WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 11:47:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Yapf reformat all files.

Browse Source
This commit is contained in:
Mike Auty
2019-03-04 22:11:44 +00:00
parent 6613c7db19
commit 7904be3fd2
10 changed files with 79 additions and 152 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/driverscan.py
+10 -22
View File
@@ -20,11 +20,13 @@
from typing import Iterable
import volatility.plugins.windows.poolscanner as poolscanner
import volatility.framework.interfaces.plugins as plugins
from volatility.framework import renderers, interfaces, exceptions
from volatility.framework.configuration import requirements
from volatility.framework.renderers import format_hints
import volatility.plugins.windows.poolscanner as poolscanner
class DriverScan(plugins.PluginInterface):
"""Scans for drivers present in a particular windows memory image"""
@@ -45,21 +47,15 @@ class DriverScan(plugins.PluginInterface):
Iterable[interfaces.objects.ObjectInterface]:
"""Scans for drivers using the poolscanner module and constraints"""
constraints = poolscanner.PoolScanner.builtin_constraints(symbol_table,
[b'Dri\xf6', b'Driv'])
constraints = poolscanner.PoolScanner.builtin_constraints(symbol_table, [b'Dri\xf6', b'Driv'])
for result in poolscanner.PoolScanner.generate_pool_scan(context,
layer_name,
symbol_table,
constraints):
for result in poolscanner.PoolScanner.generate_pool_scan(context, layer_name, symbol_table, constraints):
_constraint, mem_object, _header = result
yield mem_object
def _generator(self):
for driver in self.scan_drivers(self.context,
self.config['primary'],
self.config['nt_symbols']):
for driver in self.scan_drivers(self.context, self.config['primary'], self.config['nt_symbols']):
try:
driver_name = driver.get_driver_name()
@@ -76,18 +72,10 @@ class DriverScan(plugins.PluginInterface):
except exceptions.InvalidAddressException:
name = renderers.NotApplicableValue()
yield (0, (format_hints.Hex(driver.vol.offset),
format_hints.Hex(driver.DriverStart),
format_hints.Hex(driver.DriverSize),
service_key,
driver_name,
name))
yield (0, (format_hints.Hex(driver.vol.offset), format_hints.Hex(driver.DriverStart),
format_hints.Hex(driver.DriverSize), service_key, driver_name, name))
def run(self):
return renderers.TreeGrid([("Offset", format_hints.Hex),
("Start", format_hints.Hex),
("Size", format_hints.Hex),
("Service Key", str),
("Driver Name", str),
("Name", str)],
self._generator())
("Start", format_hints.Hex), ("Size", format_hints.Hex), ("Service Key", str),
("Driver Name", str), ("Name", str)], self._generator())