From 8ddfe8ce1677cb66c0b1b87a3bdeea50d5fec86e Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 9 Aug 2019 00:49:05 +0100 Subject: [PATCH] Update plugins using the old PESymbolTable method --- volatility/framework/plugins/windows/dlldump.py | 6 ++++-- volatility/framework/plugins/windows/verinfo.py | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/volatility/framework/plugins/windows/dlldump.py b/volatility/framework/plugins/windows/dlldump.py index 681d54b6a..d1ccadeb1 100644 --- a/volatility/framework/plugins/windows/dlldump.py +++ b/volatility/framework/plugins/windows/dlldump.py @@ -31,7 +31,8 @@ from volatility.framework import interfaces from volatility.framework import renderers from volatility.framework.configuration import requirements from volatility.framework.objects import utility -from volatility.framework.symbols.windows.pe import PEIntermedSymbols +from volatility.framework.symbols import intermed +from volatility.framework.symbols.windows import extensions vollog = logging.getLogger(__name__) @@ -54,7 +55,8 @@ class DllDump(interfaces_plugins.PluginInterface): optional = True)] + pslist.PsList.list_processes_filter_requirements def _generator(self, procs): - pe_table_name = PEIntermedSymbols.create(self.context, self.config_path, "windows", "pe") + pe_table_name = intermed.IntermediateSymbolTable.create( + self.context, self.config_path, "windows", "pe", class_types = extensions.pe.class_types) filter_func = lambda _: False if self.config.get('address', None) is not None: diff --git a/volatility/framework/plugins/windows/verinfo.py b/volatility/framework/plugins/windows/verinfo.py index a9921a717..c5ad9c900 100644 --- a/volatility/framework/plugins/windows/verinfo.py +++ b/volatility/framework/plugins/windows/verinfo.py @@ -28,7 +28,8 @@ import volatility.plugins.windows.modules as modules from volatility.framework import exceptions, renderers, constants, interfaces from volatility.framework.configuration import requirements from volatility.framework.renderers import format_hints -from volatility.framework.symbols.windows.pe import PEIntermedSymbols +from volatility.framework.symbols import intermed +from volatility.framework.symbols.windows import extensions from volatility.plugins.windows import pslist vollog = logging.getLogger(__name__) @@ -107,7 +108,8 @@ class VerInfo(interfaces_plugins.PluginInterface): session_layers: of layers in the session to be checked """ - pe_table_name = PEIntermedSymbols.create(self.context, self.config_path, "windows", "pe") + pe_table_name = intermed.IntermediateSymbolTable.create( + self.context, self.config_path, "windows", "pe", class_types = extensions.pe.class_types) for mod in mods: try: