WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-28 18:59:44 +02:00
Code Issues Packages Projects Releases Wiki Activity

removes unnecessary enum, incorporates has_valid_member and emphasises max and min year for validation

Browse Source
This commit is contained in:
Jan
2020-08-24 19:03:28 +01:00
committed by ikelos
parent db04a29185
commit 6b8c9ff024
2 changed files with 13 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/netscan.py
+3 -6
View File
@@ -245,16 +245,13 @@ class NetScan(interfaces.plugins.PluginInterface):
self.config["nt_symbols"],
self.config_path)
tcp_states = self.context.symbol_space.get_enumeration(netscan_symbol_table + constants.BANG + "TCPStateEnum")
for netw_obj in self.scan(self.context, self.config['primary'], self.config['nt_symbols'],
netscan_symbol_table):
vollog.debug("Found netw obj @ 0x{:2x} of assumed type {}".format(netw_obj.vol.offset, type(netw_obj)))
# objects passed pool header constraints. check for additional constraints if strict flag is set.
if not show_corrupt_results:
if not netw_obj.is_valid():
continue
if not show_corrupt_results and not netw_obj.is_valid():
continue
if isinstance(netw_obj, network._UDP_ENDPOINT):
vollog.debug("Found UDP_ENDPOINT @ 0x{:2x}".format(netw_obj.vol.offset))
@@ -280,7 +277,7 @@ class NetScan(interfaces.plugins.PluginInterface):
proto = "TCPv?"
try:
state = tcp_states.lookup(netw_obj.State)
state = netw_obj.State.description
except ValueError:
state = renderers.UnreadableValue()
volatility/framework/symbols/windows/extensions/network.py
+10 -13
View File
@@ -95,6 +95,9 @@ class _TCP_LISTENER(objects.StructType):
"""
MIN_CREATETIME_YEAR = 1950
MAX_CREATETIME_YEAR = 2200
def __init__(self, context: interfaces.context.ContextInterface, type_name: str,
object_info: interfaces.objects.ObjectInformation, size: int,
members: Dict[str, Tuple[int, interfaces.objects.Template]]) -> None:
@@ -120,25 +123,19 @@ class _TCP_LISTENER(objects.StructType):
return None
def get_owner_pid(self):
try:
if self.get_owner().is_valid():
if self.get_owner().is_valid():
if self.get_owner().has_valid_member("UniqueProcessId"):
return self.get_owner().UniqueProcessId
else:
return None
except exceptions.InvalidAddressException:
return None
return None
def get_owner_procname(self):
try:
if self.get_owner().is_valid():
if self.get_owner().is_valid():
if self.get_owner().has_valid_member("ImageFileName"):
return self.get_owner().ImageFileName.cast(
"string", max_length = self.get_owner().ImageFileName.vol.count, errors = "replace")
else:
return None
except exceptions.InvalidAddressException:
return None
return None
def get_create_time(self):
dt_obj = conversion.wintime_to_datetime(self.CreateTime.QuadPart)
@@ -147,7 +144,7 @@ class _TCP_LISTENER(objects.StructType):
return dt_obj
# return None if the timestamp seems invalid
if dt_obj.year < 1950 or dt_obj.year > 2200:
if not (self.MIN_CREATETIME_YEAR < dt_obj.year < self.MAX_CREATETIME_YEAR):
return None
else:
return dt_obj