WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-29 04:54:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

Svcscan: Ensure or later checks are done in order.

Browse Source 
Relates to issue 139.
This commit is contained in:
Mike Auty
2019-11-18 20:57:34 +00:00
parent dc5420df55
commit 249c3ec223
1 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/svcscan.py
+8 -8
View File
@@ -81,19 +81,19 @@ class SvcScan(interfaces.plugins.PluginInterface):
symbol_filename = "services-xp-x86"
elif SvcScan.is_xp_or_2003(context = context, symbol_table = symbol_table) and is_64bit:
symbol_filename = "services-xp-2003-x64"
elif SvcScan.is_win10_16299_or_later(context = context, symbol_table = symbol_table) and is_64bit:
symbol_filename = "services-win10-16299-x64"
elif SvcScan.is_win10_16299_or_later(context = context, symbol_table = symbol_table) and not is_64bit:
symbol_filename = "services-win10-16299-x86"
elif SvcScan.is_win10_up_to_15063(context = context, symbol_table = symbol_table) and is_64bit:
symbol_filename = "services-win10-15063-x64"
elif SvcScan.is_win10_up_to_15063(context = context, symbol_table = symbol_table) and not is_64bit:
symbol_filename = "services-win10-15063-x86"
elif poolscanner.PoolScanner.is_windows_8_or_later(context = context, symbol_table = symbol_table) and is_64bit:
symbol_filename = "services-win8-x64"
elif poolscanner.PoolScanner.is_windows_8_or_later(context = context,
symbol_table = symbol_table) and not is_64bit:
symbol_filename = "services-win8-x86"
elif SvcScan.is_win10_up_to_15063(context = context, symbol_table = symbol_table) and is_64bit:
symbol_filename = "services-win10-15063-x64"
elif SvcScan.is_win10_up_to_15063(context = context, symbol_table = symbol_table) and not is_64bit:
symbol_filename = "services-win10-15063-x86"
elif SvcScan.is_win10_16299_or_later(context = context, symbol_table = symbol_table) and is_64bit:
symbol_filename = "services-win10-16299-x64"
elif SvcScan.is_win10_16299_or_later(context = context, symbol_table = symbol_table) and not is_64bit:
symbol_filename = "services-win10-16299-x86"
elif SvcScan.is_vista_or_later(context = context, symbol_table = symbol_table) and is_64bit:
symbol_filename = "services-vista-x64"
elif SvcScan.is_vista_or_later(context = context, symbol_table = symbol_table) and not is_64bit: