From 4d19181848d4728f3e94bc03b200721c9399e62d Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Thu, 17 Apr 2025 16:42:17 -0500 Subject: [PATCH 1/4] #1780 - add LoadCount to dlllist output --- volatility3/framework/plugins/windows/dlllist.py | 6 ++++++ volatility3/framework/symbols/windows/__init__.py | 1 + .../symbols/windows/extensions/__init__.py | 14 ++++++++++++++ 3 files changed, 21 insertions(+) diff --git a/volatility3/framework/plugins/windows/dlllist.py b/volatility3/framework/plugins/windows/dlllist.py index b851cf7fd..1e8ecd414 100644 --- a/volatility3/framework/plugins/windows/dlllist.py +++ b/volatility3/framework/plugins/windows/dlllist.py @@ -173,6 +173,10 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): except exceptions.InvalidAddressException: size_of_image = renderers.NotAvailableValue() + LoadCount = entry.get_load_count() + if LoadCount is None: + LoadCount = renderers.NotAvailableValue() + yield ( 0, ( @@ -186,6 +190,7 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): size_of_image, BaseDllName, FullDllName, + LoadCount, DllLoadTime, file_output, ), @@ -232,6 +237,7 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ("Size", format_hints.Hex), ("Name", str), ("Path", str), + ("LoadCount", int), ("LoadTime", datetime.datetime), ("File output", str), ], diff --git a/volatility3/framework/symbols/windows/__init__.py b/volatility3/framework/symbols/windows/__init__.py index f9541579e..3296d7d2c 100755 --- a/volatility3/framework/symbols/windows/__init__.py +++ b/volatility3/framework/symbols/windows/__init__.py @@ -41,6 +41,7 @@ class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable): self.set_type_class("_POOL_TRACKER_BIG_PAGES", pool.POOL_TRACKER_BIG_PAGES) self.set_type_class("_IMAGE_DOS_HEADER", pe.IMAGE_DOS_HEADER) self.set_type_class("_KTIMER", extensions.KTIMER) + self.set_type_class("_LDR_DATA_TABLE_ENTRY", extensions.LDR_DATA_TABLE_ENTRY) # Might not necessarily defined in every version of windows self.optional_set_type_class("_IMAGE_NT_HEADERS", pe.IMAGE_NT_HEADERS) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 4fc65564e..a814fd12c 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -1710,3 +1710,17 @@ class SHARED_CACHE_MAP(objects.StructType): ) return vacb_list + +class LDR_DATA_TABLE_ENTRY(objects.StructType): + def get_load_count(self) -> Optional[int]: + try: + LoadCount = self.LoadCount + except: + try: + LoadCount = self.ObsoleteLoadCount + except: + LoadCount = None + if LoadCount == 65535: + LoadCount = -1 + + return LoadCount From 094ba8e269d5a212e13bae4e7642da86cffec0a6 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Thu, 17 Apr 2025 16:44:22 -0500 Subject: [PATCH 2/4] #1780 - black and ruff fixes --- volatility3/framework/symbols/windows/extensions/__init__.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index a814fd12c..61138a78c 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -1711,14 +1711,15 @@ class SHARED_CACHE_MAP(objects.StructType): return vacb_list + class LDR_DATA_TABLE_ENTRY(objects.StructType): def get_load_count(self) -> Optional[int]: try: LoadCount = self.LoadCount - except: + except Exception: try: LoadCount = self.ObsoleteLoadCount - except: + except Exception: LoadCount = None if LoadCount == 65535: LoadCount = -1 From 4012887e75457df98c93feb4d44ebb6ac3827fd8 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Thu, 4 Sep 2025 14:50:30 -0500 Subject: [PATCH 3/4] #1780 - cast LoadCount --- .../framework/symbols/windows/extensions/__init__.py | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 61138a78c..f32415124 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -1715,13 +1715,11 @@ class SHARED_CACHE_MAP(objects.StructType): class LDR_DATA_TABLE_ENTRY(objects.StructType): def get_load_count(self) -> Optional[int]: try: - LoadCount = self.LoadCount + LoadCount = self.LoadCount.cast("short") except Exception: try: - LoadCount = self.ObsoleteLoadCount + LoadCount = self.ObsoleteLoadCount.cast("short") except Exception: LoadCount = None - if LoadCount == 65535: - LoadCount = -1 return LoadCount From 88c8bfe1ad30b7e8cdf0cd4aff03a80e119ce5cb Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Fri, 5 Sep 2025 13:19:51 -0500 Subject: [PATCH 4/4] #1780 - bump versions --- volatility3/framework/constants/_version.py | 4 ++-- volatility3/framework/plugins/windows/dlllist.py | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index 07b9e45ec..7f71c277e 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,7 +1,7 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change -VERSION_MINOR = 26 # Number of changes that only add to the interface -VERSION_PATCH = 2 # Number of changes that do not change the interface +VERSION_MINOR = 27 # Number of changes that only add to the interface +VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" PACKAGE_VERSION = ( diff --git a/volatility3/framework/plugins/windows/dlllist.py b/volatility3/framework/plugins/windows/dlllist.py index 1e8ecd414..cb9d3b8bf 100644 --- a/volatility3/framework/plugins/windows/dlllist.py +++ b/volatility3/framework/plugins/windows/dlllist.py @@ -22,7 +22,7 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Lists the loaded DLLs in a particular windows memory image.""" _required_framework_version = (2, 0, 0) - _version = (3, 0, 0) + _version = (3, 0, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: