WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 17:57:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

psscan: Remove usage of PHYSICAL_DEFAULT variable

Browse Source
This commit is contained in:
Stefano
2021-10-25 17:56:33 +02:00
parent 2d3d133c0e
commit 6979a6d2ee
1 changed files with 7 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/psscan.py
+7 -11
View File
@@ -24,7 +24,6 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
_required_framework_version = (2, 0, 0)
_version = (1, 1, 0)
PHYSICAL_DEFAULT = False
@classmethod
def get_requirements(cls):
@@ -43,7 +42,7 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
optional = True),
requirements.BooleanRequirement(name = 'physical',
description = "Display physical offset instead of virtual",
default = cls.PHYSICAL_DEFAULT,
default = False,
optional = True)
]
@@ -153,8 +152,7 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
"windows",
"pe",
class_types = pe.class_types)
memory = self.context.layers[kernel.layer_name]
memory = self.context.layers[kernel.layer_name]
if not isinstance(memory, layers.intel.Intel):
raise TypeError("Primary layer is not an intel layer")
@@ -179,23 +177,20 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
if file_handle:
file_output = file_handle.preferred_filename
if not self.config.get('physical', self.PHYSICAL_DEFAULT):
if not self.config['physical']:
offset = proc.vol.offset
else:
(_, _, offset, _, _) = list(memory.mapping(offset = proc.vol.offset, length = 0))[0]
try:
yield (0, (proc.UniqueProcessId, proc.InheritedFromUniqueProcessId,
proc.ImageFileName.cast("string", max_length = proc.ImageFileName.vol.count,
errors = 'replace'), format_hints.Hex(offset),
proc.ActiveThreads, proc.get_handle_count(), proc.get_session_id(), proc.get_is_wow64(),
proc.get_create_time(), proc.get_exit_time(), file_output))
except exceptions.InvalidAddressException:
vollog.info(f"Invalid process found at address: {proc.vol.offset:x}. Skipping")
def generate_timeline(self):
for row in self._generator():
_depth, row_data = row
@@ -204,8 +199,9 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
yield (description, timeliner.TimeLinerType.MODIFIED, row_data[9])
def run(self):
return renderers.TreeGrid([("PID", int), ("PPID", int), ("ImageFileName", str), ("Offset" +
"(V)" if (not self.config["physical"]) else "(P)", format_hints.Hex),
("Threads", int), ("Handles", int), ("SessionId", int), ("Wow64", bool),
offsettype = "(V)" if not self.config['physical'] else "(P)"
return renderers.TreeGrid([("PID", int), ("PPID", int), ("ImageFileName", str),
(f"Offset{offsettype}", format_hints.Hex), ("Threads", int),
("Handles", int), ("SessionId", int), ("Wow64", bool),
("CreateTime", datetime.datetime), ("ExitTime", datetime.datetime),
("File output", str)], self._generator())