WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 09:47:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' of github.com:volatilityfoundation/volatility3

Browse Source
This commit is contained in:
Mike Auty
2018-04-11 15:39:38 +01:00
parent 133eb916cf aa774ffca6
commit 8ac434ade9
2 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/objects/utility.py
+3 -3
View File
@@ -29,15 +29,15 @@ def pointer_to_string(pointer: objects.Pointer,
return char.cast("string", max_length = count, errors = errors)
def array_of_pointers(array: objects.Array,
def array_of_pointers(array: interfaces.objects.ObjectInterface,
count: int,
subtype: templates.ObjectTemplate = None,
subtype: typing.Optional[typing.Union[str, templates.ObjectTemplate]] = None,
context: interfaces.context.ContextInterface = None) -> interfaces.objects.ObjectInterface:
"""Takes an object, and recasts it as an array of pointers to subtype"""
if isinstance(subtype, str) and context is not None:
subtype = context.symbol_space.get_type(subtype)
if not isinstance(subtype, templates.ObjectTemplate) or subtype is None:
raise TypeError("Subtype must be a valid object template")
raise TypeError("Subtype must be a valid object template (or string name of an object template)")
subtype_pointer = objects.templates.ObjectTemplate(objects.Pointer, type_name = 'pointer', subtype = subtype)
return array.cast("array", count = count, subtype = subtype_pointer)
volatility/framework/symbols/windows/extensions/__init__.py
+8 -4
View File
@@ -182,7 +182,7 @@ class _MMVAD_SHORT(objects.Struct):
if hasattr(self, "u1") and hasattr(self.u1, "VadFlags1"):
return self.u1.VadFlags1.CommitCharge
if hasattr(self, "u") and hasattr(self.u, "VadFlags"):
elif hasattr(self, "u") and hasattr(self.u, "VadFlags"):
return self.u.VadFlags.CommitCharge
elif hasattr(self, "Core"):
@@ -193,14 +193,18 @@ class _MMVAD_SHORT(objects.Struct):
def get_private_memory(self):
"""Get the VAD's private memory setting"""
if hasattr(self, "u1") and hasattr(self.u1, "VadFlags1"):
if hasattr(self, "u1") and hasattr(self.u1, "VadFlags1") and hasattr(self.u1.VadFlags1, "PrivateMemory"):
return self.u1.VadFlags1.PrivateMemory
if hasattr(self, "u") and hasattr(self.u, "VadFlags"):
elif hasattr(self, "u") and hasattr(self.u, "VadFlags") and hasattr(self.u.VadFlags, "PrivateMemory"):
return self.u.VadFlags.PrivateMemory
elif hasattr(self, "Core"):
return self.Core.u1.VadFlags1.PrivateMemory
if hasattr(self.Core, "u1") and hasattr(self.Core.u1, "VadFlags1") and hasattr(self.Core.u1.VadFlags1, "PrivateMemory"):
return self.Core.u1.VadFlags1.PrivateMemory
elif hasattr(self.Core, "u") and hasattr(self.Core.u, "VadFlags") and hasattr(self.Core.u.VadFlags, "PrivateMemory"):
return self.Core.u.VadFlags.PrivateMemory
raise AttributeError("Unable to find the private memory member")