mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-02 14:28:58 +02:00
Fix up the descriptions for non-simple requirements.
This commit is contained in:
@@ -36,7 +36,7 @@ class ConfigWriter(plugins.PluginInterface):
|
||||
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.BooleanRequirement(
|
||||
name = 'extra', description = 'Outputs whole configuration tree', default = False, optional = True)
|
||||
]
|
||||
|
||||
@@ -42,8 +42,8 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
|
||||
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "vmlinux", description = "Linux Kernel")
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
|
||||
]
|
||||
|
||||
def _generator(self, tasks):
|
||||
|
||||
@@ -40,8 +40,8 @@ class Check_afinfo(plugins.PluginInterface):
|
||||
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "vmlinux", description = "Linux Kernel")
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
|
||||
]
|
||||
|
||||
# returns whether the symbol is found within the kernel (system.map) or not
|
||||
|
||||
@@ -47,8 +47,8 @@ class Check_syscall(plugins.PluginInterface):
|
||||
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "vmlinux", description = "Linux Kernel")
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
|
||||
]
|
||||
|
||||
def _get_table_size_next_symbol(self, table_addr, ptr_sz, vmlinux):
|
||||
|
||||
@@ -38,8 +38,8 @@ class Elfs(plugins.PluginInterface):
|
||||
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "vmlinux", description = "Linux Kernel")
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
|
||||
]
|
||||
|
||||
def _generator(self, tasks):
|
||||
|
||||
@@ -39,8 +39,8 @@ class Lsmod(plugins.PluginInterface):
|
||||
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "vmlinux", description = "Linux Kernel")
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
|
||||
]
|
||||
|
||||
@classmethod
|
||||
|
||||
@@ -40,8 +40,8 @@ class Lsof(plugins.PluginInterface):
|
||||
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "vmlinux", description = "Linux Kernel")
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
|
||||
]
|
||||
|
||||
def _generator(self, tasks):
|
||||
|
||||
@@ -37,8 +37,8 @@ class Malfind(interfaces_plugins.PluginInterface):
|
||||
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "vmlinux", description = "Linux Kernel")
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
|
||||
]
|
||||
|
||||
def _list_injections(self, task):
|
||||
|
||||
@@ -37,8 +37,8 @@ class Maps(plugins.PluginInterface):
|
||||
# Since we're calling the plugin, make sure we have the plugin's requirements
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "vmlinux", description = "Linux Kernel")
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
|
||||
]
|
||||
|
||||
def _generator(self, tasks):
|
||||
|
||||
@@ -34,8 +34,8 @@ class PsList(interfaces_plugins.PluginInterface):
|
||||
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "vmlinux", description = "Linux Kernel")
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
|
||||
]
|
||||
|
||||
@classmethod
|
||||
|
||||
@@ -42,8 +42,8 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
|
||||
def get_requirements(cls):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "darwin", description = "mac Kernel")
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols")
|
||||
]
|
||||
|
||||
def _generator(self, tasks):
|
||||
|
||||
@@ -17,8 +17,8 @@ class Check_syscall(plugins.PluginInterface):
|
||||
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "darwin", description = "OSX Kernel")]
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols")]
|
||||
|
||||
def _generator(self):
|
||||
mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
|
||||
|
||||
@@ -36,8 +36,8 @@ class Lsmod(plugins.PluginInterface):
|
||||
def get_requirements(cls):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "darwin", description = "Linux Kernel")
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "darwin", description = "Linux kernel symbols")
|
||||
]
|
||||
|
||||
@classmethod
|
||||
|
||||
@@ -35,8 +35,8 @@ class Malfind(interfaces_plugins.PluginInterface):
|
||||
def get_requirements(cls):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "darwin", description = "Linux Kernel")
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "darwin", description = "Linux kernel symbols")
|
||||
]
|
||||
|
||||
def _list_injections(self, task):
|
||||
|
||||
@@ -34,8 +34,8 @@ class Psaux(plugins.PluginInterface):
|
||||
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "darwin", description = "Mac Kernel")
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols")
