From 9c5dcda6e953d779fd8c3278debea29fd2cb12ef Mon Sep 17 00:00:00 2001 From: cecio Date: Tue, 8 Sep 2020 23:15:06 +0200 Subject: [PATCH] "pe" imported directly and little modification to comment --- volatility/framework/plugins/windows/psscan.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility/framework/plugins/windows/psscan.py b/volatility/framework/plugins/windows/psscan.py index 07b8cbd39..846079804 100644 --- a/volatility/framework/plugins/windows/psscan.py +++ b/volatility/framework/plugins/windows/psscan.py @@ -10,7 +10,7 @@ from volatility.framework import renderers, interfaces from volatility.framework.configuration import requirements from volatility.framework.renderers import format_hints from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows import extensions +from volatility.framework.symbols.windows.extensions import pe from volatility.plugins import timeliner from volatility.plugins.windows import poolscanner from volatility.plugins.windows import pslist @@ -94,7 +94,7 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo) tleoffset = ntkrnlmp.get_type("_ETHREAD").relative_child_offset("ThreadListEntry") - # Start out with the member offset given to us from the profile + # Start out with the member offset offsets = [tleoffset] # If (and only if) we're dealing with 64-bit Windows 7 SP1 @@ -130,7 +130,7 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): self.config_path, "windows", "pe", - class_types = extensions.pe.class_types) + class_types = pe.class_types) for proc in self.scan_processes(self.context, self.config['primary'], self.config['nt_symbols'],