WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-13 13:17:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1779 from j-t-1/svcdiff

Browse Source 
Amend SvcDiff comments at top of file
This commit is contained in:
ikelos
2025-04-17 21:10:31 +01:00
committed by GitHub
parent fa73298e0f ff5d736f94
commit 63f7cbd447
1 changed files with 5 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/svcdiff.py
+5 -7
View File
@@ -1,15 +1,13 @@
# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
# This module attempts to locate skeleton-key like function hooks.
# It does this by locating the CSystems array through a variety of methods,
# and then validating the entry for RC4 HMAC (0x17 / 23)
# This module compares services found through list walking versus scanning,
# with the aim of finding hidden services.
#
# For a thorough walkthrough on how the R&D was performed to develop this plugin,
# please see our blogpost here:
# For background of hidden services and a real-world example of the use of this plugin,
# please see our blogpost:
#
# https://volatility-labs.blogspot.com/2021/10/memory-forensics-r-illustrated.html
# https://volatilityfoundation.org/memory-forensics-rd-illustrated-detecting-hidden-windows-services/
import logging