diff --git a/volatility/framework/plugins/windows/dlllist.py b/volatility/framework/plugins/windows/dlllist.py index 280f2cdcd..458192c49 100644 --- a/volatility/framework/plugins/windows/dlllist.py +++ b/volatility/framework/plugins/windows/dlllist.py @@ -34,17 +34,17 @@ class DllList(interfaces.plugins.PluginInterface): description = "Process IDs to include (all other processes are excluded)", optional = True), requirements.BooleanRequirement(name = 'dump', - description = "Extract listed processes", + description = "Extract listed DLLs", default = False, optional = True) ] @classmethod - def dump_dll(cls, - context: interfaces.context.ContextInterface, - pe_table_name: str, - dll_entry: interfaces.objects.ObjectInterface, - layer_name: str = None) -> interfaces.plugins.FileInterface: + def dump_pe(cls, + context: interfaces.context.ContextInterface, + pe_table_name: str, + dll_entry: interfaces.objects.ObjectInterface, + layer_name: str = None) -> interfaces.plugins.FileInterface: """Extracts the complete data for a process as a FileInterface Args: @@ -103,7 +103,7 @@ class DllList(interfaces.plugins.PluginInterface): dumped = False if self.config['dump']: - filedata = self.dump_dll(self.context, pe_table_name, entry, proc_layer_name) + filedata = self.dump_pe(self.context, pe_table_name, entry, proc_layer_name) if filedata: filedata.preferred_filename = "pid.{0}.".format(proc_id) + filedata.preferred_filename dumped = True diff --git a/volatility/framework/plugins/windows/memmap.py b/volatility/framework/plugins/windows/memmap.py index a3de3755f..b587be9f9 100644 --- a/volatility/framework/plugins/windows/memmap.py +++ b/volatility/framework/plugins/windows/memmap.py @@ -71,8 +71,6 @@ class Memmap(interfaces.plugins.PluginInterface): dumped)) offset += mapped_size - import pdb - pdb.set_trace() self.produce_file(filedata) def run(self): diff --git a/volatility/framework/plugins/windows/modscan.py b/volatility/framework/plugins/windows/modscan.py index 37fef5113..c20527b7a 100644 --- a/volatility/framework/plugins/windows/modscan.py +++ b/volatility/framework/plugins/windows/modscan.py @@ -76,7 +76,7 @@ class ModScan(interfaces.plugins.PluginInterface): dumped = False if self.config['dump']: - filedata = dlllist.DllList.dump_dll(self.context, pe_table_name, mod) + filedata = dlllist.DllList.dump_pe(self.context, pe_table_name, mod) if filedata: self.produce_file(filedata) dumped = True diff --git a/volatility/framework/plugins/windows/modules.py b/volatility/framework/plugins/windows/modules.py index d8d49f290..1165328fc 100644 --- a/volatility/framework/plugins/windows/modules.py +++ b/volatility/framework/plugins/windows/modules.py @@ -57,7 +57,7 @@ class Modules(interfaces.plugins.PluginInterface): dumped = False if self.config['dump']: - filedata = dlllist.DllList.dump_dll(self.context, pe_table_name, mod) + filedata = dlllist.DllList.dump_pe(self.context, pe_table_name, mod) if filedata: self.produce_file(filedata) dumped = True diff --git a/volatility/framework/plugins/windows/registry/hivelist.py b/volatility/framework/plugins/windows/registry/hivelist.py index 4498e3f04..9ec5d43ce 100644 --- a/volatility/framework/plugins/windows/registry/hivelist.py +++ b/volatility/framework/plugins/windows/registry/hivelist.py @@ -53,7 +53,7 @@ class HiveList(interfaces.plugins.PluginInterface): default = None), requirements.PluginRequirement(name = 'hivescan', plugin = hivescan.HiveScan, version = (1, 0, 0)), requirements.BooleanRequirement(name = 'dump', - description = "Extract listed processes", + description = "Extract listed registry hives", default = False, optional = True) diff --git a/volatility/framework/plugins/windows/vadinfo.py b/volatility/framework/plugins/windows/vadinfo.py index bda4122dc..a98051133 100644 --- a/volatility/framework/plugins/windows/vadinfo.py +++ b/volatility/framework/plugins/windows/vadinfo.py @@ -58,7 +58,7 @@ class VadInfo(interfaces.plugins.PluginInterface): optional = True), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), requirements.BooleanRequirement(name = 'dump', - description = "Extract listed processes", + description = "Extract listed memory ranges", default = False, optional = True) ]