From 583cffe960a65a136d80bab194765368220bd9bf Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Sat, 3 Aug 2024 14:24:17 -0700 Subject: [PATCH] #816 - next console properties for better readability in treegrid --- .../framework/plugins/windows/cmdscan.py | 17 ++++++- .../framework/plugins/windows/consoles.py | 44 +++++++++++++++++-- 2 files changed, 57 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/windows/cmdscan.py b/volatility3/framework/plugins/windows/cmdscan.py index 86a34a4f8..1e435c56f 100644 --- a/volatility3/framework/plugins/windows/cmdscan.py +++ b/volatility3/framework/plugins/windows/cmdscan.py @@ -175,6 +175,15 @@ class CmdScan(interfaces.plugins.PluginInterface): ) command_history_properties.append( { + "level": 0, + "name": "_COMMAND_HISTORY", + "address": command_history.vol.offset, + "data": "", + } + ) + command_history_properties.append( + { + "level": 1, "name": f"_COMMAND_HISTORY.Application", "address": command_history.Application.vol.offset, "data": command_history.get_application(), @@ -182,6 +191,7 @@ class CmdScan(interfaces.plugins.PluginInterface): ) command_history_properties.append( { + "level": 1, "name": f"_COMMAND_HISTORY.ProcessHandle", "address": command_history.ConsoleProcessHandle.ProcessHandle.vol.offset, "data": hex( @@ -191,6 +201,7 @@ class CmdScan(interfaces.plugins.PluginInterface): ) command_history_properties.append( { + "level": 1, "name": f"_COMMAND_HISTORY.CommandCount", "address": None, "data": command_history.CommandCount, @@ -198,6 +209,7 @@ class CmdScan(interfaces.plugins.PluginInterface): ) command_history_properties.append( { + "level": 1, "name": f"_COMMAND_HISTORY.LastDisplayed", "address": command_history.LastDisplayed.vol.offset, "data": command_history.LastDisplayed, @@ -205,6 +217,7 @@ class CmdScan(interfaces.plugins.PluginInterface): ) command_history_properties.append( { + "level": 1, "name": f"_COMMAND_HISTORY.CommandCountMax", "address": command_history.CommandCountMax.vol.offset, "data": command_history.CommandCountMax, @@ -213,6 +226,7 @@ class CmdScan(interfaces.plugins.PluginInterface): command_history_properties.append( { + "level": 1, "name": f"_COMMAND_HISTORY.CommandBucket", "address": command_history.CommandBucket.vol.offset, "data": "", @@ -225,6 +239,7 @@ class CmdScan(interfaces.plugins.PluginInterface): try: command_history_properties.append( { + "level": 2, "name": f"_COMMAND_HISTORY.CommandBucket_Command_{cmd_index}", "address": bucket_cmd.vol.offset, "data": bucket_cmd.get_command(), @@ -281,7 +296,7 @@ class CmdScan(interfaces.plugins.PluginInterface): if command_history and command_history_properties: for command_history_property in command_history_properties: yield ( - 0, + command_history_property["level"], ( proc.UniqueProcessId, process_name, diff --git a/volatility3/framework/plugins/windows/consoles.py b/volatility3/framework/plugins/windows/consoles.py index 0ef9e990a..3b87734e7 100644 --- a/volatility3/framework/plugins/windows/consoles.py +++ b/volatility3/framework/plugins/windows/consoles.py @@ -445,6 +445,15 @@ class Consoles(interfaces.plugins.PluginInterface): ) console_properties.append( { + "level": 0, + "name": "_CONSOLE_INFORMATION", + "address": console_info.vol.offset, + "data": "", + } + ) + console_properties.append( + { + "level": 1, "name": "_CONSOLE_INFORMATION.ScreenX", "address": console_info.ScreenX.vol.offset, "data": console_info.ScreenX, @@ -452,6 +461,7 @@ class Consoles(interfaces.plugins.PluginInterface): ) console_properties.append( { + "level": 1, "name": "_CONSOLE_INFORMATION.ScreenY", "address": console_info.ScreenY.vol.offset, "data": console_info.ScreenY, @@ -459,6 +469,7 @@ class Consoles(interfaces.plugins.PluginInterface): ) console_properties.append( { + "level": 1, "name": "_CONSOLE_INFORMATION.CommandHistorySize", "address": console_info.CommandHistorySize.vol.offset, "data": console_info.CommandHistorySize, @@ -466,6 +477,7 @@ class Consoles(interfaces.plugins.PluginInterface): ) console_properties.append( { + "level": 1, "name": "_CONSOLE_INFORMATION.HistoryBufferCount", "address": console_info.HistoryBufferCount.vol.offset, "data": console_info.HistoryBufferCount, @@ -473,6 +485,7 @@ class Consoles(interfaces.plugins.PluginInterface): ) console_properties.append( { + "level": 1, "name": "_CONSOLE_INFORMATION.HistoryBufferMax", "address": console_info.HistoryBufferMax.vol.offset, "data": console_info.HistoryBufferMax, @@ -480,6 +493,7 @@ class Consoles(interfaces.plugins.PluginInterface): ) console_properties.append( { + "level": 1, "name": "_CONSOLE_INFORMATION.Title", "address": console_info.Title.vol.offset, "data": console_info.get_title(), @@ -487,6 +501,7 @@ class Consoles(interfaces.plugins.PluginInterface): ) console_properties.append( { + "level": 