WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-09 19:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Windows Versions: Sort version checks for readability

Browse Source
This commit is contained in:
David McDonald
2025-03-05 17:59:38 -06:00
parent 844a24f02d
commit 76e459b62e
1 changed files with 26 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/symbols/windows/versions.py
+26 -26
View File
@@ -88,24 +88,6 @@ class OsDistinguisher:
return True
is_windows_8_1_or_later = OsDistinguisher(
version_check=lambda x: x >= (6, 3),
fallback_checks=[("_KPRCB", "PendingTickFlags", True)],
)
is_vista_or_later = OsDistinguisher(
version_check=lambda x: x >= (6, 0),
fallback_checks=[("KdCopyDataBlock", None, True)],
)
is_win10 = OsDistinguisher(
version_check=lambda x: (10, 0) <= x,
fallback_checks=[
("ObHeaderCookie", None, True),
("_HANDLE_TABLE", "HandleCount", False),
],
)
is_windows_xp = OsDistinguisher(
version_check=lambda x: (5, 1) <= x < (5, 2),
fallback_checks=[
@@ -149,6 +131,32 @@ is_2003 = OsDistinguisher(
],
)
is_vista_or_later = OsDistinguisher(
version_check=lambda x: x >= (6, 0),
fallback_checks=[("KdCopyDataBlock", None, True)],
)
is_windows_8_1_or_later = OsDistinguisher(
version_check=lambda x: x >= (6, 3),
fallback_checks=[("_KPRCB", "PendingTickFlags", True)],
)
is_win10 = OsDistinguisher(
version_check=lambda x: (10, 0) <= x,
fallback_checks=[
("ObHeaderCookie", None, True),
("_HANDLE_TABLE", "HandleCount", False),
],
)
is_win10_10586_or_later = OsDistinguisher(
version_check=lambda x: x >= (10, 0, 10586),
fallback_checks=[
("_EPROCESS", "SecurityDomain", False),
("_EPROCESS", "ImageFilePointer", False),
],
)
is_win10_up_to_15063 = OsDistinguisher(
version_check=lambda x: (10, 0) <= x < (10, 0, 15063),
fallback_checks=[
@@ -195,14 +203,6 @@ is_win10_17134_or_later = OsDistinguisher(
],
)
is_win10_10586_or_later = OsDistinguisher(
version_check=lambda x: x >= (10, 0, 10586),
fallback_checks=[
("_EPROCESS", "SecurityDomain", False),
("_EPROCESS", "ImageFilePointer", False),
],
)
is_win10_17763_or_later = OsDistinguisher(
version_check=lambda x: x >= (10, 0, 17763),
fallback_checks=[