From 3a7e61b2855f4f6452008ae9ee3a5a4eeeeb1a37 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 15:25:06 -0600 Subject: [PATCH] Windows Hivelist: Update dependents This updates all plugins that depend on windows.hivelist.HiveList to use the updated method signature, and bumps their dependency version accordingly. Co-authored-by: Andrew Case --- volatility3/framework/plugins/windows/cachedump.py | 6 ++---- volatility3/framework/plugins/windows/envars.py | 10 ++++------ .../framework/plugins/windows/getservicesids.py | 10 ++++------ volatility3/framework/plugins/windows/getsids.py | 10 ++++------ volatility3/framework/plugins/windows/hashdump.py | 6 ++---- volatility3/framework/plugins/windows/lsadump.py | 6 ++---- .../plugins/windows/registry/getcellroutine.py | 7 ++----- .../framework/plugins/windows/registry/printkey.py | 10 ++-------- .../framework/plugins/windows/registry/userassist.py | 10 ++++------ volatility3/plugins/windows/registry/certificates.py | 9 +++------ 10 files changed, 29 insertions(+), 55 deletions(-) diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py index f4f2e061e..5f5862e36 100644 --- a/volatility3/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -33,7 +33,7 @@ class Cachedump(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0) + name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) ), requirements.PluginRequirement( name="lsadump", plugin=lsadump.Lsadump, version=(1, 0, 0) @@ -169,13 +169,11 @@ class Cachedump(interfaces.plugins.PluginInterface): offset = self.config.get("offset", None) syshive = sechive = None - kernel = self.context.modules[self.config["kernel"]] for hive in hivelist.HiveList.list_hives( self.context, self.config_path, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], hive_offsets=None if offset is None else [offset], ): if hive.get_name().split("\\")[-1].upper() == "SYSTEM": diff --git a/volatility3/framework/plugins/windows/envars.py b/volatility3/framework/plugins/windows/envars.py index 61414778d..6ea95b33e 100644 --- a/volatility3/framework/plugins/windows/envars.py +++ b/volatility3/framework/plugins/windows/envars.py @@ -43,7 +43,7 @@ class Envars(interfaces.plugins.PluginInterface): name="pslist", plugin=pslist.PsList, version=(2, 0, 0) ), requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0) + name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) ), ] @@ -58,13 +58,11 @@ class Envars(interfaces.plugins.PluginInterface): """ values = [] - kernel = self.context.modules[self.config["kernel"]] for hive in hivelist.HiveList.list_hives( - context=self.context, - base_config_path=self.config_path, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config_path, + self.config["kernel"], hive_offsets=None, ): ## The global variables diff --git a/volatility3/framework/plugins/windows/getservicesids.py b/volatility3/framework/plugins/windows/getservicesids.py index 207d0e2ad..c222d55b1 100644 --- a/volatility3/framework/plugins/windows/getservicesids.py +++ b/volatility3/framework/plugins/windows/getservicesids.py @@ -69,18 +69,16 @@ class GetServiceSIDs(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0) + name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) ), ] def _generator(self): - kernel = self.context.modules[self.config["kernel"]] # Get the system hive for hive in hivelist.HiveList.list_hives( - context=self.context, - base_config_path=self.config_path, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config_path, + self.config["kernel"], filter_string="machine\\system", hive_offsets=None, ): diff --git a/volatility3/framework/plugins/windows/getsids.py b/volatility3/framework/plugins/windows/getsids.py index a75bbe7ea..53be50ba8 100644 --- a/volatility3/framework/plugins/windows/getsids.py +++ b/volatility3/framework/plugins/windows/getsids.py @@ -87,7 +87,7 @@ class GetSIDs(interfaces.plugins.PluginInterface): name="pslist", plugin=pslist.PsList, version=(2, 0, 0) ), requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0) + name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) ), ] @@ -101,14 +101,12 @@ class GetSIDs(interfaces.plugins.PluginInterface): key = "Microsoft\\Windows NT\\CurrentVersion\\ProfileList" val = "ProfileImagePath" - kernel = self.context.modules[self.config["kernel"]] sids = {} for hive in hivelist.HiveList.list_hives( - context=self.context, - base_config_path=self.config_path, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config_path, + self.config["kernel"], filter_string="config\\software", hive_offsets=None, ): diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py index 1fea3d49d..5fdfd549f 100644 --- a/volatility3/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -32,7 +32,7 @@ class Hashdump(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0) + name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) ), ] @@ -593,12 +593,10 @@ class Hashdump(interfaces.plugins.PluginInterface): offset = self.config.get("offset", None) syshive = None samhive = None - kernel = self.context.modules[self.config["kernel"]] for hive in hivelist.HiveList.list_hives( self.context, self.config_path, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], hive_offsets=None if offset is None else [offset], ): if hive.get_name().split("\\")[-1].upper() == "SYSTEM": diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index 50f4da30d..eb83352e0 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -36,7 +36,7 @@ class Lsadump(interfaces.plugins.PluginInterface): name="hashdump", component=hashdump.Hashdump, version=(1, 1, 0) ), requirements.VersionRequirement( - name="hivelist", component=hivelist.HiveList, version=(1, 0, 0) + name="hivelist", component=hivelist.HiveList, version=(2, 0, 0) ), ] @@ -209,13 +209,11 @@ class Lsadump(interfaces.plugins.PluginInterface): def run(self): offset = self.config.get("offset", None) syshive = sechive = None - kernel = self.context.modules[self.config["kernel"]] for hive in hivelist.HiveList.list_hives( self.context, self.config_path, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], hive_offsets=None if offset is None else [offset], ): if hive.get_name().split("\\")[-1].upper() == "SYSTEM": diff --git a/volatility3/framework/plugins/windows/registry/getcellroutine.py b/volatility3/framework/plugins/windows/registry/getcellroutine.py index 22374e205..724ed1c9d 100644 --- a/volatility3/framework/plugins/windows/registry/getcellroutine.py +++ b/volatility3/framework/plugins/windows/registry/getcellroutine.py @@ -28,7 +28,7 @@ class GetCellRoutine(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0) + name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) ), requirements.PluginRequirement( name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0) @@ -43,10 +43,7 @@ class GetCellRoutine(interfaces.plugins.PluginInterface): # walk each hive and validate that the GetCellRoutine handler # is inside of the kernel (ntoskrnl) for hive_object in hivelist.HiveList.list_hives( - context=self.context, - base_config_path=self.config_path, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, self.config_path, self.config["kernel"] ): hive = hive_object.hive diff --git a/volatility3/framework/plugins/windows/registry/printkey.py b/volatility3/framework/plugins/windows/registry/printkey.py index ed926805b..c14fcf507 100644 --- a/volatility3/framework/plugins/windows/registry/printkey.py +++ b/volatility3/framework/plugins/windows/registry/printkey.py @@ -31,7 +31,7 @@ class PrintKey(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0) + name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) ), requirements.IntRequirement( name="offset", description="Hive Offset", default=None, optional=True @@ -240,8 +240,6 @@ class PrintKey(interfaces.plugins.PluginInterface): def _registry_walker( self, - layer_name: str, - symbol_table: str, hive_offsets: Optional[List[int]] = None, key: Optional[str] = None, recurse: bool = False, @@ -249,8 +247,7 @@ class PrintKey(interfaces.plugins.PluginInterface): for hive in hivelist.HiveList.list_hives( self.context, self.config_path, - layer_name=layer_name, - symbol_table=symbol_table, + self.config["kernel"], hive_offsets=hive_offsets, ): try: @@ -292,7 +289,6 @@ class PrintKey(interfaces.plugins.PluginInterface): def run(self): offset = self.config.get("offset", None) - kernel = self.context.modules[self.config["kernel"]] return TreeGrid( columns=[ @@ -305,8 +301,6 @@ class PrintKey(interfaces.plugins.PluginInterface): ("Volatile", bool), ], generator=self._registry_walker( - kernel.layer_name, - kernel.symbol_table_name, hive_offsets=None if offset is None else [offset], key=self.config.get("key", None), recurse=self.config.get("recurse", None), diff --git a/volatility3/framework/plugins/windows/registry/userassist.py b/volatility3/framework/plugins/windows/registry/userassist.py index 87016553a..0e5d3c90c 100644 --- a/volatility3/framework/plugins/windows/registry/userassist.py +++ b/volatility3/framework/plugins/windows/registry/userassist.py @@ -54,7 +54,7 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac name="offset", description="Hive Offset", default=None, optional=True ), requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0) + name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) ), ] @@ -295,7 +295,6 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac hive_offsets = None if self.config.get("offset", None) is not None: hive_offsets = [self.config.get("offset", None)] - kernel = self.context.modules[self.config["kernel"]] self._reg_table_name = intermed.IntermediateSymbolTable.create( self.context, self._config_path, "windows", "registry" @@ -303,10 +302,9 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac # get all the user hive offsets or use the one specified for hive in hivelist.HiveList.list_hives( - context=self.context, - base_config_path=self.config_path, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config_path, + self.config["kernel"], filter_string="ntuser.dat", hive_offsets=hive_offsets, ): diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index a83badb90..3cbeb3e7c 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -25,7 +25,7 @@ class Certificates(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0) + name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) ), requirements.PluginRequirement( name="printkey", plugin=printkey.PrintKey, version=(1, 0, 0) @@ -69,13 +69,10 @@ class Certificates(interfaces.plugins.PluginInterface): return None def _generator(self) -> Iterator[Tuple[int, Tuple[str, str, str, str]]]: - kernel = self.context.modules[self.config["kernel"]] - for hive in hivelist.HiveList.list_hives( self.context, - base_config_path=self.config_path, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.config_path, + self.config["kernel"], ): for top_key in [ "Microsoft\\SystemCertificates",