mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-08 18:57:38 +02:00
Add FILE_OBJECT and EPROCESS extestions, kthread, token struct
add functionality to:
FILE_OBJECT:
access_string function
EPROCESS:
environment_variables function
new structs:
TOKEN:
get_sids function
privileges funciton
KTHREAD:
get_state function
get_wait_reason function
This commit is contained in:
@@ -755,12 +755,11 @@ class KTHREAD(objects.StructType):
|
||||
dictState = {0:'Initialized', 1: 'Ready', 2: 'Running', 3: 'Standby', 4: 'Terminated',
|
||||
5: 'Waiting', 6: 'Transition', 7: 'DeferredReady', 8: 'GateWait'}
|
||||
state = int(self.State)
|
||||
stringState = ''
|
||||
for flag in dictState:
|
||||
if state == flag:
|
||||
stringState += '{} '.format(dictState[flag])
|
||||
|
||||
return stringState[:-1] if len(stringState) else stringState
|
||||
if state in dictState:
|
||||
return dictState[state]
|
||||
|
||||
return renderers.NotApplicableValue()
|
||||
|
||||
def get_wait_reason(self) -> str:
|
||||
dictWaitReason = {0: 'Executive', 1: 'FreePage', 2: 'PageIn', 3: 'PoolAllocation',
|
||||
@@ -774,9 +773,8 @@ class KTHREAD(objects.StructType):
|
||||
33: 'WrYieldExecution', 34: 'WrFastMutex', 35: 'WrGuardedMutex',
|
||||
36: 'WrRundown', 37: 'MaximumWaitReason'}
|
||||
waitReason = int(self.WaitReason)
|
||||
stringWaitReason = ''
|
||||
for flag in dictWaitReason:
|
||||
if waitReason == flag:
|
||||
stringWaitReason += '{} '.format(dictWaitReason[flag])
|
||||
|
||||
return stringWaitReason[:-1] if len(stringWaitReason) else stringWaitReason
|
||||
if waitReason in dictWaitReason:
|
||||
return dictWaitReason[waitReason]
|
||||
|
||||
return renderers.NotApplicableValue()
|
||||
|
||||
Reference in New Issue
Block a user