WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-17 20:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Code Review: Remove redundant kernel module reconstruction

Browse Source
This commit is contained in:
David McDonald
2025-03-05 17:59:49 -06:00
parent 76cceb93cb
commit 77d6bf25b0
2 changed files with 9 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/modules.py
+5 -8
View File
@@ -326,22 +326,19 @@ class Modules(interfaces.plugins.PluginInterface):
raise ValueError(
"Intel layer does not have an associated kernel virtual offset, failing"
)
ntkrnlmp = context.module(
kernel.symbol_table_name, layer_name=kernel.layer_name, offset=kvo
)
try:
# use this type if its available (starting with windows 10)
ldr_entry_type = ntkrnlmp.get_type("_KLDR_DATA_TABLE_ENTRY")
ldr_entry_type = kernel.get_type("_KLDR_DATA_TABLE_ENTRY")
except exceptions.SymbolError:
ldr_entry_type = ntkrnlmp.get_type("_LDR_DATA_TABLE_ENTRY")
ldr_entry_type = kernel.get_type("_LDR_DATA_TABLE_ENTRY")
type_name = ldr_entry_type.type_name.split(constants.BANG)[1]
list_head = ntkrnlmp.get_symbol("PsLoadedModuleList").address
list_entry = ntkrnlmp.object(object_type="_LIST_ENTRY", offset=list_head)
list_head = kernel.get_symbol("PsLoadedModuleList").address
list_entry = kernel.object(object_type="_LIST_ENTRY", offset=list_head)
reloff = ldr_entry_type.relative_child_offset("InLoadOrderLinks")
module = ntkrnlmp.object(
module = kernel.object(
object_type=type_name, offset=list_entry.vol.offset - reloff, absolute=True
)
volatility3/framework/plugins/windows/pslist.py
+4 -7
View File
@@ -232,12 +232,9 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
raise ValueError(
"Intel layer does not have an associated kernel virtual offset, failing"
)
ntkrnlmp = context.module(
kernel.symbol_table_name, layer_name=kernel.layer_name, offset=kvo
)
ps_aph_offset = ntkrnlmp.get_symbol("PsActiveProcessHead").address
list_entry = ntkrnlmp.object(object_type="_LIST_ENTRY", offset=ps_aph_offset)
ps_aph_offset = kernel.get_symbol("PsActiveProcessHead").address
list_entry = kernel.object(object_type="_LIST_ENTRY", offset=ps_aph_offset)
# This is example code to demonstrate how to use symbol_space directly, rather than through a module:
#
@@ -250,10 +247,10 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
# Note: "nt_symbols!_EPROCESS" could have been used, but would rely on the "nt_symbols" symbol table not already
# having been present. Strictly, the value of the requirement should be joined with the BANG character
# defined in the constants file
reloff = ntkrnlmp.get_type("_EPROCESS").relative_child_offset(
reloff = kernel.get_type("_EPROCESS").relative_child_offset(
"ActiveProcessLinks"
)
eproc = ntkrnlmp.object(
eproc = kernel.object(
object_type="_EPROCESS",
offset=list_entry.vol.offset - reloff,
absolute=True,