WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-11 04:07:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

removed additional object creation for determining OS version

Browse Source
This commit is contained in:
superponible
2018-08-29 21:51:52 +01:00
committed by ikelos
parent 140ed54331
commit 4d0bdb7d72
1 changed files with 4 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/plugins/windows/userassist.py
+4 -10
View File
@@ -203,18 +203,12 @@ class UserAssist(interfaces_plugins.PluginInterface):
return item
def _win7_or_later(self):
# TODO: change this when there is a better way of determining the OS version
virtual_layer_name = self.config["primary"]
virtual_layer = self.context.memory[virtual_layer_name]
kvo = virtual_layer.config["kernel_virtual_offset"]
ntkrnlmp = self.context.module(self.config["nt_symbols"],
layer_name=virtual_layer_name, offset=kvo)
# TODO: change this if there is a better way of determining the OS version
# _KUSER_SHARED_DATA.CookiePad is in Windows 6.1 (Win7) and later
try:
_ = ntkrnlmp.get_type("_KUSER_SHARED_DATA").relative_child_offset("CookiePad")
# FIXME: ditch the try/except clause once there's a template method for determining whether a member exists
self.context.symbol_space.get_type(
self.config['nt_symbols'] + constants.BANG + "_KUSER_SHARED_DATA").relative_child_offset('CookiePad')
return True
except IndexError:
return False