mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-11 12:17:38 +02:00
Changes in structure and data return for efficient partition entries data display
This commit is contained in:
Donghyun Kim
@@ -78,88 +78,57 @@ class MBRScan(interfaces.plugins.PluginInterface):
|
||||
all_zeros = bootcode.count(b"\x00") == len(bootcode)
|
||||
|
||||
if not all_zeros:
|
||||
if not self.config.get("full", True):
|
||||
yield (0, (
|
||||
format_hints.Hex(offset),
|
||||
partition_table.get_disk_signature(),
|
||||
self.get_hash(bootcode),
|
||||
self.get_hash(full_mbr),
|
||||
partition_table.FirstEntry.is_bootable(),
|
||||
partition_table.FirstEntry.get_partition_type(),
|
||||
format_hints.Hex(partition_table.FirstEntry.get_size_in_sectors()),
|
||||
partition_table.SecondEntry.is_bootable(),
|
||||
partition_table.SecondEntry.get_partition_type(),
|
||||
format_hints.Hex(partition_table.SecondEntry.get_size_in_sectors()),
|
||||
partition_table.ThirdEntry.is_bootable(),
|
||||
partition_table.ThirdEntry.get_partition_type(),
|
||||
format_hints.Hex(partition_table.ThirdEntry.get_size_in_sectors()),
|
||||
partition_table.FourthEntry.is_bootable(),
|
||||
partition_table.FourthEntry.get_partition_type(),
|
||||
format_hints.Hex(partition_table.FourthEntry.get_size_in_sectors()),
|
||||
interfaces.renderers.Disassembly(bootcode, 0, architecture)
|
||||
))
|
||||
else:
|
||||
yield (0, (
|
||||
format_hints.Hex(offset),
|
||||
partition_table.get_disk_signature(),
|
||||
self.get_hash(bootcode),
|
||||
self.get_hash(full_mbr),
|
||||
partition_table.FirstEntry.is_bootable(),
|
||||
format_hints.Hex(partition_table.FirstEntry.get_bootable_flag()),
|
||||
partition_table.FirstEntry.get_partition_type(),
|
||||
format_hints.Hex(partition_table.FirstEntry.PartitionType),
|
||||
format_hints.Hex(partition_table.FirstEntry.get_starting_lba()),
|
||||
partition_table.FirstEntry.get_starting_cylinder(),
|
||||
partition_table.FirstEntry.get_starting_chs(),
|
||||
partition_table.FirstEntry.get_starting_sector(),
|
||||
partition_table.FirstEntry.get_ending_cylinder(),
|
||||
partition_table.FirstEntry.get_ending_chs(),
|
||||
partition_table.FirstEntry.get_ending_sector(),
|
||||
format_hints.Hex(partition_table.FirstEntry.get_size_in_sectors()),
|
||||
partition_table.SecondEntry.is_bootable(),
|
||||
format_hints.Hex(partition_table.SecondEntry.get_bootable_flag()),
|
||||
partition_table.SecondEntry.get_partition_type(),
|
||||
format_hints.Hex(partition_table.SecondEntry.PartitionType),
|
||||
format_hints.Hex(partition_table.SecondEntry.get_starting_lba()),
|
||||
partition_table.SecondEntry.get_starting_cylinder(),
|
||||
partition_table.SecondEntry.get_starting_chs(),
|
||||
partition_table.SecondEntry.get_starting_sector(),
|
||||
partition_table.SecondEntry.get_ending_cylinder(),
|
||||
partition_table.SecondEntry.get_ending_chs(),
|
||||
partition_table.SecondEntry.get_ending_sector(),
|
||||
format_hints.Hex(partition_table.SecondEntry.get_size_in_sectors()),
|
||||
partition_table.ThirdEntry.is_bootable(),
|
||||
format_hints.Hex(partition_table.ThirdEntry.get_bootable_flag()),
|
||||
partition_table.ThirdEntry.get_partition_type(),
|
||||
format_hints.Hex(partition_table.ThirdEntry.PartitionType),
|
||||
format_hints.Hex(partition_table.ThirdEntry.get_starting_lba()),
|
||||
partition_table.ThirdEntry.get_starting_cylinder(),
|
||||
partition_table.ThirdEntry.get_starting_chs(),
|
||||
partition_table.ThirdEntry.get_starting_sector(),
|
||||
partition_table.ThirdEntry.get_ending_cylinder(),
|
||||
