WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 03:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add: debug log code

Browse Source
This commit is contained in:
Donghyun Kim
2022-08-09 14:40:35 +09:00
parent e0edb87d7f
commit 7bec33b07d
1 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/joblinks.py
+16
View File
@@ -56,8 +56,24 @@ class JobLinks(interfaces.plugins.PluginInterface):
))
vollog.log(LOGLEVEL_VVVV, proc.JobLinks)
vollog.log(LOGLEVEL_VVVV, hex(proc.JobLinks.Flink))
vollog.log(LOGLEVEL_VVVV, hex(proc.JobLinks.Blink))
vollog.log(LOGLEVEL_VVVV, job.JobLinks)
vollog.log(LOGLEVEL_VVVV, hex(job.JobLinks.Flink))
vollog.log(LOGLEVEL_VVVV, hex(job.JobLinks.Blink))
vollog.log(LOGLEVEL_VVVV, job.ProcessListHead)
vollog.log(LOGLEVEL_VVVV, hex(job.ProcessListHead.Flink))
vollog.log(LOGLEVEL_VVVV, hex(job.ProcessListHead.Blink))
vollog.log(LOGLEVEL_VVVV, "")
for entry in job.ProcessListHead.to_list(proc.vol.type_name, "JobLinks"):
yield (1, (
format_hints.Hex(offset), utility.array_to_string(entry.ImageFileName), entry.UniqueProcessId,
entry.InheritedFromUniqueProcessId, entry.get_session_id(), renderers.NotApplicableValue(), entry.get_is_wow64(),
renderers.NotApplicableValue(), renderers.NotApplicableValue(), renderers.NotApplicableValue(),
renderers.NotApplicableValue(),
"(Original Process)"
))
except (exceptions.InvalidAddressException):
continue