WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-31 04:09:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Windows: Adds windows OS version checks

Browse Source
This commit is contained in:
David McDonald
2025-03-05 17:59:38 -06:00
parent b92247fe32
commit 319edbb486
1 changed files with 51 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/symbols/windows/versions.py
+51 -2
View File
@@ -1,7 +1,7 @@
import logging
from typing import Callable, Tuple, List, Optional
from typing import Callable, List, Optional, Tuple
from volatility3.framework import interfaces, constants, exceptions
from volatility3.framework import constants, exceptions, interfaces
vollog = logging.getLogger(__name__)
@@ -187,6 +187,22 @@ is_win10_16299_or_later = OsDistinguisher(
],
)
is_win10_17134_or_later = OsDistinguisher(
version_check=lambda x: x >= (10, 0, 17134),
fallback_checks=[
("_EPROCESS", "ProcessFirstResume", True),
("_EPROCESS", "HighMemoryPriority", True),
],
)
is_win10_10586_or_later = OsDistinguisher(
version_check=lambda x: x >= (10, 0, 10586),
fallback_checks=[
("_EPROCESS", "SecurityDomain", False),
("_EPROCESS", "ImageFilePointer", False),
],
)
is_win10_17763_or_later = OsDistinguisher(
version_check=lambda x: x >= (10, 0, 17763),
fallback_checks=[
@@ -218,6 +234,14 @@ is_win10_19041_or_later = OsDistinguisher(
],
)
is_win10_19577_or_later = OsDistinguisher(
version_check=lambda x: x >= (10, 0, 19577),
fallback_checks=[
("_EPROCESS", "PaeTop", False),
("_EPROCESS", "IdealProcessorAssignmentBlock", True),
],
)
is_win10_25398_or_later = OsDistinguisher(
version_check=lambda x: x >= (10, 0, 25398),
fallback_checks=[
@@ -235,6 +259,31 @@ is_windows_8_or_later = OsDistinguisher(
version_check=lambda x: x >= (6, 2),
fallback_checks=[("_HANDLE_TABLE", "HandleCount", False)],
)
is_windows_7_sp0 = OsDistinguisher(
version_check=lambda x: x == (6, 1, 7600),
fallback_checks=[
("_EPROCESS", "VdmObjects", True),
("_EPROCESS", "UmsScheduledThreads", False),
# Dropped after vista
("_EPROCESS", "QuotaUsage", False),
# Added win8
("_EPROCESS", "WnfContext", False),
],
)
is_windows_7_sp1 = OsDistinguisher(
version_check=lambda x: x == (6, 1, 7601),
fallback_checks=[
("_EPROCESS", "VdmObjects", False),
("_EPROCESS", "UmsScheduledThreads", True),
# Dropped after vista
("_EPROCESS", "QuotaUsage", False),
# Added win8
("_EPROCESS", "WnfContext", False),
],
)
# Technically, this is win7 or less
is_windows_7 = OsDistinguisher(
version_check=lambda x: x == (6, 1),