From 1ad8c950dab7005e7f603bbf1c34c962c27eb943 Mon Sep 17 00:00:00 2001 From: Paul Kermann Date: Thu, 4 May 2023 13:47:57 +0300 Subject: [PATCH 1/4] Added modules name flag --- volatility3/framework/plugins/windows/modules.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index eba6d1ce7..e25d0425e 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -42,6 +42,7 @@ class Modules(interfaces.plugins.PluginInterface): default=False, optional=True, ), + requirements.StringRequirement(name="name", description="module name/sub string", optional=True, default=""), ] def _generator(self): @@ -64,6 +65,9 @@ class Modules(interfaces.plugins.PluginInterface): except exceptions.InvalidAddressException: FullDllName = "" + if self.config['name'] and self.config['name'] not in BaseDllName: + continue + file_output = "Disabled" if self.config["dump"]: file_handle = dlllist.DllList.dump_pe( From 9249758dde5c7a1325f25b16ca49b0577d00d714 Mon Sep 17 00:00:00 2001 From: Paul Kermann Date: Thu, 4 May 2023 15:15:23 +0300 Subject: [PATCH 2/4] formatting --- volatility3/framework/plugins/windows/modules.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index e25d0425e..a1d480bb4 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -42,7 +42,12 @@ class Modules(interfaces.plugins.PluginInterface): default=False, optional=True, ), - requirements.StringRequirement(name="name", description="module name/sub string", optional=True, default=""), + requirements.StringRequirement( + name="name", + description="module name/sub string", + optional=True, + default="", + ), ] def _generator(self): @@ -66,7 +71,7 @@ class Modules(interfaces.plugins.PluginInterface): FullDllName = "" if self.config['name'] and self.config['name'] not in BaseDllName: - continue + continue file_output = "Disabled" if self.config["dump"]: From 8952c6c985c8cafd038ae4ed8db0ea4db6b04517 Mon Sep 17 00:00:00 2001 From: Paul Kermann Date: Thu, 4 May 2023 15:18:37 +0300 Subject: [PATCH 3/4] formatting --- volatility3/framework/plugins/windows/modules.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index a1d480bb4..879da4a5f 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -70,7 +70,7 @@ class Modules(interfaces.plugins.PluginInterface): except exceptions.InvalidAddressException: FullDllName = "" - if self.config['name'] and self.config['name'] not in BaseDllName: + if self.config["name"] and self.config["name"] not in BaseDllName: continue file_output = "Disabled" From c40b3a043f2c91506514c9fa7cdc7d3bcce81116 Mon Sep 17 00:00:00 2001 From: Paul Kermann Date: Mon, 8 May 2023 05:07:19 +0300 Subject: [PATCH 4/4] CR fixes --- volatility3/framework/plugins/windows/modules.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index 879da4a5f..c1be1b0a6 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -46,7 +46,7 @@ class Modules(interfaces.plugins.PluginInterface): name="name", description="module name/sub string", optional=True, - default="", + default=None, ), ]