From 3ec0e4c43f667db069b8205bb12207a5f0298ccf Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 15:33:32 -0600 Subject: [PATCH] Windows PEDump: Update PsList dep and change method signature This updates PEDump to use the latest version of PsList, updates the dependency version number, changes one of it's own method signatures to facilitate the pslist change, and does a major bump of its own version number. Co-authored-by: Andrew Case --- .../framework/plugins/windows/pedump.py | 35 ++++++++++++++----- 1 file changed, 26 insertions(+), 9 deletions(-) diff --git a/volatility3/framework/plugins/windows/pedump.py b/volatility3/framework/plugins/windows/pedump.py index 5107cb48b..5f2a1d737 100644 --- a/volatility3/framework/plugins/windows/pedump.py +++ b/volatility3/framework/plugins/windows/pedump.py @@ -3,7 +3,7 @@ # import logging import ntpath -from typing import List, Type, Optional +from typing import List, Type, Optional, Iterator, Tuple from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements @@ -18,7 +18,9 @@ class PEDump(interfaces.plugins.PluginInterface): """Allows extracting PE Files from a specific address in a specific address space""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + + # 2.0.0 - changed the signature of `dump_kernel_pe_at_base` + _version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -30,7 +32,10 @@ class PEDump(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) + ), + requirements.VersionRequirement( + name="modules", component=modules.Modules, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", @@ -145,10 +150,18 @@ class PEDump(interfaces.plugins.PluginInterface): ) @classmethod - def dump_kernel_pe_at_base(cls, context, kernel, pe_table_name, open_method, base): - session_layers = modules.Modules.get_session_layers( - context, kernel.layer_name, kernel.symbol_table_name - ) + def dump_kernel_pe_at_base( + cls, + context: interfaces.context.ContextInterface, + kernel_module_name: str, + pe_table_name: str, + open_method: Type[interfaces.plugins.FileHandlerInterface], + base: int, + ) -> Iterator[Tuple[int, str, str]]: + """ + Extracts a PE file from kernel memory at the given base address + """ + session_layers = modules.Modules.get_session_layers(context, kernel_module_name) session_layer_name = modules.Modules.find_session_layer( context, session_layers, base @@ -183,7 +196,7 @@ class PEDump(interfaces.plugins.PluginInterface): for proc in pslist.PsList.list_processes( context=context, layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + symbol_table_name=kernel.symbol_table_name, filter_func=filter_func, ): pid = proc.UniqueProcessId @@ -224,7 +237,11 @@ class PEDump(interfaces.plugins.PluginInterface): if self.config["kernel_module"]: pe_files = self.dump_kernel_pe_at_base( - self.context, kernel, pe_table_name, self.open, self.config["base"] + self.context, + self.config["kernel"], + pe_table_name, + self.open, + self.config["base"], ) else: filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None))