WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-09 19:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add timeliner support to userassist

Browse Source
This commit is contained in:
atcuno
2024-06-27 17:13:37 -05:00
parent ac5769cf86
commit 8c1a5c46e3
1 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/registry/userassist.py
+15 -1
View File
@@ -17,11 +17,12 @@ from volatility3.framework.layers.registry import RegistryHive
from volatility3.framework.renderers import conversion, format_hints
from volatility3.framework.symbols import intermed
from volatility3.plugins.windows.registry import hivelist
from volatility3.plugins import timeliner
vollog = logging.getLogger(__name__)
class UserAssist(interfaces.plugins.PluginInterface):
class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
"""Print userassist registry keys and information."""
_required_framework_version = (2, 0, 0)
@@ -335,6 +336,19 @@ class UserAssist(interfaces.plugins.PluginInterface):
)
yield result
def generate_timeline(self):
self._reg_table_name = intermed.IntermediateSymbolTable.create(
self.context, self._config_path, "windows", "registry"
)
for row in self._generator():
_depth, row_data = row
# check the name and the timestamp to not be empty
if isinstance(row_data[5], str) and not isinstance(row_data[10], renderers.NotApplicableValue):
description = f"UserAssist: {row_data[5]} {row_data[2]} ({row_data[7]})"
yield (description, timeliner.TimeLinerType.MODIFIED, row_data[10])
def run(self):
self._reg_table_name = intermed.IntermediateSymbolTable.create(
self.context, self._config_path, "windows", "registry"