|
||||
]
|
||||
|
||||
def _generator(self, tasks: Iterator[Any]) -> Generator[Tuple[int, Tuple[int, str, int, str]], None, None]:
|
||||
|
||||
@@ -37,8 +37,8 @@ class PsList(interfaces_plugins.PluginInterface):
|
||||
def get_requirements(cls):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "darwin", description = "Mac Kernel")
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols")
|
||||
]
|
||||
|
||||
@classmethod
|
||||
|
||||
@@ -38,8 +38,8 @@ class PsTree(plugins.PluginInterface):
|
||||
def get_requirements(cls):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "darwin", description = "Mac Kernel")
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols")
|
||||
]
|
||||
|
||||
def _find_level(self, pid):
|
||||
|
||||
@@ -40,8 +40,8 @@ class Check_syscall(plugins.PluginInterface):
|
||||
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "darwin", description = "OSX Kernel")
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols")
|
||||
]
|
||||
|
||||
def _generator(self, mods: Iterator[Any]):
|
||||
|
||||
@@ -36,8 +36,8 @@ class CmdLine(interfaces_plugins.PluginInterface):
|
||||
# Since we're calling the plugin, make sure we have the plugin's requirements
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS")
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
]
|
||||
|
||||
def _generator(self, procs):
|
||||
|
||||
@@ -42,9 +42,9 @@ class DllDump(interfaces_plugins.PluginInterface):
|
||||
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
|
||||
# Since we're calling the plugin, make sure we have the plugin's requirements
|
||||
return [requirements.TranslationLayerRequirement(name = 'primary',
|
||||
description = 'Kernel Address Space',
|
||||
description = 'Memory layer for the kernel',
|
||||
architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
# TODO: Convert this to a ListRequirement so that people can filter on sets of ranges
|
||||
requirements.IntRequirement(name = 'address',
|
||||
description = "Process virtual memory address to include " \
|
||||
|
||||
@@ -35,8 +35,8 @@ class DllList(interfaces_plugins.PluginInterface):
|
||||
# Since we're calling the plugin, make sure we have the plugin's requirements
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS")
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
]
|
||||
|
||||
def _generator(self, procs):
|
||||
|
||||
@@ -54,8 +54,8 @@ class Handles(interfaces_plugins.PluginInterface):
|
||||
# Since we're calling the plugin, make sure we have the plugin's requirements
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS")
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
]
|
||||
|
||||
def _decode_pointer(self, value, magic):
|
||||
|
||||
@@ -36,8 +36,8 @@ class Info(plugins.PluginInterface):
|
||||
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS")
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
]
|
||||
|
||||
def get_depends(self, layer_name: str, index: int = 0):
|
||||
|
||||
@@ -35,8 +35,8 @@ class Malfind(interfaces.plugins.PluginInterface):
|
||||
# Since we're calling the plugin, make sure we have the plugin's requirements
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS")
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
]
|
||||
|
||||
@classmethod
|
||||
|
||||
@@ -43,8 +43,8 @@ class ModDump(interfaces_plugins.PluginInterface):
|
||||
# Reuse the requirements from the plugins we use
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS")
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
]
|
||||
|
||||
@classmethod
|
||||
|
||||
@@ -34,8 +34,8 @@ class Modules(interfaces.plugins.PluginInterface):
|
||||
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS")
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
]
|
||||
|
||||
def _generator(self):
|
||||
|
||||
@@ -78,8 +78,8 @@ class PoolScanner(plugins.PluginInterface):
|
||||
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS")
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
]
|
||||
|
||||
@staticmethod
|
||||
|
||||
@@ -42,8 +42,8 @@ class ProcDump(interfaces_plugins.PluginInterface):
|
||||
# Since we're calling the plugin, make sure we have the plugin's requirements
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS")
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
]
|
||||
|
||||
def _generator(self, procs):
|
||||
|
||||
@@ -37,8 +37,8 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface):
|
||||
def get_requirements(cls):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"),
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
# TODO: Convert this to a ListRequirement so that people can filter on sets of pids
|
||||
