Add in testing plugin temporarily.

2026-08-24 07:02:23 +02:00 · 2017-10-09 00:18:15 +01:00
parent 19d66bd063
commit 27e5dbfcc6
1 changed files with 42 additions and 0 deletions
@@ -0,0 +1,42 @@
+import volatility.framework.interfaces.plugins as plugins
+from volatility.framework.configuration import requirements
+from volatility.framework.interfaces import configuration
+from volatility.framework.interfaces.configuration import HierarchicalDict
+from volatility.framework.layers.registry import RegistryHive
+
+
+class RegTest(plugins.PluginInterface):
+    """Lists the processes present in a particular memory image"""
+
+    @classmethod
+    def get_requirements(cls):
+        return [requirements.TranslationLayerRequirement(name = 'primary',
+                                                         description = 'Kernel Address Space',
+                                                         architectures = ["Intel32", "Intel64"]),
+                requirements.SymbolRequirement(name = "ntkrnlmp",
+                                               description = "Windows OS"),
+                requirements.IntRequirement(name = 'offset',
+                                            description = "Hive Offset",
+                                            default = 0,
+                                            optional = True)]
+
+    def update_configuration(self):
+        """No operation since all values provided by config/requirements initially"""
+
+    def run(self):
+        layer = self.context.memory[self.config['primary']]
+        reg_config = HierarchicalDict({'hive_offset': 0xe1ca8210,
+                                       'base_layer': self.config['primary'],
+                                       'ntkrnlmp': self.config['ntkrnlmp']})
+        self.config.splice('registry', reg_config)
+
+        registry_config_path = configuration.path_join(self.config_path, 'registry')
+        registry_layer = RegistryHive(self.context, registry_config_path, name = 'hive0', os = 'Windows')
+        self.context.memory.add_layer(registry_layer)
+        root_node = registry_layer.get_cell(registry_layer.root_cell)
+        name = root_node.Name.cast("string", max_length = root_node.NameLength, errors = "replace",
+                                   encoding = "latin-1")
+        import pdb
+        pdb.set_trace()
+
+        print("Signature:", registry_layer.subkeys(root_node))