From baaedf21e51b33c9c3eee772296ebfd3b9dd9869 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Thu, 12 May 2022 19:37:30 +0900 Subject: [PATCH 01/14] Add: plugin version, logger, dump options --- .../plugins/windows/registry/certificates.py | 24 ++++++++++++------- 1 file changed, 16 insertions(+), 8 deletions(-) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index 91f17fb2d..81b7d766f 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -1,16 +1,19 @@ +import logging import struct from typing import List, Iterator, Tuple -from volatility3.framework import interfaces, renderers +from volatility3.framework import constants, interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.symbols.windows.extensions.registry import RegValueTypes from volatility3.plugins.windows.registry import hivelist, printkey +vollog = logging.getLogger(__name__) class Certificates(interfaces.plugins.PluginInterface): """Lists the certificates in the registry's Certificate Store.""" _required_framework_version = (2, 0, 0) + _version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -20,7 +23,11 @@ class Certificates(interfaces.plugins.PluginInterface): architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.PluginRequirement(name = 'hivelist', plugin = hivelist.HiveList, version = (1, 0, 0)), - requirements.PluginRequirement(name = 'printkey', plugin = printkey.PrintKey, version = (1, 0, 0)) + requirements.PluginRequirement(name = 'printkey', plugin = printkey.PrintKey, version = (1, 0, 0)), + requirements.BooleanRequirement(name = 'dump', + description = "Extract listed certificates", + default = False, + optional = True) ] def parse_data(self, data: bytes) -> Tuple[str, bytes]: @@ -48,21 +55,22 @@ class Certificates(interfaces.plugins.PluginInterface): try: # Walk it node_path = hive.get_key(top_key, return_list = True) - for (depth, is_key, last_write_time, key_path, volatility, - node) in printkey.PrintKey.key_iterator(hive, node_path, recurse = True): + for (_, is_key, _, key_path, _, node) in printkey.PrintKey.key_iterator(hive, node_path, recurse = True): if not is_key and RegValueTypes(node.Type).name == "REG_BINARY": name, certificate_data = self.parse_data(node.decode_data()) unique_key_offset = key_path.casefold().index(top_key.casefold()) + len(top_key) + 1 reg_section = key_path[unique_key_offset:key_path.index("\\", unique_key_offset)] key_hash = key_path[key_path.rindex("\\") + 1:] - if not isinstance(certificate_data, interfaces.renderers.BaseAbsentValue): - with self.open("{} - {} - {}.crt".format(hex(hive.hive_offset), reg_section, - key_hash)) as file_data: - file_data.write(certificate_data) + if self.config['dump']: + if not isinstance(certificate_data, interfaces.renderers.BaseAbsentValue): + with self.open("{} - {} - {}.crt".format(hex(hive.hive_offset), reg_section, + key_hash)) as file_data: + file_data.write(certificate_data) yield (0, (top_key, reg_section, key_hash, name)) except KeyError: # Key wasn't found in this hive, carry on + vollog.log(constants.LOGLEVEL_VVVV, "Key wasn't found in this hive") pass def run(self) -> renderers.TreeGrid: From dafd62d6cee5f8366e3071adfc80e1c910d301fa Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Thu, 12 May 2022 19:52:57 +0900 Subject: [PATCH 02/14] Fix: dump options for depreated step --- .../plugins/windows/registry/certificates.py | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index 81b7d766f..f261b5e36 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -41,6 +41,12 @@ class Certificates(interfaces.plugins.PluginInterface): elif ctype == 0x100000020: certificate_data = cvalue return (name, certificate_data) + + def dump_data(self, certificate_data: bytes, hive_offset: int, reg_section: str, key_hash: str) -> str: + if not isinstance(certificate_data, interfaces.renderers.BaseAbsentValue): + dump_name = "{} - {} - {}.crt".format(hive_offset, reg_section, key_hash) + with self.open(dump_name) as file_data: + file_data.write(certificate_data) def _generator(self) -> Iterator[Tuple[int, Tuple[str, str, str, str]]]: for hive in