WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-12 20:57:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Prevent duplicate processing of the same file object

Browse Source
This commit is contained in:
atcuno
2024-05-08 11:23:01 -05:00
parent 1c5c57e155
commit 3f3f1a9c0d
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/dumpfiles.py
+10
View File
@@ -244,6 +244,8 @@ class DumpFiles(interfaces.plugins.PluginInterface):
symbol_table=kernel.symbol_table_name,
)
dumped_files = set()
for proc in procs:
try:
object_table = proc.ObjectTable
@@ -267,6 +269,10 @@ class DumpFiles(interfaces.plugins.PluginInterface):
if not file_re.search(name):
continue
if file_obj.vol.offset in dumped_files:
continue
dumped_files.add(file_obj.vol.offset)
for result in self.process_file_object(
self.context, kernel.layer_name, self.open, file_obj
):
@@ -303,6 +309,10 @@ class DumpFiles(interfaces.plugins.PluginInterface):
if not file_re.search(name):
continue
if file_obj.vol.offset in dumped_files:
continue
dumped_files.add(file_obj.vol.offset)
for result in self.process_file_object(
self.context, kernel.layer_name, self.open, file_obj
):