WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 03:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Revert method for get driver's and device's name

Browse Source
This commit is contained in:
Donghyun Kim
2022-03-28 03:34:24 +09:00
parent ff9c5cea4f
commit 2f3bc8cf0d
2 changed files with 8 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/devicetree.py
+2 -3
View File
@@ -77,7 +77,7 @@ vollog = logging.getLogger(__name__)
class DeviceTree(interfaces.plugins.PluginInterface):
"""Listing tree based on drivers and attached devices in a particular windows memory image."""
_required_framework_version = (2, 0, 1)
_required_framework_version = (2, 0, 3)
_version = (1, 0, 0)
@classmethod
@@ -121,8 +121,7 @@ class DeviceTree(interfaces.plugins.PluginInterface):
for level, attached_device in enumerate(device.get_attached_devices(), start=2):
device_name = attached_device.get_device_name()
attached_device_name = "Unparsable Value" if isinstance(device_name, renderers.UnparsableValue) else device_name
name = "{} - {}".format(attached_device_name, attached_device.DriverObject.DriverName.get_string())
name = "{} - {}".format(device_name, attached_device.DriverObject.DriverName.get_string())
attached_device_type = DEVICE_CODES.get(attached_device.DeviceType, "UNKNOWN")
volatility3/framework/symbols/windows/extensions/__init__.py
+6 -12
View File
@@ -352,13 +352,10 @@ class EX_FAST_REF(objects.StructType):
class DEVICE_OBJECT(objects.StructType, pool.ExecutiveObject):
"""A class for kernel device objects."""
def get_device_name(self) -> Union[str, interfaces.renderers.BaseAbsentValue]:
def get_device_name(self) -> str:
"""Get device's name from the object header."""
try:
header = self.get_object_header()
return header.NameInfo.Name.String # type: ignore
except(ValueError):
return renderers.UnparsableValue()
header = self.get_object_header()
return header.NameInfo.Name.String # type: ignore
def get_attached_devices(self) -> Generator[ObjectInterface, None, None]:
"""Enumerate the device's attaches"""
@@ -370,13 +367,10 @@ class DEVICE_OBJECT(objects.StructType, pool.ExecutiveObject):
class DRIVER_OBJECT(objects.StructType, pool.ExecutiveObject):
"""A class for kernel driver objects."""
def get_driver_name(self) -> Union[str, interfaces.renderers.BaseAbsentValue]:
def get_driver_name(self) -> str:
"""Get driver's name from the object header."""
try:
header = self.get_object_header()
return header.NameInfo.Name.String # type: ignore
except(ValueError):
return renderers.UnparsableValue()
header = self.get_object_header()
return header.NameInfo.Name.String # type: ignore
def get_devices(self) -> Generator[ObjectInterface, None, None]:
"""Enumerate the driver's device objects"""