WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 17:57:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Prevent pslist from backtracing on invalid process. Include a warning with the offset.

Browse Source
This commit is contained in:
atcuno
2021-03-19 11:51:23 -05:00
parent 8e420dec41
commit 0be5dad2bd
1 changed files with 16 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/pslist.py
+16 -11
View File
@@ -6,7 +6,7 @@ import datetime
import logging
from typing import Callable, Iterable, List, Type
from volatility3.framework import renderers, interfaces, layers, constants
from volatility3.framework import renderers, interfaces, layers, exceptions, constants
from volatility3.framework.configuration import requirements
from volatility3.framework.objects import utility
from volatility3.framework.renderers import format_hints
@@ -187,17 +187,22 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
(_, _, offset, _, _) = list(memory.mapping(offset = proc.vol.offset, length = 0))[0]
file_output = "Disabled"
if self.config['dump']:
file_handle = self.process_dump(self.context, self.config['nt_symbols'], pe_table_name, proc, self.open)
file_output = "Error outputting file"
if file_handle:
file_handle.close()
file_output = str(file_handle.preferred_filename)
yield (0, (proc.UniqueProcessId, proc.InheritedFromUniqueProcessId,
proc.ImageFileName.cast("string", max_length = proc.ImageFileName.vol.count, errors = 'replace'),
format_hints.Hex(offset), proc.ActiveThreads, proc.get_handle_count(), proc.get_session_id(),
proc.get_is_wow64(), proc.get_create_time(), proc.get_exit_time(), file_output))
try:
if self.config['dump']:
file_handle = self.process_dump(self.context, self.config['nt_symbols'], pe_table_name, proc, self.open)
file_output = "Error outputting file"
if file_handle:
file_handle.close()
file_output = str(file_handle.preferred_filename)
yield (0, (proc.UniqueProcessId, proc.InheritedFromUniqueProcessId,
proc.ImageFileName.cast("string", max_length = proc.ImageFileName.vol.count, errors = 'replace'),
format_hints.Hex(offset), proc.ActiveThreads, proc.get_handle_count(), proc.get_session_id(),
proc.get_is_wow64(), proc.get_create_time(), proc.get_exit_time(), file_output))
except exceptions.InvalidAddressException:
vollog.debug("Invalid process found at address: {:x}. Skipping".format(proc.vol.offset))
def generate_timeline(self):
for row in self._generator():