WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-08 10:47:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix up the test_rig to work with a previous API change.

Browse Source
This commit is contained in:
Mike Auty
2016-02-13 17:17:45 +00:00
parent 34b8671ce3
commit a1f127940d
1 changed files with 19 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test_rig.py
+19 -11
View File
@@ -56,7 +56,7 @@ def test_symbols():
def test_memory():
ctx = utils_load_as()
base = layers.physical.FileLayer(ctx, 'physical', filename = 'trig_data.bin')
base = layers.physical.FileLayer(ctx, config_path = "memtest", name = 'physical', filename = 'trig_data.bin')
ctx.memory.add_layer(base)
val = ctx.object('ntkrnlmp!TEST_POINTER', 'physical', 0)
print(hex(val.point1.test1), val.point1.test2)
@@ -64,16 +64,19 @@ def test_memory():
def test_kdbgfind():
ctx = utils_load_as()
base = layers.physical.FileLayer(ctx, 'physical', filename = '/run/media/mike/disk/memory/xp-laptop-2005-06-25.img')
base = layers.physical.FileLayer(ctx, config_path = "memtest", name = 'physical',
filename = '/run/media/mike/disk/memory/xp-laptop-2005-06-25.img')
ctx.memory.add_layer(base)
intel = layers.intel.Intel(ctx, 'kernel', 'physical', page_map_offset = 0x39000)
ctx.memory.add_layer(intel)
def intel32(ctx):
base = layers.physical.FileLayer(ctx, 'physical', filename = '/run/media/mike/disk/memory/xp-laptop-2005-06-25.img')
base = layers.physical.FileLayer(ctx, config_path = "memtest", name = 'physical',
filename = '/run/media/mike/disk/memory/xp-laptop-2005-06-25.img')
ctx.memory.add_layer(base)
intel = layers.intel.Intel(ctx, 'kernel', 'physical', page_map_offset = 0x39000)
intel = layers.intel.Intel(ctx, config_path = "memtest", name = 'kernel', memory_layer = 'physical',
page_map_offset = 0x39000)
x = [0x823c87c0, 0x81fdf020, 0x81f5a3b8, 0x81f8eb10, 0x820e0da0, 0x82199668, 0x81fa5aa0, 0x81fa8650, 0x81faba78,
0x81fa8240, 0x81f8dda0, 0x81f6e7e8, 0x81f9a670, 0x81f5f020, 0x8202bda0, 0x82113c48, 0x81f67500, 0x81f6ca90,
0x820dd588, 0x82025608, 0x81faf280, 0x821125d0, 0x82076558, 0x81f68518, 0x82059da0, 0x81f6db28, 0x82021a78,
@@ -84,9 +87,11 @@ def intel32(ctx):
def intelpae(ctx):
base = layers.physical.FileLayer(ctx, 'physical', filename = '/run/media/mike/disk/memory/private/jon-fres.dmp')
base = layers.physical.FileLayer(ctx, config_path = "memtest", name = 'physical',
filename = '/run/media/mike/disk/memory/private/jon-fres.dmp')
ctx.memory.add_layer(base)
intel = layers.intel.IntelPAE(ctx, 'intel', 'physical', page_map_offset = 0x319000)
intel = layers.intel.IntelPAE(ctx, config_path = "memtest", name = 'intel', memory_layer = 'physical',
page_map_offset = 0x319000)
x = [0x81bcc830, 0x81989940, 0x81915020, 0x8192ad18, 0x818fa7b8, 0x818f6da0, 0x818d1020, 0x818b2878, 0x8189f180,
0x8188db58, 0x81884a40, 0x818766b0, 0x8185a948, 0x8183ad70, 0x81826020, 0x818a64c8, 0x81818020, 0x81800020,
0x817ff460, 0x817eb020, 0x817e9020, 0x817a62a8, 0x817a4b28, 0x81865020, 0x817972c0]
@@ -94,10 +99,11 @@ def intelpae(ctx):
def intel32e(ctx):
base = layers.physical.FileLayer(ctx, 'data',
base = layers.physical.FileLayer(ctx, config_path = "memtest", name = 'data',
filename = '/run/media/mike/disk/memory/private/ikelos-winxpsp2-x64.dmp')
ctx.memory.add_layer(base)
intel = layers.intel.Intel32e(ctx, 'kernel', 'data', page_map_offset = 0x3c3000)
intel = layers.intel.Intel32e(ctx, config_path = "memtest", name = 'kernel', memory_layer = 'data',
page_map_offset = 0x3c3000)
x = [0xfffffadffa517c20, 0xfffffadffa2c9510, 0xfffffadffb16a660, 0xfffffadff9d77c20, 0xfffffadffb0fe040,
0xfffffadffb0f2040, 0xfffffadffb0c2040, 0xfffffadffb0b7c20, 0xfffffadffb087c20, 0xfffffadffb06a760,
0xfffffadffb039c20, 0xfffffadffb02c040, 0xfffffadffafe9c20, 0xfffffadffafa7040, 0xfffffadffaf2e040,
@@ -112,7 +118,7 @@ def test_translation():
ctx = contexts.Context(nativelst)
intel, x = intel32(ctx)
base = layers.physical.BufferDataLayer(ctx, 'base', buffer = b" ")
base = layers.physical.BufferDataLayer(ctx, config_path = "memtest", name = 'base', buffer = b" ")
print(base.is_valid(0), base.is_valid(0) == True)
print(base.is_valid(1), base.is_valid(1) == False)
@@ -127,9 +133,11 @@ def test_translation():
def test_plugin():
ctx = utils_load_as()
base = layers.physical.FileLayer(ctx, 'physical', filename = '/run/media/mike/disk/memory/xp-laptop-2005-06-25.img')
base = layers.physical.FileLayer(ctx, config_path = "memtest", name = 'physical',
filename = '/run/media/mike/disk/memory/xp-laptop-2005-06-25.img')
ctx.memory.add_layer(base)
intel = layers.intel.Intel(ctx, 'kernel', 'physical', page_map_offset = 0x39000)
intel = layers.intel.Intel(ctx, config_path = "memtest", name = 'kernel', memory_layer = 'physical',
page_map_offset = 0x39000)
ctx.memory.add_layer(intel)
import volatility.plugins.windows.pslist as pslist