From 2cb5435911bae7751bcc1f67c473a83b5c331d27 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 7 May 2018 17:45:40 +0100 Subject: [PATCH] Change the signature for add_process_layer to match linux. --- .../framework/symbols/windows/extensions/__init__.py | 7 +++---- volatility/plugins/windows/vaddump.py | 2 +- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index ebb4e674c..3ab6a2704 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -389,12 +389,11 @@ class _UNICODE_STRING(objects.Struct): class _EPROCESS(generic.GenericIntelProcess): def add_process_layer(self, - context: interfaces.context.ContextInterface, config_prefix: str = None, preferred_name: str = None): """Constructs a new layer based on the process's DirectoryTableBase""" - parent_layer = context.memory[self.vol.layer_name] + parent_layer = self._context.memory[self.vol.layer_name] if not isinstance(parent_layer, intel.Intel): # We can't get bits_per_register unless we're an intel space (since that's not defined at the higher layer) @@ -408,7 +407,7 @@ class _EPROCESS(generic.GenericIntelProcess): dtb = dtb & ((1 << parent_layer.bits_per_register) - 1) # Add the constructed layer and return the name - return self._add_process_layer(context, dtb, config_prefix, preferred_name) + return self._add_process_layer(self._context, dtb, config_prefix, preferred_name) def load_order_modules(self) -> typing.Iterable[int]: """Generator for DLLs in the order that they were loaded""" @@ -416,7 +415,7 @@ class _EPROCESS(generic.GenericIntelProcess): if constants.BANG not in self.vol.type_name: raise ValueError("Invalid symbol table name syntax (no {} found)".format(constants.BANG)) - proc_layer_name = self.add_process_layer(self._context) + proc_layer_name = self.add_process_layer() proc_layer = self._context.memory[proc_layer_name] if not proc_layer.is_valid(self.Peb): diff --git a/volatility/plugins/windows/vaddump.py b/volatility/plugins/windows/vaddump.py index ae74344a9..f567cbd49 100644 --- a/volatility/plugins/windows/vaddump.py +++ b/volatility/plugins/windows/vaddump.py @@ -26,7 +26,7 @@ class VadDump(interfaces_plugins.PluginInterface): process_name = utility.array_to_string(proc.ImageFileName) # TODO: what kind of exceptions could this raise and what should we do? - proc_layer_name = proc.add_process_layer(self.context) + proc_layer_name = proc.add_process_layer() proc_layer = self.context.memory[proc_layer_name] for vad in plugin.list_vads(proc):