WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-24 07:02:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

simplify vad dump to be used by other plugins

Browse Source
This commit is contained in:
doomedraven
2019-11-13 18:54:19 +00:00
committed by ikelos
parent 648cded5e1
commit 97f670ec79
1 changed files with 23 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/vaddump.py
+23 -12
View File
@@ -36,14 +36,33 @@ class VadDump(interfaces.plugins.PluginInterface):
requirements.PluginRequirement(name = 'vadinfo', plugin = vadinfo.VadInfo, version = (1, 0, 0)),
]
@staticmethod
def vad_dump(vad, proc_layer):
"""
Returns VAD content
"""
tmp_data = b""
chunk_size = 1024 * 1024 * 10
offset = vad.get_start()
out_of_range = vad.get_start() + vad.get_end()
# print("walking from {:x} to {:x} | {:x}".format(offset, out_of_range, out_of_range-offset))
while offset < out_of_range:
to_read = min(chunk_size, out_of_range - offset)
data = proc_layer.read(offset, to_read, pad = True)
if not data:
break
tmp_data += data
offset += to_read
return tmp_data
def _generator(self, procs):
filter_func = lambda _: False
if self.config.get('address', None) is not None:
filter_func = lambda x: x.get_start() not in [self.config['address']]
chunk_size = 1024 * 1024 * 10
for proc in procs:
process_name = utility.array_to_string(proc.ImageFileName)
@@ -63,16 +82,8 @@ class VadDump(interfaces.plugins.PluginInterface):
filedata = interfaces.plugins.FileInterface("pid.{0}.vad.{1:#x}-{2:#x}.dmp".format(
proc.UniqueProcessId, vad.get_start(), vad.get_end()))
offset = vad.get_start()
out_of_range = vad.get_start() + vad.get_end()
# print("walking from {:x} to {:x} | {:x}".format(offset, out_of_range, out_of_range-offset))
while offset < out_of_range:
to_read = min(chunk_size, out_of_range - offset)
data = proc_layer.read(offset, to_read, pad = True)
if not data:
break
filedata.data.write(data)
offset += to_read
data = self.vad_dump(vad, proc_layer)
filedata.data.write(data)
self.produce_file(filedata)
result_text = "Stored {}".format(filedata.preferred_filename)