Move all core plugins over to framework/plugins.

This should have no impact functionality-wise. The statistics plugin was left out a) as an example and b) because it was committed by mistake in the first place and was never meant to be a real plugin.
2026-09-29 04:54:51 +02:00 · 2018-12-16 13:40:15 +00:00
parent 9824538bd9
commit 35ad2325a8
38 changed files with 9 additions and 0 deletions
@@ -0,0 +1,56 @@
+from typing import List
+
+import volatility.framework.constants as constants
+import volatility.framework.interfaces.plugins as interfaces_plugins
+from volatility.framework import exceptions, renderers, interfaces
+from volatility.framework.configuration import requirements
+from volatility.framework.objects import utility
+from volatility.plugins.windows import pslist
+
+
+class CmdLine(interfaces_plugins.PluginInterface):
+    """Lists process command line arguments"""
+
+    @classmethod
+    def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
+        # Since we're calling the plugin, make sure we have the plugin's requirements
+        return [requirements.TranslationLayerRequirement(name = 'primary',
+                                                         description = 'Kernel Address Space',
+                                                         architectures = ["Intel32", "Intel64"]),
+                requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS")]
+
+    def _generator(self, procs):
+
+        for proc in procs:
+            process_name = utility.array_to_string(proc.ImageFileName)
+            # TODO: what kind of exceptions could this raise and what should we do?
+            proc_layer_name = proc.add_process_layer()
+
+            try:
+                peb = self._context.object(self.config["nt_symbols"] + constants.BANG + "_PEB",
+                                           layer_name = proc_layer_name,
+                                           offset = proc.Peb)
+
+                result_text = peb.ProcessParameters.CommandLine.get_string()
+
+            except exceptions.SwappedInvalidAddressException as exp:
+                result_text = "Required memory at {0:#x} is inaccessible (swapped)".format(exp.invalid_address)
+
+            except exceptions.PagedInvalidAddressException as exp:
+                result_text = "Required memory at {0:#x} is not valid (process exited?)".format(exp.invalid_address)
+
+            yield (0, (proc.UniqueProcessId,
+                       process_name,
+                       result_text))
+
+    def run(self):
+
+        filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
+
+        return renderers.TreeGrid([("PID", int),
+                                   ("Process", str),
+                                   ("Args", str)],
+                                  self._generator(pslist.PsList.list_processes(context = self.context,
+                                                                               layer_name = self.config['primary'],
+                                                                               symbol_table = self.config['nt_symbols'],
+                                                                               filter_func = filter_func)))