WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-25 02:54:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

Refactor get_peb functionality in EPROCESS

Browse Source
This commit is contained in:
xabiugarte
2019-12-04 20:02:31 +00:00
committed by ikelos
parent a6944f7a06
commit 11d3d304ba
1 changed files with 13 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/symbols/windows/extensions/__init__.py
+13 -34
View File
@@ -712,6 +712,7 @@ class EPROCESS(generic.GenericIntelProcess, ExecutiveObject):
return True
def add_process_layer(self, config_prefix: str = None, preferred_name: str = None):
"""Constructs a new layer based on the process's DirectoryTableBase."""
@@ -735,9 +736,8 @@ class EPROCESS(generic.GenericIntelProcess, ExecutiveObject):
# Add the constructed layer and return the name
return self._add_process_layer(self._context, dtb, config_prefix, preferred_name)
def load_order_modules(self) -> Iterable[int]:
"""Generator for DLLs in the order that they were loaded."""
def get_peb(self) -> interfaces.objects.ObjectInterface:
"""Constructs a PEB object"""
if constants.BANG not in self.vol.type_name:
raise ValueError("Invalid symbol table name syntax (no {} found)".format(constants.BANG))
@@ -751,51 +751,30 @@ class EPROCESS(generic.GenericIntelProcess, ExecutiveObject):
peb = self._context.object("{}{}_PEB".format(sym_table, constants.BANG),
layer_name = proc_layer_name,
offset = self.Peb)
return peb
def load_order_modules(self) -> Iterable[int]:
"""Generator for DLLs in the order that they were loaded."""
peb = self.get_peb()
for entry in peb.Ldr.InLoadOrderModuleList.to_list(
"{}{}_LDR_DATA_TABLE_ENTRY".format(sym_table, constants.BANG), "InLoadOrderLinks"):
"{}{}_LDR_DATA_TABLE_ENTRY".format(self.get_symbol_table().name, constants.BANG), "InLoadOrderLinks"):
yield entry
def init_order_modules(self) -> Iterable[int]:
"""Generator for DLLs in the order that they were loaded."""
if constants.BANG not in self.vol.type_name:
raise ValueError("Invalid symbol table name syntax (no {} found)".format(constants.BANG))
proc_layer_name = self.add_process_layer()
proc_layer = self._context.layers[proc_layer_name]
if not proc_layer.is_valid(self.Peb):
return
sym_table = self.vol.type_name.split(constants.BANG)[0]
peb = self._context.object("{}{}_PEB".format(sym_table, constants.BANG),
layer_name = proc_layer_name,
offset = self.Peb)
peb = self.get_peb()
for entry in peb.Ldr.InInitializationOrderModuleList.to_list(
"{}{}_LDR_DATA_TABLE_ENTRY".format(sym_table, constants.BANG), "InInitializationOrderLinks"):
"{}{}_LDR_DATA_TABLE_ENTRY".format(self.get_symbol_table().name, constants.BANG), "InInitializationOrderLinks"):
yield entry
def mem_order_modules(self) -> Iterable[int]:
"""Generator for DLLs in the order that they were loaded."""
if constants.BANG not in self.vol.type_name:
raise ValueError("Invalid symbol table name syntax (no {} found)".format(constants.BANG))
proc_layer_name = self.add_process_layer()
proc_layer = self._context.layers[proc_layer_name]
if not proc_layer.is_valid(self.Peb):
return
sym_table = self.vol.type_name.split(constants.BANG)[0]
peb = self._context.object("{}{}_PEB".format(sym_table, constants.BANG),
layer_name = proc_layer_name,
offset = self.Peb)
peb = self.get_peb()
for entry in peb.Ldr.InMemoryOrderModuleList.to_list(
"{}{}_LDR_DATA_TABLE_ENTRY".format(sym_table, constants.BANG), "InMemoryOrderLinks"):
"{}{}_LDR_DATA_TABLE_ENTRY".format(self.get_symbol_table().name, constants.BANG), "InMemoryOrderLinks"):
yield entry
def get_handle_count(self):