WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-12 04:37:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Linux: Make bang_addrs has something to search for

Browse Source
This commit is contained in:
Mike Auty
2021-03-02 15:50:21 +00:00
parent 9deb0c9d8a
commit 2a41b1eee9
1 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/linux/bash.py
+9 -8
View File
@@ -72,15 +72,16 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
history_entries = []
for address, _ in proc_layer.scan(self.context,
scanners.MultiStringScanner(bang_addrs),
sections = task.get_process_memory_sections(heap_only = True)):
hist = self.context.object(bash_table_name + constants.BANG + "hist_entry",
offset = address - ts_offset,
layer_name = proc_layer_name)
if bang_addrs:
for address, _ in proc_layer.scan(self.context,
scanners.MultiStringScanner(bang_addrs),
sections = task.get_process_memory_sections(heap_only = True)):
hist = self.context.object(bash_table_name + constants.BANG + "hist_entry",
offset = address - ts_offset,
layer_name = proc_layer_name)
if hist.is_valid():
history_entries.append(hist)
if hist.is_valid():
history_entries.append(hist)
for hist in sorted(history_entries, key = lambda x: x.get_time_as_integer()):
yield (0, (task.pid, task_name, hist.get_time_object(), hist.get_command()))