Plugins: Change most *dump plugins to --dump

2026-09-10 11:47:38 +02:00 · 2020-08-26 20:36:52 +01:00
parent f78820faf7
commit 1459bdda39
14 changed files with 397 additions and 593 deletions
@@ -33,79 +33,6 @@ class ModDump(interfaces.plugins.PluginInterface):
            requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
        ]

-    @classmethod
-    def get_session_layers(cls,
-                           context: interfaces.context.ContextInterface,
-                           layer_name: str,
-                           symbol_table: str,
-                           pids: List[int] = None) -> Generator[str, None, None]:
-        """Build a cache of possible virtual layers, in priority starting with
-        the primary/kernel layer. Then keep one layer per session by cycling
-        through the process list.
-
-        Args:
-            context: The context to retrieve required elements (layers, symbol tables) from
-            layer_name: The name of the layer on which to operate
-            symbol_table: The name of the table containing the kernel symbols
-            pids: A list of process identifiers to include exclusively or None for no filter
-
-        Returns:
-            A list of session layer names
-        """
-        seen_ids = []  # type: List[interfaces.objects.ObjectInterface]
-        filter_func = pslist.PsList.create_pid_filter(pids or [])
-
-        for proc in pslist.PsList.list_processes(context = context,
-                                                 layer_name = layer_name,
-                                                 symbol_table = symbol_table,
-                                                 filter_func = filter_func):
-            proc_id = "Unknown"
-            try:
-                proc_id = proc.UniqueProcessId
-                proc_layer_name = proc.add_process_layer()
-
-                # create the session space object in the process' own layer.
-                # not all processes have a valid session pointer.
-                session_space = context.object(symbol_table + constants.BANG + "_MM_SESSION_SPACE",
-                                               layer_name = layer_name,
-                                               offset = proc.Session)
-
-                if session_space.SessionId in seen_ids:
-                    continue
-
-            except exceptions.InvalidAddressException:
-                vollog.log(
-                    constants.LOGLEVEL_VVV,
-                    "Process {} does not have a valid Session or a layer could not be constructed for it".format(
-                        proc_id))
-                continue
-
-            # save the layer if we haven't seen the session yet
-            seen_ids.append(session_space.SessionId)
-            yield proc_layer_name
-
-    @classmethod
-    def find_session_layer(cls, context: interfaces.context.ContextInterface, session_layers: Iterable[str],
-                           base_address: int):
-        """Given a base address and a list of layer names, find a layer that
-        can access the specified address.
-
-        Args:
-            context: The context to retrieve required elements (layers, symbol tables) from
-            layer_name: The name of the layer on which to operate
-            symbol_table: The name of the table containing the kernel symbols
-            session_layers: A list of session layer names
-            base_address: The base address to identify the layers that can access it
-
-        Returns:
-            Layer name or None if no layers that contain the base address can be found
-        """
-
-        for layer_name in session_layers:
-            if context.layers[layer_name].is_valid(base_address):
-                return layer_name
-
-        return None

    def _generator(self, mods):