WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 17:57:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

add handle offset to the handles plugin output

Browse Source
This commit is contained in:
Analyst
2019-02-27 10:14:52 -06:00
parent 224ea8ee2a
commit 8baafaac7b
1 changed files with 13 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/handles.py
+13 -4
View File
@@ -306,15 +306,24 @@ class Handles(interfaces_plugins.PluginInterface):
"Cannot access _OBJECT_HEADER at {0:#x}".format(entry.vol.offset))
continue
yield (0, (proc.UniqueProcessId, process_name, format_hints.Hex(entry.HandleValue), obj_type,
format_hints.Hex(entry.GrantedAccess), obj_name))
yield (0, (proc.UniqueProcessId,
process_name,
format_hints.Hex(entry.Body.vol.offset),
format_hints.Hex(entry.HandleValue),
obj_type,
format_hints.Hex(entry.GrantedAccess),
obj_name))
def run(self):
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("HandleValue", format_hints.Hex), ("Type", str),
("GrantedAccess", format_hints.Hex), ("Name", str)],
return renderers.TreeGrid([("PID", int), ("Process", str),
("Offset", format_hints.Hex),
("HandleValue", format_hints.Hex),
("Type", str),
("GrantedAccess", format_hints.Hex),
("Name", str)],
self._generator(
pslist.PsList.list_processes(
self.context,