WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 17:57:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Convert hivelist to classmethod style.

Browse Source
This commit is contained in:
Mike Auty
2018-08-29 23:29:51 +01:00
parent 059be517fc
commit 0aa6ba0fe0
2 changed files with 13 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/plugins/windows/hivelist.py
+9 -7
View File
@@ -19,19 +19,21 @@ class HiveList(plugins.PluginInterface):
default = None)]
def _generator(self):
for hive in self.list_hives():
for hive in self.list_hives(self.context,
self.config["primary"],
self.config["nt_symbols"],
self.config.get('filter', None)):
yield (0, (format_hints.Hex(hive.vol.offset),
hive.get_name() or ""))
def list_hives(self):
@classmethod
def list_hives(cls, context, layer_name, symbol_table, filter = None):
"""Lists all the hives in the primary layer"""
layer_name = self.config['primary']
# We only use the object factory to demonstrate how to use one
kvo = self.context.memory[layer_name].config['kernel_virtual_offset']
ntkrnlmp = self.context.module(self.config["nt_symbols"], layer_name = layer_name, offset = kvo)
kvo = context.memory[layer_name].config['kernel_virtual_offset']
ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo)
list_head = ntkrnlmp.get_symbol("CmpHiveListHead").address
list_entry = ntkrnlmp.object(type_name = "_LIST_ENTRY", offset = kvo + list_head)
@@ -39,7 +41,7 @@ class HiveList(plugins.PluginInterface):
cmhive = ntkrnlmp.object(type_name = "_CMHIVE", offset = list_entry.vol.offset - reloff)
for hive in cmhive.HiveList:
if self.config.get("filter", None) is None or self.config["filter"].lower() in str(hive.get_name() or "").lower():
if filter is None or filter.lower() in str(hive.get_name() or "").lower():
yield hive
def run(self):
volatility/plugins/windows/userassist.py
+4 -5
View File
@@ -307,11 +307,10 @@ class UserAssist(interfaces_plugins.PluginInterface):
if self.config.get('offset', None) is None:
try:
import volatility.plugins.windows.hivelist as hivelist
plugin_config_path = self.make_subconfig(primary = self.config['primary'],
nt_symbols = self.config['nt_symbols'],
filter = "ntuser.dat")
plugin = hivelist.HiveList(self.context, plugin_config_path)
hive_offsets = [hive.vol.offset for hive in plugin.list_hives()]
hive_offsets = [hive.vol.offset for hive in hivelist.HiveList.list_hives(self.context,
self.config['primary'],
self.config['nt_symbols'],
filter = "ntuser.dat")]
except:
vollog.warning("Unable to import windows.hivelist plugin, please provide a hive offset")
raise ValueError("Unable to import windows.hivelist plugin, please provide a hive offset")