hivelist.HiveList.list_hives(self.context, @@ -63,10 +69,11 @@ class Certificates(interfaces.plugins.PluginInterface): key_hash = key_path[key_path.rindex("\\") + 1:] if self.config['dump']: - if not isinstance(certificate_data, interfaces.renderers.BaseAbsentValue): - with self.open("{} - {} - {}.crt".format(hex(hive.hive_offset), reg_section, - key_hash)) as file_data: - file_data.write(certificate_data) + self.dump_data(certificate_data, hive.hive_offset, reg_section, key_hash) + else: + vollog.warning("Certificates plugin is no longer support automatically dumped, please use the dump option.") + self.dump_data(certificate_data, hive.hive_offset, reg_section, key_hash) + yield (0, (top_key, reg_section, key_hash, name)) except KeyError: # Key wasn't found in this hive, carry on From f63f869506186d0396625d6232f9657ca1dad717 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Thu, 12 May 2022 20:23:42 +0900 Subject: [PATCH 03/14] Remove: return type of dump method --- volatility3/plugins/windows/registry/certificates.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index f261b5e36..ee9cba6d3 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -42,7 +42,7 @@ class Certificates(interfaces.plugins.PluginInterface): certificate_data = cvalue return (name, certificate_data) - def dump_data(self, certificate_data: bytes, hive_offset: int, reg_section: str, key_hash: str) -> str: + def dump_data(self, certificate_data: bytes, hive_offset: int, reg_section: str, key_hash: str): if not isinstance(certificate_data, interfaces.renderers.BaseAbsentValue): dump_name = "{} - {} - {}.crt".format(hive_offset, reg_section, key_hash) with self.open(dump_name) as file_data: From 0e8958b8416350ac9c22961674532e62b72050ec Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Mon, 16 May 2022 15:11:07 +0900 Subject: [PATCH 04/14] Fix: classmethod, variable name, exceptions, etc --- .../plugins/windows/registry/certificates.py | 33 +++++++++++-------- 1 file changed, 20 insertions(+), 13 deletions(-) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index ee9cba6d3..a27b3545a 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -1,8 +1,8 @@ import logging import struct -from typing import List, Iterator, Tuple +from typing import List, Iterator, Tuple, Type -from volatility3.framework import constants, interfaces, renderers +from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.symbols.windows.extensions.registry import RegValueTypes from volatility3.plugins.windows.registry import hivelist, printkey @@ -13,7 +13,6 @@ class Certificates(interfaces.plugins.PluginInterface): """Lists the certificates in the registry's Certificate Store.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -42,11 +41,20 @@ class Certificates(interfaces.plugins.PluginInterface): certificate_data = cvalue return (name, certificate_data) - def dump_data(self, certificate_data: bytes, hive_offset: int, reg_section: str, key_hash: str): - if not isinstance(certificate_data, interfaces.renderers.BaseAbsentValue): - dump_name = "{} - {} - {}.crt".format(hive_offset, reg_section, key_hash) - with self.open(dump_name) as file_data: - file_data.write(certificate_data) + @classmethod + def dump_certificate(cls, certificate_data: bytes, hive_offset: int, + reg_section: str, key_hash: str, + open_method: Type[interfaces.plugins.FileHandlerInterface]) -> \ + interfaces.plugins.FileHandlerInterface: + try: + if not isinstance(certificate_data, interfaces.renderers.BaseAbsentValue): + dump_name = "{} - {} - {}.crt".format(hive_offset, reg_section, key_hash) + with open_method(dump_name) as file_data: + file_data.write(certificate_data) + except exceptions.InvalidAddressException: + vollog.debug(f"Unable to certificate file at {hive_offset:#x}") + return None + def _generator(self) -> Iterator[Tuple[int, Tuple[str, str, str, str]]]: for hive in hivelist.HiveList.list_hives(self.context, @@ -61,7 +69,7 @@ class Certificates(interfaces.plugins.PluginInterface): try: # Walk it node_path = hive.get_key(top_key, return_list = True) - for (_, is_key, _, key_path, _, node) in