WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-23 18:14:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

Report IRP entries that point inside a hidden module. This is a common rootkit technique.

Browse Source
This commit is contained in:
Andrew Case
2022-11-02 21:10:51 +00:00
parent d09f23a7d7
commit 0b33a79dc6
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/driverirp.py
+8
View File
@@ -48,7 +48,10 @@ class DriverIrp(interfaces.plugins.PluginInterface):
for i, address in enumerate(driver.MajorFunction):
module_symbols = collection.get_module_symbols_by_absolute_location(address)
module_found = False
for module_name, symbol_generator in module_symbols:
module_found = True
symbols_found = False
for symbol in symbol_generator:
@@ -60,6 +63,11 @@ class DriverIrp(interfaces.plugins.PluginInterface):
yield (0, (format_hints.Hex(driver.vol.offset), driver_name, MAJOR_FUNCTIONS[i],
format_hints.Hex(address), module_name, renderers.NotAvailableValue()))
if not module_found:
yield (0, (format_hints.Hex(driver.vol.offset), driver_name, MAJOR_FUNCTIONS[i],
format_hints.Hex(address), renderers.NotAvailableValue(), renderers.NotAvailableValue()))
def run(self):
return renderers.TreeGrid([