WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-28 12:34:53 +02:00
Code Issues Packages Projects Releases Wiki Activity

Casting will use the original object's symbol_table if none is provided.

Browse Source
This commit is contained in:
Mike Auty
2019-07-23 00:46:09 +01:00
parent d1227220b5
commit 164079c203
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/handles.py
+6 -6
View File
@@ -81,8 +81,8 @@ class Handles(interfaces_plugins.PluginInterface):
# before windows 7
if not self.context.layers[virtual].is_valid(handle_table_entry.Object):
return None
fast_ref = handle_table_entry.Object.cast(self.config["nt_symbols"] + constants.BANG + "_EX_FAST_REF")
object_header = fast_ref.dereference().cast(self.config["nt_symbols"] + constants.BANG + "_OBJECT_HEADER")
fast_ref = handle_table_entry.Object.cast("_EX_FAST_REF")
object_header = fast_ref.dereference().cast("_OBJECT_HEADER")
object_header.GrantedAccess = handle_table_entry.GrantedAccess
except AttributeError:
# starting with windows 8
@@ -284,16 +284,16 @@ class Handles(interfaces_plugins.PluginInterface):
continue
if obj_type == "File":
item = entry.Body.cast(self.config["nt_symbols"] + constants.BANG + "_FILE_OBJECT")
item = entry.Body.cast("_FILE_OBJECT")
obj_name = item.file_name_with_device()
elif obj_type == "Process":
item = entry.Body.cast(self.config["nt_symbols"] + constants.BANG + "_EPROCESS")
item = entry.Body.cast("_EPROCESS")
obj_name = "{} Pid {}".format(utility.array_to_string(proc.ImageFileName), item.UniqueProcessId)
elif obj_type == "Thread":
item = entry.Body.cast(self.config["nt_symbols"] + constants.BANG + "_ETHREAD")
item = entry.Body.cast("_ETHREAD")
obj_name = "Tid {} Pid {}".format(item.Cid.UniqueThread, item.Cid.UniqueProcess)
elif obj_type == "Key":
item = entry.Body.cast(self.config["nt_symbols"] + constants.BANG + "_CM_KEY_BODY")
item = entry.Body.cast("_CM_KEY_BODY")
obj_name = item.get_full_key_name()
else:
try: