From 6a6fd29d05fb9550ea5e932ce6f2719a40c5e003 Mon Sep 17 00:00:00 2001
From: David McDonald <dgmcdona@uno.edu>
Date: Thu, 27 Feb 2025 16:24:20 -0600
Subject: [PATCH] Windows svclist: Update svcscan dependency

This updates the svclist plugin with breaking changes to its public
methods in order to update calls to the svcscan methods. Both
requirement and plugin version numbers have been updated accordingly
here.

Co-authored-by: Andrew Case <andrew@dfir.org>
---
 .../framework/plugins/windows/svclist.py      | 28 ++++++++++---------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/volatility3/framework/plugins/windows/svclist.py b/volatility3/framework/plugins/windows/svclist.py
index 8a64084c5..00782c543 100644
--- a/volatility3/framework/plugins/windows/svclist.py
+++ b/volatility3/framework/plugins/windows/svclist.py
@@ -19,7 +19,9 @@ class SvcList(svcscan.SvcScan):
     """Lists services contained with the services.exe doubly linked list of services"""
 
     _required_framework_version = (2, 0, 0)
-    _version = (1, 0, 0)
+
+    # 2.0.0 - service_list signature changed
+    _version = (2, 0, 0)
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
@@ -30,7 +32,7 @@ class SvcList(svcscan.SvcScan):
         # Since we're calling the plugin, make sure we have the plugin's requirements
         return [
             requirements.PluginRequirement(
-                name="svcscan", plugin=svcscan.SvcScan, version=(3, 0, 0)
+                name="svcscan", plugin=svcscan.SvcScan, version=(4, 0, 0)
             ),
             requirements.ModuleRequirement(
                 name="kernel",
@@ -60,16 +62,17 @@ class SvcList(svcscan.SvcScan):
     def service_list(
         cls,
         context: interfaces.context.ContextInterface,
-        layer_name: str,
-        symbol_table: str,
+        kernel_module_name: str,
         service_table_name: str,
         service_binary_dll_map,
         filter_func,
     ):
+        kernel = context.modules[kernel_module_name]
+
         if not symbols.symbol_table_is_64bit(
-            context, symbol_table
+            context, kernel.symbol_table_name
         ) or not versions.is_win10_15063_or_later(
-            context=context, symbol_table=symbol_table
+            context=context, symbol_table=kernel.symbol_table_name
         ):
             vollog.warning(
                 "This plugin only supports Windows 10 version 15063+ 64bit Windows memory samples"
@@ -77,20 +80,19 @@ class SvcList(svcscan.SvcScan):
             return
 
         for proc in pslist.PsList.list_processes(
-            context=context,
-            layer_name=layer_name,
-            symbol_table=symbol_table,
+            context,
+            kernel_module_name,
             filter_func=filter_func,
         ):
             try:
-                layer_name = proc.add_process_layer()
+                proc_layer_name = proc.add_process_layer()
             except exceptions.InvalidAddressException:
                 vollog.warning(
                     f"Unable to access memory of services.exe running with PID: {proc.UniqueProcessId}"
                 )
                 continue
 
-            layer = context.layers[layer_name]
+            proc_layer = context.layers[proc_layer_name]
 
             exe_range = cls._get_exe_range(proc)
             if not exe_range:
@@ -99,7 +101,7 @@ class SvcList(svcscan.SvcScan):
                 )
                 continue
 
-            for offset in layer.scan(
+            for offset in proc_layer.scan(
                 context=context,
                 scanner=scanners.BytesScanner(needle=b"Sc27"),
                 sections=exe_range,
@@ -108,6 +110,6 @@ class SvcList(svcscan.SvcScan):
                     context,
                     service_table_name,
                     service_binary_dll_map,
-                    layer_name,
+                    proc_layer_name,
                     offset,
                 )