WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-22 01:24:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

cleanups

Browse Source
This commit is contained in:
Steffi Keene
2020-08-12 20:56:15 +01:00
committed by ikelos
parent 5166bcbe95
commit 76d6764e81
2 changed files with 7 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/memdump.py
+6 -7
View File
@@ -3,12 +3,10 @@
#
from typing import List
import sys
from volatility.framework import exceptions, renderers, interfaces
from volatility.framework.configuration import requirements
from volatility.framework.renderers import format_hints
from volatility.framework.objects import utility
from volatility.plugins.windows import pslist, dlllist, ssdt, vadinfo
from volatility.plugins.windows import pslist
class Memdump(interfaces.plugins.PluginInterface):
@@ -23,7 +21,6 @@ class Memdump(interfaces.plugins.PluginInterface):
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)),
requirements.PluginRequirement(name = 'vadinfo', plugin = vadinfo.VadInfo, version = (1, 0, 0)),
requirements.IntRequirement(name = 'pid',
description = "Process ID to include (all other processes are excluded)",
optional = True)
@@ -38,6 +35,8 @@ class Memdump(interfaces.plugins.PluginInterface):
pid = "Unknown"
try:
pid = proc.UniqueProcessId
offset = format_hints.Hex(proc.vol.offset)
filename = str(pid) + "." + str(offset)
proc_layer_name = proc.add_process_layer()
proc_layer = self.context.layers[proc_layer_name]
except exceptions.InvalidAddressException as excp:
@@ -45,7 +44,7 @@ class Memdump(interfaces.plugins.PluginInterface):
continue
#Create file for writing
filedata = interfaces.plugins.FileInterface("{}.dmp".format(proc.UniqueProcessId))
filedata = interfaces.plugins.FileInterface("{}.dmp".format(filename))
for mapval in proc_layer.mapping(0x0, proc_layer.maximum_address, ignore_errors = True):
vadd, _, vpage, page_size, maplayer = mapval
@@ -57,10 +56,10 @@ class Memdump(interfaces.plugins.PluginInterface):
continue
try:
result_text = "Writing {} [ {} ] to {}.dmp".format(process_name, proc.UniqueProcessId, proc.UniqueProcessId)
result_text = "Writing {} [ {} ] to {}.dmp".format(process_name, proc.UniqueProcessId, filename)
self.produce_file(filedata)
except exceptions.InvalidAddressException:
result_text = "Unable to write {} [ {} ]to {}.dmp".format(process_name, proc.UniqueProcessId, proc.UniqueProcessId)
result_text = "Unable to write {} [ {} ]to {}.dmp".format(process_name, proc.UniqueProcessId, filename)
yield(0, (result_text,))
volatility/framework/plugins/windows/memmap.py
+1 -4
View File
@@ -3,11 +3,10 @@
#
from typing import List
from volatility.framework import exceptions, renderers, interfaces
from volatility.framework.configuration import requirements
from volatility.framework.renderers import format_hints
from volatility.plugins.windows import pslist, dlllist, ssdt, vadinfo
from volatility.plugins.windows import pslist
class Memmap(interfaces.plugins.PluginInterface):
@@ -22,7 +21,6 @@ class Memmap(interfaces.plugins.PluginInterface):
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)),
requirements.PluginRequirement(name = 'vadinfo', plugin = vadinfo.VadInfo, version = (1, 0, 0)),
requirements.IntRequirement(name = 'pid',
description = "Process ID to include (all other processes are excluded)",
optional = True)
@@ -30,7 +28,6 @@ class Memmap(interfaces.plugins.PluginInterface):
def _generator(self, procs):
for proc in procs:
reverse_map = dict()
offset = 0
pid = "Unknown"