From 2e8d18e7cb7621821e724515ed23bf3c8320234d Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 15 Feb 2025 21:51:14 +0000 Subject: [PATCH] Windows: Convert mbrscan over to LayerData output --- volatility3/framework/plugins/windows/mbrscan.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/mbrscan.py b/volatility3/framework/plugins/windows/mbrscan.py index 4d5198181..b279307d7 100644 --- a/volatility3/framework/plugins/windows/mbrscan.py +++ b/volatility3/framework/plugins/windows/mbrscan.py @@ -149,7 +149,12 @@ class MBRScan(interfaces.plugins.PluginInterface): interfaces.renderers.Disassembly( bootcode, 0, architecture ), - format_hints.HexBytes(bootcode), + interfaces.renderers.LayerData( + context=self.context, + layer_name=layer.name, + offset=mbr_start_offset, + length=bootcode_length, + ), ), ) @@ -257,7 +262,7 @@ class MBRScan(interfaces.plugins.PluginInterface): ("EndingSector", int), ("SectorInSize", format_hints.Hex), ("Disasm", interfaces.renderers.Disassembly), - ("Bootcode", format_hints.HexBytes), + ("Bootcode", interfaces.renderers.LayerData), ], self._generator(), )