From 0aa6ba0fe019f53094091eb01dce68d23ec7670f Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 29 Aug 2018 23:29:51 +0100 Subject: [PATCH] Convert hivelist to classmethod style. --- volatility/plugins/windows/hivelist.py | 16 +++++++++------- volatility/plugins/windows/userassist.py | 9 ++++----- 2 files changed, 13 insertions(+), 12 deletions(-) diff --git a/volatility/plugins/windows/hivelist.py b/volatility/plugins/windows/hivelist.py index cdb0a5ebc..be365c892 100644 --- a/volatility/plugins/windows/hivelist.py +++ b/volatility/plugins/windows/hivelist.py @@ -19,19 +19,21 @@ class HiveList(plugins.PluginInterface): default = None)] def _generator(self): - for hive in self.list_hives(): + for hive in self.list_hives(self.context, + self.config["primary"], + self.config["nt_symbols"], + self.config.get('filter', None)): yield (0, (format_hints.Hex(hive.vol.offset), hive.get_name() or "")) - def list_hives(self): + @classmethod + def list_hives(cls, context, layer_name, symbol_table, filter = None): """Lists all the hives in the primary layer""" - layer_name = self.config['primary'] - # We only use the object factory to demonstrate how to use one - kvo = self.context.memory[layer_name].config['kernel_virtual_offset'] - ntkrnlmp = self.context.module(self.config["nt_symbols"], layer_name = layer_name, offset = kvo) + kvo = context.memory[layer_name].config['kernel_virtual_offset'] + ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo) list_head = ntkrnlmp.get_symbol("CmpHiveListHead").address list_entry = ntkrnlmp.object(type_name = "_LIST_ENTRY", offset = kvo + list_head) @@ -39,7 +41,7 @@ class HiveList(plugins.PluginInterface): cmhive = ntkrnlmp.object(type_name = "_CMHIVE", offset = list_entry.vol.offset - reloff) for hive in cmhive.HiveList: - if self.config.get("filter", None) is None or self.config["filter"].lower() in str(hive.get_name() or "").lower(): + if filter is None or filter.lower() in str(hive.get_name() or "").lower(): yield hive def run(self): diff --git a/volatility/plugins/windows/userassist.py b/volatility/plugins/windows/userassist.py index 979b4fdc5..4199d1622 100644 --- a/volatility/plugins/windows/userassist.py +++ b/volatility/plugins/windows/userassist.py @@ -307,11 +307,10 @@ class UserAssist(interfaces_plugins.PluginInterface): if self.config.get('offset', None) is None: try: import volatility.plugins.windows.hivelist as hivelist - plugin_config_path = self.make_subconfig(primary = self.config['primary'], - nt_symbols = self.config['nt_symbols'], - filter = "ntuser.dat") - plugin = hivelist.HiveList(self.context, plugin_config_path) - hive_offsets = [hive.vol.offset for hive in plugin.list_hives()] + hive_offsets = [hive.vol.offset for hive in hivelist.HiveList.list_hives(self.context, + self.config['primary'], + self.config['nt_symbols'], + filter = "ntuser.dat")] except: vollog.warning("Unable to import windows.hivelist plugin, please provide a hive offset") raise ValueError("Unable to import windows.hivelist plugin, please provide a hive offset")