WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-17 20:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Reorder requirements by type

Browse Source
This commit is contained in:
j-t-1
2024-12-19 16:32:30 +00:00
committed by GitHub
parent 62940c311c
commit 4fe3db50df
1 changed files with 13 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/dlllist.py
+13 -10
View File
@@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__)
class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
"""Lists the loaded modules in a particular windows memory image."""
"""Lists the loaded DLLs in a particular windows memory image."""
_required_framework_version = (2, 0, 0)
_version = (3, 0, 0)
@@ -39,6 +39,9 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
requirements.VersionRequirement(
name="psscan", component=psscan.PsScan, version=(1, 1, 0)
),
requirements.VersionRequirement(
name="pedump", component=pedump.PEDump, version=(1, 0, 0)
),
requirements.VersionRequirement(
name="info", component=info.Info, version=(1, 0, 0)
),
@@ -53,16 +56,16 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
description="Process offset in the physical address space",
optional=True,
),
requirements.StringRequirement(
name="name",
description="Specify a regular expression to match dll name(s)",
optional=True,
),
requirements.IntRequirement(
name="base",
description="Specify a base virtual address in process memory",
optional=True,
),
requirements.StringRequirement(
name="name",
description="Specify a regular expression to match dll name(s)",
optional=True,
),
requirements.BooleanRequirement(
name="ignore-case",
description="Specify case insensitivity for the regular expression name matching",
@@ -75,9 +78,6 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
default=False,
optional=True,
),
requirements.VersionRequirement(
name="pedump", component=pedump.PEDump, version=(1, 0, 0)
),
]
def _generator(self, procs):
@@ -90,12 +90,15 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
kuser = info.Info.get_kuser_structure(
self.context, kernel.layer_name, kernel.symbol_table_name
)
nt_major_version = int(kuser.NtMajorVersion)
nt_minor_version = int(kuser.NtMinorVersion)
# LoadTime only applies to versions higher or equal to Window 7 (6.1 and higher)
dll_load_time_field = (nt_major_version > 6) or (
nt_major_version == 6 and nt_minor_version >= 1
)
for proc in procs:
proc_id = proc.UniqueProcessId
proc_layer_name = proc.add_process_layer()
@@ -114,7 +117,7 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
mod_re = re.compile(self.config["name"], flags)
except re.error:
vollog.debug(
"Error parsing regular expression: %s", self.config["name"]
f"Error parsing regular expression: {self.config["name"]}"
)
return None