requirements.IntRequirement(
|
||||
name = 'pid', description = "Process ID to include (all other processes are excluded)",
|
||||
|
||||
@@ -33,8 +33,8 @@ class HiveList(plugins.PluginInterface):
|
||||
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"),
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
requirements.StringRequirement(
|
||||
name = 'filter', description = "String to filter hive names returned", optional = True, default = None)
|
||||
]
|
||||
|
||||
@@ -38,8 +38,8 @@ class PrintKey(interfaces.plugins.PluginInterface):
|
||||
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"),
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
requirements.IntRequirement(name = 'offset', description = "Hive Offset", default = None, optional = True),
|
||||
requirements.StringRequirement(
|
||||
name = 'key', description = "Key to start from", default = None, optional = True),
|
||||
|
||||
@@ -51,8 +51,8 @@ class UserAssist(interfaces.plugins.PluginInterface):
|
||||
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"),
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
requirements.IntRequirement(name = 'offset', description = "Hive Offset", default = None, optional = True)
|
||||
]
|
||||
|
||||
|
||||
@@ -39,8 +39,8 @@ class SSDT(plugins.PluginInterface):
|
||||
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS")
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
]
|
||||
|
||||
def _generator(self, mods: Iterator[Any]) -> Iterator[Tuple[int, Tuple[int, int, Any, Any]]]:
|
||||
|
||||
@@ -37,8 +37,8 @@ class Strings(interfaces.plugins.PluginInterface):
|
||||
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"),
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
requirements.URIRequirement(name = "strings_file", description = "Strings file")
|
||||
]
|
||||
# TODO: Make URLRequirement that can accept a file address which the framework can open
|
||||
|
||||
@@ -39,9 +39,9 @@ class VadDump(interfaces_plugins.PluginInterface):
|
||||
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
|
||||
# Since we're calling the plugin, make sure we have the plugin's requirements
|
||||
return [requirements.TranslationLayerRequirement(name = 'primary',
|
||||
description = 'Kernel Address Space',
|
||||
description = 'Memory layer for the kernel',
|
||||
architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
# TODO: Convert this to a ListRequirement so that people can filter on sets of ranges
|
||||
requirements.IntRequirement(name = 'address',
|
||||
description = "Process virtual memory address to include " \
|
||||
|
||||
@@ -58,9 +58,9 @@ class VadInfo(interfaces.plugins.PluginInterface):
|
||||
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
|
||||
# Since we're calling the plugin, make sure we have the plugin's requirements
|
||||
return [requirements.TranslationLayerRequirement(name = 'primary',
|
||||
description = 'Kernel Address Space',
|
||||
description = 'Memory layer for the kernel',
|
||||
architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
# TODO: Convert this to a ListRequirement so that people can filter on sets of ranges
|
||||
requirements.IntRequirement(name = 'address',
|
||||
description = "Process virtual memory address to include " \
|
||||
|
||||
@@ -43,8 +43,8 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
|
||||
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = "Primary kernel address space", architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"),
|
||||
name = 'primary', description = "Memory layer for the kernel", architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
requirements.BooleanRequirement(
|
||||
name = "wide", description = "Match wide (unicode) strings", default = False, optional = True),
|
||||
requirements.StringRequirement(
|
||||
|
||||
@@ -49,8 +49,8 @@ class VerInfo(interfaces_plugins.PluginInterface):
|
||||
## TODO: and we don't want any CLI options from pslist, modules, or moddump
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"),
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
]
|
||||
|
||||
@classmethod
|
||||
|
||||
@@ -56,7 +56,7 @@ class YaraScan(plugins.PluginInterface):
|
||||
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = "Primary kernel address space", architectures = ["Intel32", "Intel64"]),
|
||||
name = 'primary', description = "Memory layer for the kernel", architectures = ["Intel32", "Intel64"]),
|
||||
requirements.BooleanRequirement(
|
||||
name = "all", description = "Scan both process and kernel memory", default = False, optional = True),
|
||||
requirements.BooleanRequirement(
|
||||
|
||||
Reference in New Issue
Block a user