printkey.PrintKey.key_iterator(hive, node_path, recurse = True): + for (_depth, is_key, _last_write_time, key_path, _volatility, node) in printkey.PrintKey.key_iterator(hive, node_path, recurse = True): if not is_key and RegValueTypes(node.Type).name == "REG_BINARY": name, certificate_data = self.parse_data(node.decode_data()) unique_key_offset = key_path.casefold().index(top_key.casefold()) + len(top_key) + 1 @@ -69,10 +77,9 @@ class Certificates(interfaces.plugins.PluginInterface): key_hash = key_path[key_path.rindex("\\") + 1:] if self.config['dump']: - self.dump_data(certificate_data, hive.hive_offset, reg_section, key_hash) - else: - vollog.warning("Certificates plugin is no longer support automatically dumped, please use the dump option.") - self.dump_data(certificate_data, hive.hive_offset, reg_section, key_hash) + file_handle = self.dump_certificate(certificate_data, hive.hive_offset, reg_section, key_hash, self.open) + if file_handle: + file_handle.close() yield (0, (top_key, reg_section, key_hash, name)) except KeyError: From 5770d35a4afd718760ddeeb1c21606e6b5bd1e2e Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Tue, 17 May 2022 00:18:06 +0900 Subject: [PATCH 05/14] Add: return file handle --- volatility3/plugins/windows/registry/certificates.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index a27b3545a..b079844e7 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -49,8 +49,9 @@ class Certificates(interfaces.plugins.PluginInterface): try: if not isinstance(certificate_data, interfaces.renderers.BaseAbsentValue): dump_name = "{} - {} - {}.crt".format(hive_offset, reg_section, key_hash) - with open_method(dump_name) as file_data: - file_data.write(certificate_data) + file_handle = open_method(dump_name) + file_handle.write(certificate_data) + return file_handle except exceptions.InvalidAddressException: vollog.debug(f"Unable to certificate file at {hive_offset:#x}") return None From 3846268bf7a8b3731a80a61959ca1aee227a112d Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Tue, 17 May 2022 00:19:39 +0900 Subject: [PATCH 06/14] Add: optional return type --- volatility3/plugins/windows/registry/certificates.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index b079844e7..d2fb61f02 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -1,6 +1,6 @@ import logging import struct -from typing import List, Iterator, Tuple, Type +from typing import List, Iterator, Optional, Tuple, Type from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements @@ -45,7 +45,7 @@ class Certificates(interfaces.plugins.PluginInterface): def dump_certificate(cls, certificate_data: bytes, hive_offset: int, reg_section: str, key_hash: str, open_method: Type[interfaces.plugins.FileHandlerInterface]) -> \ - interfaces.plugins.FileHandlerInterface: + Optional[interfaces.plugins.FileHandlerInterface]: try: if not isinstance(certificate_data, interfaces.renderers.BaseAbsentValue): dump_name = "{} - {} - {}.crt".format(hive_offset, reg_section, key_hash) From 6d7095fa3bf01aa4f2a9fceb1887cf28ed463e58 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Sat, 2 Jul 2022 19:30:00 +0900 Subject: [PATCH 07/14] Add: exceptions code --- .../plugins/windows/registry/certificates.py | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index d2fb61f02..e2fe662fc 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -17,10 +17,8 @@ class Certificates(interfaces.plugins.PluginInterface): @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ - requirements.TranslationLayerRequirement(name = 'primary', - description = 'Memory layer for the kernel', + requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.PluginRequirement(name = 'hivelist', plugin = hivelist.HiveList, version = (1, 0, 0)), requirements.PluginRequirement(name = 'printkey', plugin = printkey.PrintKey, version = (1, 0, 0)), requirements.BooleanRequirement(name = 'dump', @@ -58,10 +56,12 @@ class Certificates(interfaces.plugins.PluginInterface): def _generator(self) -> Iterator[Tuple[int, Tuple[str, str, str, str]]]: + kernel = self.context.modules[self.config['kernel']] + for hive