WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-07 18:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Windows Hivelist: Update dependents

Browse Source 
This updates all plugins that depend on windows.hivelist.HiveList to use
the updated method signature, and bumps their dependency version
accordingly.

Co-authored-by: Andrew Case <andrew@dfir.org>
This commit is contained in:
David McDonald
2025-03-05 17:59:38 -06:00
co-authored by Andrew Case
parent 6092e3ee0a
commit 3a7e61b285
10 changed files with 29 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/cachedump.py
+2 -4
View File
@@ -33,7 +33,7 @@ class Cachedump(interfaces.plugins.PluginInterface):
architectures=["Intel32", "Intel64"],
),
requirements.PluginRequirement(
name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0)
name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0)
),
requirements.PluginRequirement(
name="lsadump", plugin=lsadump.Lsadump, version=(1, 0, 0)
@@ -169,13 +169,11 @@ class Cachedump(interfaces.plugins.PluginInterface):
offset = self.config.get("offset", None)
syshive = sechive = None
kernel = self.context.modules[self.config["kernel"]]
for hive in hivelist.HiveList.list_hives(
self.context,
self.config_path,
kernel.layer_name,
kernel.symbol_table_name,
self.config["kernel"],
hive_offsets=None if offset is None else [offset],
):
if hive.get_name().split("\\")[-1].upper() == "SYSTEM":
volatility3/framework/plugins/windows/envars.py
+4 -6
View File
@@ -43,7 +43,7 @@ class Envars(interfaces.plugins.PluginInterface):
name="pslist", plugin=pslist.PsList, version=(2, 0, 0)
),
requirements.PluginRequirement(
name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0)
name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0)
),
]
@@ -58,13 +58,11 @@ class Envars(interfaces.plugins.PluginInterface):
"""
values = []
kernel = self.context.modules[self.config["kernel"]]
for hive in hivelist.HiveList.list_hives(
context=self.context,
base_config_path=self.config_path,
layer_name=kernel.layer_name,
symbol_table=kernel.symbol_table_name,
self.context,
self.config_path,
self.config["kernel"],
hive_offsets=None,
):
## The global variables
volatility3/framework/plugins/windows/getservicesids.py
+4 -6
View File
@@ -69,18 +69,16 @@ class GetServiceSIDs(interfaces.plugins.PluginInterface):
architectures=["Intel32", "Intel64"],
),
requirements.PluginRequirement(
name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0)
name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0)
),
]
def _generator(self):
kernel = self.context.modules[self.config["kernel"]]
# Get the system hive
for hive in hivelist.HiveList.list_hives(
context=self.context,
base_config_path=self.config_path,
layer_name=kernel.layer_name,
symbol_table=kernel.symbol_table_name,
self.context,
self.config_path,
self.config["kernel"],
filter_string="machine\\system",
hive_offsets=None,
):
volatility3/framework/plugins/windows/getsids.py
+4 -6
View File
@@ -87,7 +87,7 @@ class GetSIDs(interfaces.plugins.PluginInterface):
name="pslist", plugin=pslist.PsList, version=(2, 0, 0)
),
requirements.PluginRequirement(
name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0)
name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0)
),
]
@@ -101,14 +101,12 @@ class GetSIDs(interfaces.plugins.PluginInterface):
key = "Microsoft\\Windows NT\\CurrentVersion\\ProfileList"
val = "ProfileImagePath"
kernel = self.context.modules[self.config["kernel"]]
sids = {}
for hive in hivelist.HiveList.list_hives(
context=self.context,
base_config_path=self.config_path,
layer_name=kernel.layer_name,
symbol_table=kernel.symbol_table_name,
self.context,
self.config_path,
self.config["kernel"],
filter_string="config\\software",
hive_offsets=None,
):
volatility3/framework/plugins/windows/hashdump.py
+2 -4
View File
@@ -32,7 +32,7 @@ class Hashdump(interfaces.plugins.PluginInterface):
architectures=["Intel32", "Intel64"],
),
requirements.PluginRequirement(
name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0)
name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0)
),
]
@@ -593,12 +593,10 @@ class Hashdump(interfaces.plugins.PluginInterface):
offset = self.config.get("offset", None)
syshive = None
samhive = None
kernel = self.context.modules[self.config["kernel"]]
for hive in hivelist.HiveList.list_hives(
self.context,
self.config_path,
kernel.layer_name,
kernel.symbol_table_name,
self.config["kernel"],
hive_offsets=None if offset is None else [offset],
):
if hive.get_name().split("\\")[-1].upper() == "SYSTEM":
volatility3/framework/plugins/windows/lsadump.py
+2 -4
View File
@@ -36,7 +36,7 @@ class Lsadump(interfaces.plugins.PluginInterface):
name="hashdump", component=hashdump.Hashdump, version=(1, 1, 0)
),
requirements.VersionRequirement(
name="hivelist", component=hivelist.HiveList, version=(1, 0, 0)
name="hivelist", component=hivelist.HiveList, version=(2, 0, 0)
