diff --git a/volatility/framework/plugins/windows/vaddump.py b/volatility/framework/plugins/windows/vaddump.py index 2ba44d055..bc4a31622 100644 --- a/volatility/framework/plugins/windows/vaddump.py +++ b/volatility/framework/plugins/windows/vaddump.py @@ -36,14 +36,33 @@ class VadDump(interfaces.plugins.PluginInterface): requirements.PluginRequirement(name = 'vadinfo', plugin = vadinfo.VadInfo, version = (1, 0, 0)), ] + @staticmethod + def vad_dump(vad, proc_layer): + """ + Returns VAD content + """ + + tmp_data = b"" + chunk_size = 1024 * 1024 * 10 + offset = vad.get_start() + out_of_range = vad.get_start() + vad.get_end() + # print("walking from {:x} to {:x} | {:x}".format(offset, out_of_range, out_of_range-offset)) + while offset < out_of_range: + to_read = min(chunk_size, out_of_range - offset) + data = proc_layer.read(offset, to_read, pad = True) + if not data: + break + tmp_data += data + offset += to_read + + return tmp_data + def _generator(self, procs): filter_func = lambda _: False if self.config.get('address', None) is not None: filter_func = lambda x: x.get_start() not in [self.config['address']] - chunk_size = 1024 * 1024 * 10 - for proc in procs: process_name = utility.array_to_string(proc.ImageFileName) @@ -63,16 +82,8 @@ class VadDump(interfaces.plugins.PluginInterface): filedata = interfaces.plugins.FileInterface("pid.{0}.vad.{1:#x}-{2:#x}.dmp".format( proc.UniqueProcessId, vad.get_start(), vad.get_end())) - offset = vad.get_start() - out_of_range = vad.get_start() + vad.get_end() - # print("walking from {:x} to {:x} | {:x}".format(offset, out_of_range, out_of_range-offset)) - while offset < out_of_range: - to_read = min(chunk_size, out_of_range - offset) - data = proc_layer.read(offset, to_read, pad = True) - if not data: - break - filedata.data.write(data) - offset += to_read + data = self.vad_dump(vad, proc_layer) + filedata.data.write(data) self.produce_file(filedata) result_text = "Stored {}".format(filedata.preferred_filename)