diff --git a/volatility3/framework/plugins/windows/svclist.py b/volatility3/framework/plugins/windows/svclist.py index 8a64084c5..00782c543 100644 --- a/volatility3/framework/plugins/windows/svclist.py +++ b/volatility3/framework/plugins/windows/svclist.py @@ -19,7 +19,9 @@ class SvcList(svcscan.SvcScan): """Lists services contained with the services.exe doubly linked list of services""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + + # 2.0.0 - service_list signature changed + _version = (2, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -30,7 +32,7 @@ class SvcList(svcscan.SvcScan): # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.PluginRequirement( - name="svcscan", plugin=svcscan.SvcScan, version=(3, 0, 0) + name="svcscan", plugin=svcscan.SvcScan, version=(4, 0, 0) ), requirements.ModuleRequirement( name="kernel", @@ -60,16 +62,17 @@ class SvcList(svcscan.SvcScan): def service_list( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, service_table_name: str, service_binary_dll_map, filter_func, ): + kernel = context.modules[kernel_module_name] + if not symbols.symbol_table_is_64bit( - context, symbol_table + context, kernel.symbol_table_name ) or not versions.is_win10_15063_or_later( - context=context, symbol_table=symbol_table + context=context, symbol_table=kernel.symbol_table_name ): vollog.warning( "This plugin only supports Windows 10 version 15063+ 64bit Windows memory samples" @@ -77,20 +80,19 @@ class SvcList(svcscan.SvcScan): return for proc in pslist.PsList.list_processes( - context=context, - layer_name=layer_name, - symbol_table=symbol_table, + context, + kernel_module_name, filter_func=filter_func, ): try: - layer_name = proc.add_process_layer() + proc_layer_name = proc.add_process_layer() except exceptions.InvalidAddressException: vollog.warning( f"Unable to access memory of services.exe running with PID: {proc.UniqueProcessId}" ) continue - layer = context.layers[layer_name] + proc_layer = context.layers[proc_layer_name] exe_range = cls._get_exe_range(proc) if not exe_range: @@ -99,7 +101,7 @@ class SvcList(svcscan.SvcScan): ) continue - for offset in layer.scan( + for offset in proc_layer.scan( context=context, scanner=scanners.BytesScanner(needle=b"Sc27"), sections=exe_range, @@ -108,6 +110,6 @@ class SvcList(svcscan.SvcScan): context, service_table_name, service_binary_dll_map, - layer_name, + proc_layer_name, offset, )