partition_table.ThirdEntry.get_ending_chs(),
|
||||
partition_table.ThirdEntry.get_ending_sector(),
|
||||
format_hints.Hex(partition_table.ThirdEntry.get_size_in_sectors()),
|
||||
partition_table.FourthEntry.is_bootable(),
|
||||
format_hints.Hex(partition_table.FourthEntry.get_bootable_flag()),
|
||||
partition_table.FourthEntry.get_partition_type(),
|
||||
format_hints.Hex(partition_table.FourthEntry.PartitionType),
|
||||
format_hints.Hex(partition_table.FourthEntry.get_starting_lba()),
|
||||
partition_table.FourthEntry.get_starting_cylinder(),
|
||||
partition_table.FourthEntry.get_starting_chs(),
|
||||
partition_table.FourthEntry.get_starting_sector(),
|
||||
partition_table.FourthEntry.get_ending_cylinder(),
|
||||
partition_table.FourthEntry.get_ending_chs(),
|
||||
partition_table.FourthEntry.get_ending_sector(),
|
||||
format_hints.Hex(partition_table.FourthEntry.get_size_in_sectors()),
|
||||
interfaces.renderers.Disassembly(bootcode, 0, architecture),
|
||||
format_hints.HexBytes(bootcode)
|
||||
))
|
||||
|
||||
partition_entries = [
|
||||
partition_table.FirstEntry, partition_table.SecondEntry,
|
||||
partition_table.ThirdEntry, partition_table.FourthEntry
|
||||
]
|
||||
|
||||
for partition_index, partition_entry_object in enumerate(partition_entries, start=1):
|
||||
# Output disassembly information and bootcode for each partition entry is inefficient,
|
||||
# so it can only be processed in the last index.
|
||||
last_partition_index = 4
|
||||
bootcode_buf = bootcode if(partition_index == last_partition_index) else b""
|
||||
|
||||
if not self.config.get("full", True):
|
||||
yield (0, (
|
||||
format_hints.Hex(offset),
|
||||
partition_table.get_disk_signature(),
|
||||
self.get_hash(bootcode),
|
||||
self.get_hash(full_mbr),
|
||||
partition_index,
|
||||
partition_entry_object.is_bootable(),
|
||||
partition_entry_object.get_partition_type(),
|
||||
format_hints.Hex(partition_entry_object.get_size_in_sectors()),
|
||||
interfaces.renderers.Disassembly(bootcode_buf, 0, architecture)
|
||||
))
|
||||
else:
|
||||
yield (0, (
|
||||
format_hints.Hex(offset),
|
||||
partition_table.get_disk_signature(),
|
||||
self.get_hash(bootcode),
|
||||
self.get_hash(full_mbr),
|
||||
partition_index,
|
||||
partition_entry_object.is_bootable(),
|
||||
format_hints.Hex(partition_entry_object.get_bootable_flag()),
|
||||
partition_entry_object.get_partition_type(),
|
||||
format_hints.Hex(partition_entry_object.PartitionType),
|
||||
format_hints.Hex(partition_entry_object.get_starting_lba()),
|
||||
partition_entry_object.get_starting_cylinder(),
|
||||
partition_entry_object.get_starting_chs(),
|
||||
partition_entry_object.get_starting_sector(),
|
||||
partition_entry_object.get_ending_cylinder(),
|
||||
partition_entry_object.get_ending_chs(),
|
||||
partition_entry_object.get_ending_sector(),
|
||||
format_hints.Hex(partition_entry_object.get_size_in_sectors()),
|
||||
interfaces.renderers.Disassembly(bootcode_buf, 0, architecture),
|
||||
format_hints.HexBytes(bootcode_buf)
|
||||
))
|
||||
else:
|
||||
vollog.log(constants.LOGLEVEL_VVVV, f"Not a valid MBR: Data all zeroed out : {format_hints.Hex(offset)}")
|
||||
vollog.log(constants.LOGLEVEL_VV, f"Not a valid MBR: Data all zeroed out : {format_hints.Hex(offset)}")
|
||||
|
||||
except exceptions.PagedInvalidAddressException:
|
||||
continue
|
||||
pass
|
||||
|
||||
def run(self)-> renderers.TreeGrid:
|
||||
if not self.config.get("full", True):
|
||||
@@ -168,18 +137,10 @@ class MBRScan(interfaces.plugins.PluginInterface):
|
||||
("Disk Signature", str),
