WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-22 01:24:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

Plugins: Change most *dump plugins to --dump

Browse Source
This commit is contained in:
Mike Auty
2020-08-26 20:36:52 +01:00
committed by ikelos
parent f78820faf7
commit 1459bdda39
14 changed files with 397 additions and 593 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/memmap.py
+26 -4
View File
@@ -26,7 +26,11 @@ class Memmap(interfaces.plugins.PluginInterface):
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)),
requirements.IntRequirement(name = 'pid',
description = "Process ID to include (all other processes are excluded)",
optional = True)
optional = True),
requirements.BooleanRequirement(name = 'dump',
description = "Extract listed memory segments",
default = False,
optional = True)
]
def _generator(self, procs):
@@ -43,22 +47,40 @@ class Memmap(interfaces.plugins.PluginInterface):
pid, excp.invalid_address, excp.layer_name))
continue
filename = str(pid)
filedata = interfaces.plugins.FileInterface("pid.{}.dmp".format(filename))
for mapval in proc_layer.mapping(0x0, proc_layer.maximum_address, ignore_errors = True):
offset, _, mapped_offset, mapped_size, maplayer = mapval
offset, size, mapped_offset, mapped_size, maplayer = mapval
dumped = False
if self.config['dump']:
try:
data = proc_layer.read(offset, size, pad = True)
filedata.data.write(data)
dumped = True
except exceptions.InvalidAddressException:
vollog.debug("Unable to write {}'s address {} to {}.dmp".format(proc_layer_name, offset,
filedata.preferred_filename))
yield (0, (
format_hints.Hex(offset),
format_hints.Hex(mapped_offset),
format_hints.Hex(mapped_size),
format_hints.Hex(offset)))
format_hints.Hex(offset),
dumped))
offset += mapped_size
import pdb
pdb.set_trace()
self.produce_file(filedata)
def run(self):
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid(
[("Virtual", format_hints.Hex), ("Physical", format_hints.Hex), ("Size", format_hints.Hex),
("Offset", format_hints.Hex)],
("Offset", format_hints.Hex), ("Dumped", bool)],
self._generator(
pslist.PsList.list_processes(context = self.context,
layer_name = self.config['primary'],