From 6be5716195e6a1906d1766e76a8077400368dfee Mon Sep 17 00:00:00 2001 From: memoryforensics1 <61626429+memoryforensics1@users.noreply.github.com> Date: Tue, 1 Sep 2020 17:39:08 +0300 Subject: [PATCH] Add FILE_OBJECT and EPROCESS extestions, kthread, token struct add functionality to: FILE_OBJECT: access_string function EPROCESS: environment_variables function new structs: TOKEN: get_sids function privileges funciton KTHREAD: get_state function get_wait_reason function --- .../symbols/windows/extensions/__init__.py | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 0de860100..73ecb4584 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -755,12 +755,11 @@ class KTHREAD(objects.StructType): dictState = {0:'Initialized', 1: 'Ready', 2: 'Running', 3: 'Standby', 4: 'Terminated', 5: 'Waiting', 6: 'Transition', 7: 'DeferredReady', 8: 'GateWait'} state = int(self.State) - stringState = '' - for flag in dictState: - if state == flag: - stringState += '{} '.format(dictState[flag]) - return stringState[:-1] if len(stringState) else stringState + if state in dictState: + return dictState[state] + + return renderers.NotApplicableValue() def get_wait_reason(self) -> str: dictWaitReason = {0: 'Executive', 1: 'FreePage', 2: 'PageIn', 3: 'PoolAllocation', @@ -774,9 +773,8 @@ class KTHREAD(objects.StructType): 33: 'WrYieldExecution', 34: 'WrFastMutex', 35: 'WrGuardedMutex', 36: 'WrRundown', 37: 'MaximumWaitReason'} waitReason = int(self.WaitReason) - stringWaitReason = '' - for flag in dictWaitReason: - if waitReason == flag: - stringWaitReason += '{} '.format(dictWaitReason[flag]) - return stringWaitReason[:-1] if len(stringWaitReason) else stringWaitReason + if waitReason in dictWaitReason: + return dictWaitReason[waitReason] + + return renderers.NotApplicableValue()