From 0f05128230a90ff7eecca23812ddcfcb3a037751 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 15:49:01 -0600 Subject: [PATCH] Windows PEDump: Update dependents This updates all plugins that both depend on PEDump and won't require breaking changes of their own. They now call the updated method signature, and have their pedump requirement version bumped appropriately. Co-authored-by: Andrew Case --- volatility3/framework/plugins/windows/dlllist.py | 2 +- volatility3/framework/plugins/windows/modscan.py | 2 +- volatility3/framework/plugins/windows/modules.py | 6 +++--- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/plugins/windows/dlllist.py b/volatility3/framework/plugins/windows/dlllist.py index e7ff81f69..b609b4fc3 100644 --- a/volatility3/framework/plugins/windows/dlllist.py +++ b/volatility3/framework/plugins/windows/dlllist.py @@ -40,7 +40,7 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): name="psscan", component=psscan.PsScan, version=(1, 1, 0) ), requirements.VersionRequirement( - name="pedump", component=pedump.PEDump, version=(1, 0, 0) + name="pedump", component=pedump.PEDump, version=(2, 0, 0) ), requirements.VersionRequirement( name="info", component=info.Info, version=(1, 0, 0) diff --git a/volatility3/framework/plugins/windows/modscan.py b/volatility3/framework/plugins/windows/modscan.py index 76c30ac9c..ab1383ddf 100644 --- a/volatility3/framework/plugins/windows/modscan.py +++ b/volatility3/framework/plugins/windows/modscan.py @@ -55,7 +55,7 @@ class ModScan(modules.Modules): default=None, ), requirements.VersionRequirement( - name="pedump", component=pedump.PEDump, version=(1, 0, 0) + name="pedump", component=pedump.PEDump, version=(2, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index c4f6af4bc..4872135a9 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -37,6 +37,9 @@ class Modules(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="pslist", component=pslist.PsList, version=(3, 0, 0) ), + requirements.VersionRequirement( + name="pedump", component=pedump.PEDump, version=(2, 0, 0) + ), requirements.BooleanRequirement( name="dump", description="Extract listed modules", @@ -54,9 +57,6 @@ class Modules(interfaces.plugins.PluginInterface): optional=True, default=None, ), - requirements.VersionRequirement( - name="pedump", component=pedump.PEDump, version=(1, 0, 0) - ), ] def dump_module(self, session_layers, pe_table_name, mod):