From 13550aef3fc313f87f9d9c8a3aff3aaf09ae964c Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 16:10:25 -0600 Subject: [PATCH] Windows Modules: Update dependents This updates the ssdt, truecrypt, drivermodule, driverirp, and verinfo plugins to use the new method signatures from the Modules plugin, and updates the requirement version numbers as well. Co-authored-by: Andrew Case --- volatility3/framework/plugins/windows/driverirp.py | 2 +- volatility3/framework/plugins/windows/drivermodule.py | 2 +- volatility3/framework/plugins/windows/ssdt.py | 2 +- volatility3/framework/plugins/windows/truecrypt.py | 4 ++-- volatility3/framework/plugins/windows/verinfo.py | 8 +++----- 5 files changed, 8 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/plugins/windows/driverirp.py b/volatility3/framework/plugins/windows/driverirp.py index 413ea782f..2fc699e79 100644 --- a/volatility3/framework/plugins/windows/driverirp.py +++ b/volatility3/framework/plugins/windows/driverirp.py @@ -65,7 +65,7 @@ class DriverIrp(interfaces.plugins.PluginInterface): name="driverscan", plugin=driverscan.DriverScan, version=(2, 0, 0) ), requirements.PluginRequirement( - name="modules", plugin=modules.Modules, version=(2, 1, 0) + name="modules", plugin=modules.Modules, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/drivermodule.py b/volatility3/framework/plugins/windows/drivermodule.py index c6547aae0..9b4c78ae8 100644 --- a/volatility3/framework/plugins/windows/drivermodule.py +++ b/volatility3/framework/plugins/windows/drivermodule.py @@ -32,7 +32,7 @@ class DriverModule(interfaces.plugins.PluginInterface): name="driverscan", plugin=driverscan.DriverScan, version=(2, 0, 0) ), requirements.PluginRequirement( - name="modules", plugin=modules.Modules, version=(2, 1, 0) + name="modules", plugin=modules.Modules, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/ssdt.py b/volatility3/framework/plugins/windows/ssdt.py index 4e4773ffa..471dc9e18 100644 --- a/volatility3/framework/plugins/windows/ssdt.py +++ b/volatility3/framework/plugins/windows/ssdt.py @@ -32,7 +32,7 @@ class SSDT(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="modules", plugin=modules.Modules, version=(2, 0, 0) + name="modules", plugin=modules.Modules, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/truecrypt.py b/volatility3/framework/plugins/windows/truecrypt.py index 7fd26cb4e..158fc995d 100644 --- a/volatility3/framework/plugins/windows/truecrypt.py +++ b/volatility3/framework/plugins/windows/truecrypt.py @@ -33,7 +33,7 @@ class Passphrase(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="modules", component=modules.Modules, version=(2, 0, 0) + name="modules", component=modules.Modules, version=(3, 0, 0) ), requirements.IntRequirement( name="min-length", @@ -121,7 +121,7 @@ class Passphrase(interfaces.plugins.PluginInterface): def _generator(self): kernel = self.context.modules[self.config["kernel"]] mods: Iterable[ObjectInterface] = modules.Modules.list_modules( - self.context, kernel.layer_name, kernel.symbol_table_name + self.context, self.config["kernel"] ) truecrypt_module_base = next( mod.DllBase diff --git a/volatility3/framework/plugins/windows/verinfo.py b/volatility3/framework/plugins/windows/verinfo.py index 4930789d2..26bc5e63c 100644 --- a/volatility3/framework/plugins/windows/verinfo.py +++ b/volatility3/framework/plugins/windows/verinfo.py @@ -46,7 +46,7 @@ class VerInfo(interfaces.plugins.PluginInterface): name="pslist", plugin=pslist.PsList, version=(2, 0, 0) ), requirements.PluginRequirement( - name="modules", plugin=modules.Modules, version=(2, 0, 0) + name="modules", plugin=modules.Modules, version=(3, 0, 0) ), requirements.BooleanRequirement( name="extensive", @@ -259,13 +259,11 @@ class VerInfo(interfaces.plugins.PluginInterface): self.context, kernel.layer_name, kernel.symbol_table_name ) - mods = modules.Modules.list_modules( - self.context, kernel.layer_name, kernel.symbol_table_name - ) + mods = modules.Modules.list_modules(self.context, self.config["kernel"]) # populate the session layers for kernel modules session_layers = modules.Modules.get_session_layers( - self.context, kernel.layer_name, kernel.symbol_table_name + self.context, self.config["kernel"] ) return renderers.TreeGrid(