WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-05 17:27:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Core: Slight speed-up for all single struct.unpack calls

Browse Source
This commit is contained in:
Mike Auty
2022-02-09 20:07:13 +00:00
parent 3e742bf1f7
commit 497eaea512
3 changed files with 10 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/symbols/windows/extensions/pool.py
+2 -2
View File
@@ -128,8 +128,8 @@ class POOL_HEADER(objects.StructType):
# ---------------
if addr - optional_headers_length < 0:
continue
padding_length = struct.unpack(
"<I", infomask_data[addr - optional_headers_length:addr - optional_headers_length + 4])[0]
padding_length, = struct.unpack(
"<I", infomask_data[addr - optional_headers_length:addr - optional_headers_length + 4])
padding_length -= lengths_of_optional_headers[padding_available or 0]
# Certain versions of windows have PADDING_INFO lengths that are too long
volatility3/framework/symbols/windows/extensions/registry.py
+6 -3
View File
@@ -264,15 +264,18 @@ class CM_KEY_VALUE(objects.StructType):
if self_type == RegValueTypes.REG_DWORD:
if len(data) != struct.calcsize("<L"):
raise ValueError(f"Size of data does not match the type of registry value {self.get_name()}")
return struct.unpack("<L", data)[0]
res, = struct.unpack("<L", data)
return res
if self_type == RegValueTypes.REG_DWORD_BIG_ENDIAN:
if len(data) != struct.calcsize(">L"):
raise ValueError(f"Size of data does not match the type of registry value {self.get_name()}")
return struct.unpack(">L", data)[0]
res, = struct.unpack(">L", data)
return res
if self_type == RegValueTypes.REG_QWORD:
if len(data) != struct.calcsize("<Q"):
raise ValueError(f"Size of data does not match the type of registry value {self.get_name()}")
return struct.unpack("<Q", data)[0]
res, = struct.unpack("<Q", data)
return res
if self_type in [
RegValueTypes.REG_SZ, RegValueTypes.REG_EXPAND_SZ, RegValueTypes.REG_LINK, RegValueTypes.REG_MULTI_SZ,
RegValueTypes.REG_BINARY, RegValueTypes.REG_FULL_RESOURCE_DESCRIPTOR, RegValueTypes.REG_RESOURCE_LIST,
volatility3/framework/symbols/windows/pdbutil.py
+2 -2
View File
@@ -132,14 +132,14 @@ class PDBUtility(interfaces.configuration.VersionableInterface):
if mz_sig != b"MZ":
return None
nt_header_start = struct.unpack("<I", layer.read(offset + 0x3C, 4))[0]
nt_header_start, = struct.unpack("<I", layer.read(offset + 0x3C, 4))
pe_sig = layer.read(offset + nt_header_start, 2)
# Check it is actually the Nt Headers
if pe_sig != b"PE":
return None
optional_header_size = struct.unpack('<H', layer.read(offset + nt_header_start + 0x14, 2))[0]
optional_header_size, = struct.unpack('<H', layer.read(offset + nt_header_start + 0x14, 2))
# Just enough to tell us the max size
pe_header = layer.read(offset, nt_header_start + 0x16 + optional_header_size)
pe_data = pefile.PE(data = pe_header)