From 4d0bdb7d722635b86fc8050e2ab06a3297e538d0 Mon Sep 17 00:00:00 2001 From: superponible Date: Wed, 29 Aug 2018 13:44:14 -0500 Subject: [PATCH] removed additional object creation for determining OS version --- volatility/plugins/windows/userassist.py | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/volatility/plugins/windows/userassist.py b/volatility/plugins/windows/userassist.py index 3d92af2b8..2d5d3ccfa 100644 --- a/volatility/plugins/windows/userassist.py +++ b/volatility/plugins/windows/userassist.py @@ -203,18 +203,12 @@ class UserAssist(interfaces_plugins.PluginInterface): return item def _win7_or_later(self): - # TODO: change this when there is a better way of determining the OS version - virtual_layer_name = self.config["primary"] - virtual_layer = self.context.memory[virtual_layer_name] - - kvo = virtual_layer.config["kernel_virtual_offset"] - - ntkrnlmp = self.context.module(self.config["nt_symbols"], - layer_name=virtual_layer_name, offset=kvo) - + # TODO: change this if there is a better way of determining the OS version # _KUSER_SHARED_DATA.CookiePad is in Windows 6.1 (Win7) and later try: - _ = ntkrnlmp.get_type("_KUSER_SHARED_DATA").relative_child_offset("CookiePad") + # FIXME: ditch the try/except clause once there's a template method for determining whether a member exists + self.context.symbol_space.get_type( + self.config['nt_symbols'] + constants.BANG + "_KUSER_SHARED_DATA").relative_child_offset('CookiePad') return True except IndexError: return False