),
]
@@ -209,13 +209,11 @@ class Lsadump(interfaces.plugins.PluginInterface):
def run(self):
offset = self.config.get("offset", None)
syshive = sechive = None
kernel = self.context.modules[self.config["kernel"]]
for hive in hivelist.HiveList.list_hives(
self.context,
self.config_path,
kernel.layer_name,
kernel.symbol_table_name,
self.config["kernel"],
hive_offsets=None if offset is None else [offset],
):
if hive.get_name().split("\\")[-1].upper() == "SYSTEM":
volatility3/framework/plugins/windows/registry/getcellroutine.py
+2 -5
View File
@@ -28,7 +28,7 @@ class GetCellRoutine(interfaces.plugins.PluginInterface):
architectures=["Intel32", "Intel64"],
),
requirements.PluginRequirement(
name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0)
name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0)
),
requirements.PluginRequirement(
name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0)
@@ -43,10 +43,7 @@ class GetCellRoutine(interfaces.plugins.PluginInterface):
# walk each hive and validate that the GetCellRoutine handler
# is inside of the kernel (ntoskrnl)
for hive_object in hivelist.HiveList.list_hives(
context=self.context,
base_config_path=self.config_path,
layer_name=kernel.layer_name,
symbol_table=kernel.symbol_table_name,
self.context, self.config_path, self.config["kernel"]
):
hive = hive_object.hive
volatility3/framework/plugins/windows/registry/printkey.py
+2 -8
View File
@@ -31,7 +31,7 @@ class PrintKey(interfaces.plugins.PluginInterface):
architectures=["Intel32", "Intel64"],
),
requirements.PluginRequirement(
name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0)
name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0)
),
requirements.IntRequirement(
name="offset", description="Hive Offset", default=None, optional=True
@@ -240,8 +240,6 @@ class PrintKey(interfaces.plugins.PluginInterface):
def _registry_walker(
self,
layer_name: str,
symbol_table: str,
hive_offsets: Optional[List[int]] = None,
key: Optional[str] = None,
recurse: bool = False,
@@ -249,8 +247,7 @@ class PrintKey(interfaces.plugins.PluginInterface):
for hive in hivelist.HiveList.list_hives(
self.context,
self.config_path,
layer_name=layer_name,
symbol_table=symbol_table,
self.config["kernel"],
hive_offsets=hive_offsets,
):
try:
@@ -292,7 +289,6 @@ class PrintKey(interfaces.plugins.PluginInterface):
def run(self):
offset = self.config.get("offset", None)
kernel = self.context.modules[self.config["kernel"]]
return TreeGrid(
columns=[
@@ -305,8 +301,6 @@ class PrintKey(interfaces.plugins.PluginInterface):
("Volatile", bool),
],
generator=self._registry_walker(
kernel.layer_name,
kernel.symbol_table_name,
hive_offsets=None if offset is None else [offset],
key=self.config.get("key", None),
recurse=self.config.get("recurse", None),
volatility3/framework/plugins/windows/registry/userassist.py
+4 -6
View File
@@ -54,7 +54,7 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac
name="offset", description="Hive Offset", default=None, optional=True
),
requirements.PluginRequirement(
name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0)
name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0)
),
]
@@ -295,7 +295,6 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac
hive_offsets = None
if self.config.get("offset", None) is not None:
hive_offsets = [self.config.get("offset", None)]
kernel = self.context.modules[self.config["kernel"]]
self._reg_table_name = intermed.IntermediateSymbolTable.create(
self.context, self._config_path, "windows", "registry"
@@ -303,10 +302,9 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac
# get all the user hive offsets or use the one specified
for hive in hivelist.HiveList.list_hives(
context=self.context,
base_config_path=self.config_path,
layer_name=kernel.layer_name,
symbol_table=kernel.symbol_table_name,
self.context,
self.config_path,
self.config["kernel"],
filter_string="ntuser.dat",
hive_offsets=hive_offsets,
):
volatility3/plugins/windows/registry/certificates.py
+3 -6
View File
@@ -25,7 +25,7 @@ class Certificates(interfaces.plugins.PluginInterface):
architectures=["Intel32", "Intel64"],
),
requirements.PluginRequirement(
name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0)
name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0)
),
requirements.PluginRequirement(
name="printkey", plugin=printkey.PrintKey, version=(1, 0, 0)
@@ -69,13 +69,10 @@ class Certificates(interfaces.plugins.PluginInterface):
return None
def _generator(self) -> Iterator[Tuple[int, Tuple[str, str, str, str]]]:
kernel = self.context.modules[self.config["kernel"]]
for hive in hivelist.HiveList.list_hives(
self.context,
base_config_path=self.config_path,
layer_name=kernel.layer_name,
symbol_table=kernel.symbol_table_name,
self.config_path,
self.config["kernel"],
):
for top_key in [
"Microsoft\\SystemCertificates",