in hivelist.HiveList.list_hives(self.context, base_config_path = self.config_path, - layer_name = self.config['primary'], - symbol_table = self.config['nt_symbols']): + layer_name = kernel.layer_name, + symbol_table = kernel.symbol_table_name): for top_key in [ "Microsoft\\SystemCertificates", @@ -87,6 +87,12 @@ class Certificates(interfaces.plugins.PluginInterface): # Key wasn't found in this hive, carry on vollog.log(constants.LOGLEVEL_VVVV, "Key wasn't found in this hive") pass + except exceptions.SwappedInvalidAddressException as exp: + vollog.log(constants.LOGLEVEL_VVVV, f"Required memory at {exp.invalid_address:#x} is inaccessible (swapped)") + pass + except exceptions.PagedInvalidAddressException as exp: + vollog.log(constants.LOGLEVEL_VVVV, f"Required memory at {exp.invalid_address:#x} is not valid (process exited?)") + pass def run(self) -> renderers.TreeGrid: return renderers.TreeGrid([("Certificate path", str), ("Certificate section", str), ("Certificate ID", str), From c40aecdfdacfde5ac17b658b581aa85595272b85 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Sat, 2 Jul 2022 19:38:12 +0900 Subject: [PATCH 08/14] Remove: invalid exceptions code --- volatility3/plugins/windows/registry/certificates.py | 3 --- 1 file changed, 3 deletions(-) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index e2fe662fc..e873fd1d6 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -90,9 +90,6 @@ class Certificates(interfaces.plugins.PluginInterface): except exceptions.SwappedInvalidAddressException as exp: vollog.log(constants.LOGLEVEL_VVVV, f"Required memory at {exp.invalid_address:#x} is inaccessible (swapped)") pass - except exceptions.PagedInvalidAddressException as exp: - vollog.log(constants.LOGLEVEL_VVVV, f"Required memory at {exp.invalid_address:#x} is not valid (process exited?)") - pass def run(self) -> renderers.TreeGrid: return renderers.TreeGrid([("Certificate path", str), ("Certificate section", str), ("Certificate ID", str), From ec78fe7d8dd015c8ebfc366a5937cebe2bf92b3e Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Mon, 4 Jul 2022 15:49:03 +0900 Subject: [PATCH 09/14] Fix: try/except/pass to contextlib.supress by #782 --- volatility3/plugins/windows/registry/certificates.py | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index e873fd1d6..429db96a6 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -1,3 +1,4 @@ +import contextlib import logging import struct from typing import List, Iterator, Optional, Tuple, Type @@ -67,7 +68,7 @@ class Certificates(interfaces.plugins.PluginInterface): "Microsoft\\SystemCertificates", "Software\\Microsoft\\SystemCertificates", ]: - try: + with contextlib.suppress(KeyError, exceptions.SwappedInvalidAddressException): # Walk it node_path = hive.get_key(top_key, return_list = True) for (_depth, is_key, _last_write_time, key_path, _volatility, node) in printkey.PrintKey.key_iterator(hive, node_path, recurse = True): @@ -83,13 +84,6 @@ class Certificates(interfaces.plugins.PluginInterface): file_handle.close() yield (0, (top_key, reg_section, key_hash, name)) - except KeyError: - # Key wasn't found in this hive, carry on - vollog.log(constants.LOGLEVEL_VVVV, "Key wasn't found in this hive") - pass - except exceptions.SwappedInvalidAddressException as exp: - vollog.log(constants.LOGLEVEL_VVVV, f"Required memory at {exp.invalid_address:#x} is inaccessible (swapped)") - pass def run(self) -> renderers.TreeGrid: return renderers.TreeGrid([("Certificate path", str), ("Certificate section", str), ("Certificate ID", str), From 837e1ef39df3f5db6422d541b163b47d8226bb83 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Sun, 7 Aug 2022 15:58:07 +0900 Subject: [PATCH 10/14] Fix: error handling for netstat plugin --- volatility3/framework/plugins/windows/netstat.