WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-30 11:49:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

Make sure options are specific to each plugin.

Browse Source 
So this feels like a contentious decision.  It'd be awesome to have the
options for the methods stored along-side the methods themselves.

The downside with this is that the thing accessing the configuration
data is always the plugin, so it's the plugin that must have requested
the configuration option.  This is also important in case the
description of the configuration option needs modifying for clarity or
providing context for how it will be used.

If the interface changes, all plugins calling the plugin methods will
need updating, so the config options can be updated if necessary.
This commit is contained in:
Mike Auty
2019-08-23 21:41:50 +01:00
parent 0b6c991b10
commit 6fc12e9b01
10 changed files with 43 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/cmdline.py
+4 -2
View File
@@ -36,8 +36,10 @@ class CmdLine(interfaces_plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
] + pslist.PsList.list_processes_filter_requirements
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.IntRequirement(
name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True)
]
def _generator(self, procs):
volatility/framework/plugins/windows/dlldump.py
+5 -1
View File
@@ -52,7 +52,11 @@ class DllDump(interfaces_plugins.PluginInterface):
description = "Process virtual memory address to include " \
"(all other address ranges are excluded). This must be " \
"a base address, not an address within the desired range.",
optional = True)] + pslist.PsList.list_processes_filter_requirements
optional = True),
requirements.IntRequirement(
name = 'pid', description = "Process ID to include (all other processes are excluded)",
optional = True)
]
def _generator(self, procs):
pe_table_name = intermed.IntermediateSymbolTable.create(
volatility/framework/plugins/windows/dlllist.py
+4 -2
View File
@@ -36,8 +36,10 @@ class DllList(interfaces_plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
] + pslist.PsList.list_processes_filter_requirements
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.IntRequirement(
name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True)
]
def _generator(self, procs):
volatility/framework/plugins/windows/handles.py
+4 -2
View File
@@ -55,8 +55,10 @@ class Handles(interfaces_plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
] + pslist.PsList.list_processes_filter_requirements
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.IntRequirement(
name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True)
]
def _decode_pointer(self, value, magic):
"""Windows encodes pointers to objects and decodes them on the fly
volatility/framework/plugins/windows/malfind.py
+4 -2
View File
@@ -37,8 +37,10 @@ class Malfind(interfaces.plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
] + pslist.PsList.list_processes_filter_requirements
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.IntRequirement(
name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True)
]
@classmethod
def is_vad_empty(self, proc_layer, vad):
volatility/framework/plugins/windows/procdump.py
+4 -2
View File
@@ -45,8 +45,10 @@ class ProcDump(interfaces_plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
] + pslist.PsList.list_processes_filter_requirements
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.IntRequirement(
name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True)
]
def _generator(self, procs):
volatility/framework/plugins/windows/pslist.py
+4 -7
View File
@@ -45,13 +45,10 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface):
name = 'physical',
description = 'Display physical offsets instead of virtual',
default = cls.PHYSICAL_DEFAULT,
optional = True)
] + cls.list_processes_filter_requirements
list_processes_filter_requirements = [
requirements.IntRequirement(
name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True)
]
optional = True),
requirements.IntRequirement(
name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True)
]
@classmethod
def create_pid_filter(cls, pid_list: List[int] = None) -> Callable[[interfaces.objects.ObjectInterface], bool]:
volatility/framework/plugins/windows/vaddump.py
+5 -1
View File
@@ -47,7 +47,11 @@ class VadDump(interfaces_plugins.PluginInterface):
description = "Process virtual memory address to include " \
"(all other address ranges are excluded). This must be " \
"a base address, not an address within the desired range.",
optional = True)] + pslist.PsList.list_processes_filter_requirements
optional = True),
requirements.IntRequirement(
name = 'pid', description = "Process ID to include (all other processes are excluded)",
optional = True)
]
def _generator(self, procs):
volatility/framework/plugins/windows/vadinfo.py
+5 -1
View File
@@ -66,7 +66,11 @@ class VadInfo(interfaces.plugins.PluginInterface):
description = "Process virtual memory address to include " \
"(all other address ranges are excluded). This must be " \
"a base address, not an address within the desired range.",
optional = True)] + pslist.PsList.list_processes_filter_requirements
optional = True),
requirements.IntRequirement(
name = 'pid', description = "Process ID to include (all other processes are excluded)",
optional = True)
]
@classmethod
def protect_values(cls, context: interfaces.context.ContextInterface, virtual_layer: str,
volatility/framework/plugins/windows/vadyarascan.py
+4 -2
View File
@@ -53,8 +53,10 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
name = "max_size",
default = 0x40000000,
description = "Set the maximum size (default is 1GB)",
optional = True)
] + pslist.PsList.list_processes_filter_requirements
optional = True),
requirements.IntRequirement(
name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True)
]
def _generator(self):