From 6b8c9ff024a883d9a7e313afdf7a05ded27e01cb Mon Sep 17 00:00:00 2001 From: Jan Date: Fri, 24 Jul 2020 17:40:00 +0200 Subject: [PATCH] removes unnecessary enum, incorporates has_valid_member and emphasises max and min year for validation --- .../framework/plugins/windows/netscan.py | 9 +++----- .../symbols/windows/extensions/network.py | 23 ++++++++----------- 2 files changed, 13 insertions(+), 19 deletions(-) diff --git a/volatility/framework/plugins/windows/netscan.py b/volatility/framework/plugins/windows/netscan.py index 3546e233d..8900c697c 100644 --- a/volatility/framework/plugins/windows/netscan.py +++ b/volatility/framework/plugins/windows/netscan.py @@ -245,16 +245,13 @@ class NetScan(interfaces.plugins.PluginInterface): self.config["nt_symbols"], self.config_path) - tcp_states = self.context.symbol_space.get_enumeration(netscan_symbol_table + constants.BANG + "TCPStateEnum") - for netw_obj in self.scan(self.context, self.config['primary'], self.config['nt_symbols'], netscan_symbol_table): vollog.debug("Found netw obj @ 0x{:2x} of assumed type {}".format(netw_obj.vol.offset, type(netw_obj))) # objects passed pool header constraints. check for additional constraints if strict flag is set. - if not show_corrupt_results: - if not netw_obj.is_valid(): - continue + if not show_corrupt_results and not netw_obj.is_valid(): + continue if isinstance(netw_obj, network._UDP_ENDPOINT): vollog.debug("Found UDP_ENDPOINT @ 0x{:2x}".format(netw_obj.vol.offset)) @@ -280,7 +277,7 @@ class NetScan(interfaces.plugins.PluginInterface): proto = "TCPv?" try: - state = tcp_states.lookup(netw_obj.State) + state = netw_obj.State.description except ValueError: state = renderers.UnreadableValue() diff --git a/volatility/framework/symbols/windows/extensions/network.py b/volatility/framework/symbols/windows/extensions/network.py index 196cb1583..5540b2797 100644 --- a/volatility/framework/symbols/windows/extensions/network.py +++ b/volatility/framework/symbols/windows/extensions/network.py @@ -95,6 +95,9 @@ class _TCP_LISTENER(objects.StructType): """ + MIN_CREATETIME_YEAR = 1950 + MAX_CREATETIME_YEAR = 2200 + def __init__(self, context: interfaces.context.ContextInterface, type_name: str, object_info: interfaces.objects.ObjectInformation, size: int, members: Dict[str, Tuple[int, interfaces.objects.Template]]) -> None: @@ -120,25 +123,19 @@ class _TCP_LISTENER(objects.StructType): return None def get_owner_pid(self): - try: - if self.get_owner().is_valid(): + if self.get_owner().is_valid(): + if self.get_owner().has_valid_member("UniqueProcessId"): return self.get_owner().UniqueProcessId - else: - return None - except exceptions.InvalidAddressException: - return None + return None def get_owner_procname(self): - try: - if self.get_owner().is_valid(): + if self.get_owner().is_valid(): + if self.get_owner().has_valid_member("ImageFileName"): return self.get_owner().ImageFileName.cast( "string", max_length = self.get_owner().ImageFileName.vol.count, errors = "replace") - else: - return None - except exceptions.InvalidAddressException: - return None + return None def get_create_time(self): dt_obj = conversion.wintime_to_datetime(self.CreateTime.QuadPart) @@ -147,7 +144,7 @@ class _TCP_LISTENER(objects.StructType): return dt_obj # return None if the timestamp seems invalid - if dt_obj.year < 1950 or dt_obj.year > 2200: + if not (self.MIN_CREATETIME_YEAR < dt_obj.year < self.MAX_CREATETIME_YEAR): return None else: return dt_obj