_url":"https://github.com/wxsBSD","followers_url":"https://api.github.com/users/wxsBSD/followers","following_url":"https://api.github.com/users/wxsBSD/following{/other_user}","gists_url":"https://api.github.com/users/wxsBSD/gists{/gist_id}","starred_url":"https://api.github.com/users/wxsBSD/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wxsBSD/subscriptions","organizations_url":"https://api.github.com/users/wxsBSD/orgs","repos_url":"https://api.github.com/users/wxsBSD/repos","events_url":"https://api.github.com/users/wxsBSD/events{/privacy}","received_events_url":"https://api.github.com/users/wxsBSD/received_events","type":"User","site_admin":false},"created_at":"2016-07-29T12:59:10Z","updated_at":"2016-07-29T12:59:10Z","body":"In another conversation it was brought to my attention that https://github.com/VirusTotal/yara-python/pull/1 (which I think addresses this, it's been too long to remember exactly) never got merged."}}
{"actor":{"display_login":"wxsBSD"}}