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/netstat.py b/volatility3/framework/plugins/windows/netstat.py index 486957565..3051b950e 100644 --- a/volatility3/framework/plugins/windows/netstat.py +++ b/volatility3/framework/plugins/windows/netstat.py @@ -433,7 +433,8 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): self.context, interfaces.configuration.path_join(self.config_path, 'tcpip'), kernel.layer_name, "tcpip.pdb", tcpip_module.DllBase, tcpip_module.SizeOfImage) except exceptions.VolatilityException: - vollog.warning("Unable to locate symbols for the memory image's tcpip module") + vollog.error("Unable to locate symbols for the memory image's tcpip module") + raise for netw_obj in self.list_sockets(self.context, kernel.layer_name, kernel.symbol_table_name, netscan_symbol_table, tcpip_module.DllBase, tcpip_symbol_table): From a04cb4e031f0a0092aec57ff72c371485893dd66 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Sun, 7 Aug 2022 16:13:29 +0900 Subject: [PATCH 11/14] Fix: return syntax --- volatility3/framework/plugins/windows/netstat.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/netstat.py b/volatility3/framework/plugins/windows/netstat.py index 3051b950e..4d6ec5f62 100644 --- a/volatility3/framework/plugins/windows/netstat.py +++ b/volatility3/framework/plugins/windows/netstat.py @@ -434,7 +434,7 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): kernel.layer_name, "tcpip.pdb", tcpip_module.DllBase, tcpip_module.SizeOfImage) except exceptions.VolatilityException: vollog.error("Unable to locate symbols for the memory image's tcpip module") - raise + return for netw_obj in self.list_sockets(self.context, kernel.layer_name, kernel.symbol_table_name, netscan_symbol_table, tcpip_module.DllBase, tcpip_symbol_table): From 4f77be32a541563b35279dc7bfda7ee6a52ca853 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Sun, 7 Aug 2022 16:30:14 +0900 Subject: [PATCH 12/14] Remove: dump file namespace --- volatility3/plugins/windows/registry/certificates.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index 429db96a6..8ef5abcdd 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -47,7 +47,7 @@ class Certificates(interfaces.plugins.PluginInterface): Optional[interfaces.plugins.FileHandlerInterface]: try: if not isinstance(certificate_data, interfaces.renderers.BaseAbsentValue): - dump_name = "{} - {} - {}.crt".format(hive_offset, reg_section, key_hash) + dump_name = "{}-{}-{}.crt".format(hive_offset, reg_section, key_hash) file_handle = open_method(dump_name) file_handle.write(certificate_data) return file_handle From 0c8d4f75ae63a2396deceef229e1c4d2e26135f3 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Sun, 7 Aug 2022 16:57:43 +0900 Subject: [PATCH 13/14] Fix: wide exceptions --- volatility3/plugins/windows/registry/certificates.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index 8ef5abcdd..6029c0a5c 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -68,7 +68,7 @@ class Certificates(interfaces.plugins.PluginInterface): "Microsoft\\SystemCertificates", "Software\\Microsoft\\SystemCertificates", ]: - with contextlib.suppress(KeyError, exceptions.SwappedInvalidAddressException): + with contextlib.suppress(KeyError, exceptions.InvalidAddressException): # Walk it node_path = hive.get_key(top_key, return_list = True) for (_depth, is_key, _last_write_time, key_path, _volatility, node) in printkey.PrintKey.key_iterator(hive, node_path, recurse = True): From 8bbcb51bcb3c27c7871dc6629d50570dc866e6bd Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Thu, 25 Aug 2022 01:47:19 +0900 Subject: [PATCH 14/14] Remove: return syntax --- volatility3/framework/plugins/windows/netstat.py | 1 - 1 file changed, 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/netstat.py b/volatility3/framework/plugins/windows/netstat.py index 4d6ec5f62..93ac3af93 100644 --- a/volatility3/framework/plugins/windows/netstat.py +++ b/volatility3/framework/plugins/windows/netstat.py @@ -434,7 +434,6 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): kernel.layer_name, "tcpip.pdb", tcpip_module.DllBase, tcpip_module.SizeOfImage) except exceptions.VolatilityException: vollog.error("Unable to locate symbols for the memory image's tcpip module") - return for netw_obj in self.list_sockets(self.context, kernel.layer_name, kernel.symbol_table_name, netscan_symbol_table, tcpip_module.DllBase, tcpip_symbol_table):