|
||||
("Bootcode MD5", str),
|
||||
("Full MBR MD5", str),
|
||||
("PartABootable", bool),
|
||||
("PartAType", str),
|
||||
("PartASectorInSize", format_hints.Hex),
|
||||
("PartBBootable", bool),
|
||||
("PartBType", str),
|
||||
("PartBSectorInSize", format_hints.Hex),
|
||||
("PartCBootable", bool),
|
||||
("PartCType", str),
|
||||
("PartCSectorInSize", format_hints.Hex),
|
||||
("PartDBootable", bool),
|
||||
("PartDType", str),
|
||||
("PartDSectorInSize", format_hints.Hex),
|
||||
("PartitionIndex", int),
|
||||
("Bootable", bool),
|
||||
("PartitionType", str),
|
||||
("SectorInSize", format_hints.Hex),
|
||||
("Disasm", interfaces.renderers.Disassembly)
|
||||
], self._generator())
|
||||
else:
|
||||
@@ -188,54 +149,19 @@ class MBRScan(interfaces.plugins.PluginInterface):
|
||||
("Disk Signature", str),
|
||||
("Bootcode MD5", str),
|
||||
("Full MBR MD5", str),
|
||||
("PartABootable", bool),
|
||||
("PartABootFlag", format_hints.Hex),
|
||||
("PartAType", str),
|
||||
("PartATypeRaw", format_hints.Hex),
|
||||
("PartAStartingLBA", format_hints.Hex),
|
||||
("PartAStartingCylinder", int),
|
||||
("PartAStartingCHS", int),
|
||||
("PartAStartingSector", int),
|
||||
("PartAEndingCylinder", int),
|
||||
("PartAEndingCHS", int),
|
||||
("PartAEndingSector", int),
|
||||
("PartASectorInSize", format_hints.Hex),
|
||||
("PartBBootable", bool),
|
||||
("PartBBootFlag", format_hints.Hex),
|
||||
("PartBType", str),
|
||||
("PartBTypeRaw", format_hints.Hex),
|
||||
("PartBStartingLBA", format_hints.Hex),
|
||||
("PartBStartingCylinder", int),
|
||||
("PartBStartingCHS", int),
|
||||
("PartBStartingSector", int),
|
||||
("PartBEndingCylinder", int),
|
||||
("PartBEndingCHS", int),
|
||||
("PartBEndingSector", int),
|
||||
("PartBSectorInSize", format_hints.Hex),
|
||||
("PartCBootable", bool),
|
||||
("PartCBootFlag", format_hints.Hex),
|
||||
("PartCType", str),
|
||||
("PartCTypeRaw", format_hints.Hex),
|
||||
("PartCStartingLBA", format_hints.Hex),
|
||||
("PartCStartingCylinder", int),
|
||||
("PartCStartingCHS", int),
|
||||
("PartCStartingSector", int),
|
||||
("PartCEndingCylinder", int),
|
||||
("PartCEndingCHS", int),
|
||||
("PartCEndingSector", int),
|
||||
("PartCSectorInSize", format_hints.Hex),
|
||||
("PartDBootable", bool),
|
||||
("PartDBootFlag", format_hints.Hex),
|
||||
("PartDType", str),
|
||||
("PartDTypeRaw", format_hints.Hex),
|
||||
("PartDStartingLBA", format_hints.Hex),
|
||||
("PartDStartingCylinder", int),
|
||||
("PartDStartingCHS", int),
|
||||
("PartDStartingSector", int),
|
||||
("PartDEndingCylinder", int),
|
||||
("PartDEndingCHS", int),
|
||||
("PartDEndingSector", int),
|
||||
("PartDSectorInSize", format_hints.Hex),
|
||||
("PartitionIndex", int),
|
||||
("Bootable", bool),
|
||||
("BootFlag", format_hints.Hex),
|
||||
("PartitionType", str),
|
||||
("PartitionTypeRaw", format_hints.Hex),
|
||||
("StartingLBA", format_hints.Hex),
|
||||
("StartingCylinder", int),
|
||||
("StartingCHS", int),
|
||||
("StartingSector", int),
|
||||
("EndingCylinder", int),
|
||||
("EndingCHS", int),
|
||||
("EndingSector", int),
|
||||
("SectorInSize", format_hints.Hex),
|
||||
("Disasm", interfaces.renderers.Disassembly),
|
||||
("Bootcode", format_hints.HexBytes)
|
||||
], self._generator())
|
||||
|
||||
@@ -2,8 +2,6 @@
|
||||
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
|
||||
#
|
||||
|
||||
import struct
|
||||
|
||||
from volatility3.framework import objects
|
||||
|
||||
class PARTITION_TABLE(objects.StructType):
|
||||
|
||||
Reference in New Issue
Block a user