From 850b377dcf8b087d5296774b0803965271cda9b7 Mon Sep 17 00:00:00 2001
From: hsarkey <hsarkey@volexity.com>
Date: Fri, 9 Feb 2024 15:21:41 -0500
Subject: [PATCH 1/2] Updated windows.dlllist plugin to have --name and --base
 flags for filtering on dll name and base address.

---
 .../framework/plugins/windows/dlllist.py      | 47 ++++++++++++++++++-
 1 file changed, 45 insertions(+), 2 deletions(-)

diff --git a/volatility3/framework/plugins/windows/dlllist.py b/volatility3/framework/plugins/windows/dlllist.py
index f876dc1a2..4f50bdda5 100644
--- a/volatility3/framework/plugins/windows/dlllist.py
+++ b/volatility3/framework/plugins/windows/dlllist.py
@@ -5,6 +5,7 @@ import contextlib
 import datetime
 import logging
 import ntpath
+import re
 from typing import List, Optional, Type
 
 from volatility3.framework import constants, exceptions, interfaces, renderers
@@ -22,7 +23,7 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
     """Lists the loaded modules in a particular windows memory image."""
 
     _required_framework_version = (2, 0, 0)
-    _version = (2, 0, 0)
+    _version = (2, 0, 1)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
@@ -53,6 +54,22 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
                 description="Process offset in the physical address space",
                 optional=True,
             ),
+            requirements.StringRequirement(
+                name="name",
+                description="Specify a regular expression to match dll name(s)",
+                optional=True,
+            ),
+            requirements.IntRequirement(
+                name="base",
+                description="Specify a base address",
+                optional=True,
+            ),
+            requirements.BooleanRequirement(
+                name="ignore-case",
+                description="Specify case insensitivity for the regular expression name matching",
+                default=False,
+                optional=True,
+            ),
             requirements.BooleanRequirement(
                 name="dump",
                 description="Extract listed DLLs",
@@ -144,9 +161,35 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
                 BaseDllName = FullDllName = renderers.UnreadableValue()
                 with contextlib.suppress(exceptions.InvalidAddressException):
                     BaseDllName = entry.BaseDllName.get_string()
-                    # We assume that if the BaseDllName points to an invalid buffer, so will FullDllName
+                    # We assume that if BaseDllName points to invalid buffer, so will FullDllName
                     FullDllName = entry.FullDllName.get_string()
 
+                # Check if a name regex was passed and apply it to only show matches
+                if self.config["name"]:
+                    try:
+                        flags = re.I if self.config["ignore-case"] else 0
+                        mod_re = re.compile(self.config["name"], flags)
+                    except re.error:
+                        vollog.debug(
+                            "Error parsing regular expression: %s", self.config["name"]
+                        )
+                        return None
+
+                    # If Base or Full Dll Name are invalid, move on
+                    if isinstance(BaseDllName, renderers.UnreadableValue) or isinstance(
+                        FullDllName, renderers.UnreadableValue
+                    ):
+                        continue
+
+                    # If regex does not match, move on
+                    if not mod_re.search(BaseDllName) and not mod_re.search(
+                        FullDllName
+                    ):
+                        continue
+
+                if self.config["base"] and self.config["base"] != entry.DllBase:
+                    continue
+
                 if dll_load_time_field:
                     # Versions prior to 6.1 won't have the LoadTime attribute
                     # and 32bit version shouldn't have the Quadpart according to MSDN

From 43fa84d2d1220d01826dd86c30138e3649d8806c Mon Sep 17 00:00:00 2001
From: Hannah Sarkey <hsarkey@volexity.com>
Date: Thu, 4 Jul 2024 21:33:55 -0400
Subject: [PATCH 2/2] Update dlllist.py to have more detailed --base
 description

---
 volatility3/framework/plugins/windows/dlllist.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/volatility3/framework/plugins/windows/dlllist.py b/volatility3/framework/plugins/windows/dlllist.py
index 4f50bdda5..d48a53663 100644
--- a/volatility3/framework/plugins/windows/dlllist.py
+++ b/volatility3/framework/plugins/windows/dlllist.py
@@ -61,7 +61,7 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
             ),
             requirements.IntRequirement(
                 name="base",
-                description="Specify a base address",
+                description="Specify a base virtual address in process memory",
                 optional=True,
             ),
             requirements.BooleanRequirement(