WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-13 05:07:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Windows svclist: Update svcscan dependency

Browse Source 
This updates the svclist plugin with breaking changes to its public
methods in order to update calls to the svcscan methods. Both
requirement and plugin version numbers have been updated accordingly
here.

Co-authored-by: Andrew Case <andrew@dfir.org>
This commit is contained in:
David McDonald
2025-03-05 17:59:38 -06:00
co-authored by Andrew Case
parent 0b72e0fdb1
commit 6a6fd29d05
1 changed files with 15 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/svclist.py
+15 -13
View File
@@ -19,7 +19,9 @@ class SvcList(svcscan.SvcScan):
"""Lists services contained with the services.exe doubly linked list of services"""
_required_framework_version = (2, 0, 0)
_version = (1, 0, 0)
# 2.0.0 - service_list signature changed
_version = (2, 0, 0)
def __init__(self, *args, **kwargs):
super().__init__(*args, **kwargs)
@@ -30,7 +32,7 @@ class SvcList(svcscan.SvcScan):
# Since we're calling the plugin, make sure we have the plugin's requirements
return [
requirements.PluginRequirement(
name="svcscan", plugin=svcscan.SvcScan, version=(3, 0, 0)
name="svcscan", plugin=svcscan.SvcScan, version=(4, 0, 0)
),
requirements.ModuleRequirement(
name="kernel",
@@ -60,16 +62,17 @@ class SvcList(svcscan.SvcScan):
def service_list(
cls,
context: interfaces.context.ContextInterface,
layer_name: str,
symbol_table: str,
kernel_module_name: str,
service_table_name: str,
service_binary_dll_map,
filter_func,
):
kernel = context.modules[kernel_module_name]
if not symbols.symbol_table_is_64bit(
context, symbol_table
context, kernel.symbol_table_name
) or not versions.is_win10_15063_or_later(
context=context, symbol_table=symbol_table
context=context, symbol_table=kernel.symbol_table_name
):
vollog.warning(
"This plugin only supports Windows 10 version 15063+ 64bit Windows memory samples"
@@ -77,20 +80,19 @@ class SvcList(svcscan.SvcScan):
return
for proc in pslist.PsList.list_processes(
context=context,
layer_name=layer_name,
symbol_table=symbol_table,
context,
kernel_module_name,
filter_func=filter_func,
):
try:
layer_name = proc.add_process_layer()
proc_layer_name = proc.add_process_layer()
except exceptions.InvalidAddressException:
vollog.warning(
f"Unable to access memory of services.exe running with PID: {proc.UniqueProcessId}"
)
continue
layer = context.layers[layer_name]
proc_layer = context.layers[proc_layer_name]
exe_range = cls._get_exe_range(proc)
if not exe_range:
@@ -99,7 +101,7 @@ class SvcList(svcscan.SvcScan):
)
continue
for offset in layer.scan(
for offset in proc_layer.scan(
context=context,
scanner=scanners.BytesScanner(needle=b"Sc27"),
sections=exe_range,
@@ -108,6 +110,6 @@ class SvcList(svcscan.SvcScan):
context,
service_table_name,
service_binary_dll_map,
layer_name,
proc_layer_name,
offset,
)