1, "name": "_CONSOLE_INFORMATION.OriginalTitle", "address": console_info.OriginalTitle.vol.offset, "data": console_info.get_original_title(), @@ -498,6 +513,7 @@ class Consoles(interfaces.plugins.PluginInterface): ) console_properties.append( { + "level": 1, "name": "_CONSOLE_INFORMATION.ProcessCount", "address": console_info.ProcessCount.vol.offset, "data": console_info.ProcessCount, @@ -505,6 +521,7 @@ class Consoles(interfaces.plugins.PluginInterface): ) console_properties.append( { + "level": 1, "name": "_CONSOLE_INFORMATION.ConsoleProcessList", "address": console_info.ConsoleProcessList.vol.offset, "data": "", @@ -515,6 +532,7 @@ class Consoles(interfaces.plugins.PluginInterface): ): console_properties.append( { + "level": 2, "name": f"_CONSOLE_INFORMATION.ConsoleProcessList.ConsoleProcess_{index}", "address": attached_proc.ConsoleProcess.dereference().vol.offset, "data": "", @@ -522,6 +540,7 @@ class Consoles(interfaces.plugins.PluginInterface): ) console_properties.append( { + "level": 2, "name": f"_CONSOLE_INFORMATION.ConsoleProcessList.ConsoleProcess_{index}_ProcessId", "address": attached_proc.ConsoleProcess.ProcessId.vol.offset, "data": attached_proc.ConsoleProcess.ProcessId, @@ -529,6 +548,7 @@ class Consoles(interfaces.plugins.PluginInterface): ) console_properties.append( { + "level": 2, "name": f"_CONSOLE_INFORMATION.ConsoleProcessList.ConsoleProcess_{index}_ProcessHandle", "address": attached_proc.ConsoleProcess.ProcessHandle.vol.offset, "data": hex( @@ -542,6 +562,7 @@ class Consoles(interfaces.plugins.PluginInterface): ) console_properties.append( { + "level": 1, "name": "_CONSOLE_INFORMATION.HistoryList", "address": console_info.HistoryList.vol.offset, "data": "", @@ -553,6 +574,7 @@ class Consoles(interfaces.plugins.PluginInterface): try: console_properties.append( { + "level": 2, "name": f"_CONSOLE_INFORMATION.HistoryList.CommandHistory_{index}", "address": command_history.vol.offset, "data": "", @@ -560,6 +582,7 @@ class Consoles(interfaces.plugins.PluginInterface): ) console_properties.append( { + "level": 2, "name": f"_CONSOLE_INFORMATION.HistoryList.CommandHistory_{index}_Application", "address": command_history.Application.vol.offset, "data": command_history.get_application(), @@ -567,6 +590,7 @@ class Consoles(interfaces.plugins.PluginInterface): ) console_properties.append( { + "level": 2, "name": f"_CONSOLE_INFORMATION.HistoryList.CommandHistory_{index}_ProcessHandle", "address": command_history.ConsoleProcessHandle.ProcessHandle.vol.offset, "data": hex( @@ -576,6 +600,7 @@ class Consoles(interfaces.plugins.PluginInterface): ) console_properties.append( { + "level": 2, "name": f"_CONSOLE_INFORMATION.HistoryList.CommandHistory_{index}_CommandCount", "address": None, "data": command_history.CommandCount, @@ -583,6 +608,7 @@ class Consoles(interfaces.plugins.PluginInterface): ) console_properties.append( { + "level": 2, "name": f"_CONSOLE_INFORMATION.HistoryList.CommandHistory_{index}_LastDisplayed", "address": command_history.LastDisplayed.vol.offset, "data": command_history.LastDisplayed, @@ -593,8 +619,8 @@ class Consoles(interfaces.plugins.PluginInterface): bucket_cmd, ) in command_history.get_commands(): try: - console_properties.append( - { + console_properties.append({ + "level": 3, "name": f"_CONSOLE_INFORMATION.HistoryList.CommandHistory_{index}_Command_{cmd_index}", "address": bucket_cmd.vol.offset, "data": bucket_cmd.get_command(), @@ -610,12 +636,21 @@ class Consoles(interfaces.plugins.PluginInterface): ) vollog.debug(f"Getting ScreenBuffer entries for {console_info}") + console_properties.append( + { + "level": 1, + "name": "_CONSOLE_INFORMATION.CurrentScreenBuffer", + "address": console_info.CurrentScreenBuffer.vol.offset, + "data": "", + } + ) for screen_index, screen_info in enumerate( console_info.get_screens() ): try: console_properties.append( { + "level": 2, "name": f"_CONSOLE_INFORMATION.ScreenBuffer_{screen_index}", "address": screen_info, "data": "", @@ -623,6 +658,7 @@ class Consoles(interfaces.plugins.PluginInterface): ) console_properties.append( { + "level": 2, "name": f"_CONSOLE_INFORMATION.ScreenBuffer_{screen_index}.ScreenX", "address": None, "data": screen_info.ScreenX, @@ -630,6 +666,7 @@ class Consoles(interfaces.plugins.PluginInterface): ) console_properties.append( { + "level": 2, "name": f"_CONSOLE_INFORMATION.ScreenBuffer_{screen_index}.ScreenY", "address": None, "data": screen_info.ScreenY, @@ -637,6 +674,7 @@ class Consoles(interfaces.plugins.PluginInterface): ) console_properties.append( { + "level": 2, "name": f"_CONSOLE_INFORMATION.ScreenBuffer_{screen_index}.Dump", "address": None, "data": "\n".join(screen_info.get_buffer()), @@ -748,7 +786,7 @@ class Consoles(interfaces.plugins.PluginInterface): if console_info and console_properties: for console_property in console_properties: yield ( - 0, + console_property["level"], ( proc.UniqueProcessId, process_name,