WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-12 12:47:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Layers: Change mapping signature to return domain length

Browse Source
This commit is contained in:
Mike Auty
2020-03-04 20:29:42 +00:00
committed by ikelos
parent a2ac55ba0b
commit 77be83edc4
11 changed files with 109 additions and 92 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/pslist.py
+1 -1
View File
@@ -132,7 +132,7 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
if not self.config.get('physical', self.PHYSICAL_DEFAULT):
offset = proc.vol.offset
else:
(_, offset, _, _) = list(memory.mapping(offset = proc.vol.offset, length = 0))[0]
(_, _, offset, _, _) = list(memory.mapping(offset = proc.vol.offset, length = 0))[0]
yield (0, (proc.UniqueProcessId, proc.InheritedFromUniqueProcessId,
proc.ImageFileName.cast("string", max_length = proc.ImageFileName.vol.count, errors = 'replace'),
volatility/framework/plugins/windows/pstree.py
+1 -1
View File
@@ -42,7 +42,7 @@ class PsTree(pslist.PsList):
else:
layer_name = self.config['primary']
memory = self.context.layers[layer_name]
(_, offset, _, _) = list(memory.mapping(offset = proc.vol.offset, length = 0))[0]
(_, _, offset, _, _) = list(memory.mapping(offset = proc.vol.offset, length = 0))[0]
self._processes[proc.UniqueProcessId] = proc
volatility/framework/plugins/windows/strings.py
+2 -2
View File
@@ -84,7 +84,7 @@ class Strings(interfaces.plugins.PluginInterface):
if isinstance(layer, intel.Intel):
# We don't care about errors, we just wanted chunks that map correctly
for mapval in layer.mapping(0x0, layer.maximum_address, ignore_errors = True):
vpage, kpage, page_size, maplayer = mapval
vpage, _, kpage, page_size, maplayer = mapval
for val in range(kpage, kpage + page_size, 0x1000):
cur_set = reverse_map.get(kpage >> 12, set())
cur_set.add(("kernel", vpage))
@@ -107,7 +107,7 @@ class Strings(interfaces.plugins.PluginInterface):
proc_layer = self.context.layers[proc_layer_name]
if isinstance(proc_layer, linear.LinearlyMappedLayer):
for mapval in proc_layer.mapping(0x0, proc_layer.maximum_address, ignore_errors = True):
kpage, vpage, page_size, maplayer = mapval
kpage, _, vpage, page_size, maplayer = mapval
for val in range(kpage, kpage + page_size, 0x1000):
cur_set = reverse_map.get(kpage >> 12, set())
cur_set.add(("Process {}".format(process.UniqueProcessId), vpage))