WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 09:47:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

add Win10x64 17763

Browse Source
This commit is contained in:
Dave Lassalle
2024-08-03 12:03:20 -07:00
parent fdb131f870
commit a515e571dc
3 changed files with 608 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/consoles.py
+8
View File
@@ -203,6 +203,7 @@ class Consoles(interfaces.plugins.PluginInterface):
version_dict = {}
else:
version_dict = {
(10, 0, 17763, 0): "consoles-win10-17763-x64",
(10, 0, 20348, 1): "consoles-win10-20348-x64",
(10, 0, 20348, 1970): "consoles-win10-20348-1970-x64",
(10, 0, 20348, 2461): "consoles-win10-20348-2461-x64",
@@ -580,6 +581,13 @@ class Consoles(interfaces.plugins.PluginInterface):
"data": command_history.CommandCount,
}
)
console_properties.append(
{
"name": f"_CONSOLE_INFORMATION.HistoryList.CommandHistory_{index}_LastDisplayed",
"address": command_history.LastDisplayed.vol.offset,
"data": command_history.LastDisplayed,
}
)
for (
cmd_index,
bucket_cmd,
volatility3/framework/symbols/windows/consoles/consoles-win10-17763-x64.json
+595
View File
@@ -0,0 +1,595 @@
{
"symbols": {},
"enums": {},
"base_types": {
"unsigned long": {
"kind": "int",
"size": 4,
"signed": false,
"endian": "little"
},
"unsigned char": {
"kind": "char",
"size": 1,
"signed": false,
"endian": "little"
},
"pointer": {
"kind": "int",
"size": 8,
"signed": false,
"endian": "little"
},
"unsigned int": {
"kind": "int",
"size": 4,
"signed": false,
"endian": "little"
},
"unsigned short": {
"kind": "int",
"size": 2,
"signed": false,
"endian": "little"
},
"short": {
"kind": "int",
"size": 2,
"signed": true,
"endian": "little"
},
"long": {
"kind": "int",
"size": 4,
"signed": false,
"endian": "little"
}
},
"user_types": {
"_CONSOLE_INFORMATION": {
"fields": {
"ScreenX": {
"type": {
"kind": "base",
"name": "short"
},
"offset": 32
},
"ScreenY": {
"type": {
"kind": "base",
"name": "short"
},
"offset": 34
},
"CommandHistorySize": {
"type": {
"kind": "base",
"name": "unsigned short"
},
"offset": 144
},
"HistoryBufferMax": {
"type": {
"kind": "base",
"name": "unsigned short"
},
"offset": 148
},
"OriginalTitle": {
"type": {
"kind": "pointer",
"subtype": {
"kind": "base",
"name": "string"
}
},
"offset": 1736
},
"Title": {
"type": {
"kind": "pointer",
"subtype": {
"kind": "base",
"name": "string"
}
},
"offset": 1672
},
"GetScreenBuffer": {
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_SCREEN_INFORMATION"
}
},
"offset": 1800
},
"CurrentScreenBuffer": {
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_SCREEN_INFORMATION"
}
},
"offset": 1384
},
"ConsoleProcessList": {
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_LIST_ENTRY"
}
},
"offset": 1360
},
"ProcessCount": {
"type": {
"kind": "base",
"name": "unsigned short"
},
"offset": 1368
},
"HistoryList": {
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_LIST_ENTRY"
}
},
"offset": -760
},
"HistoryBufferCount": {
"type": {
"kind": "base",
"name": "unsigned short"
},
"offset": -752
},
"ExeAliasList": {
"type": {
"kind": "base",
"name": "unsigned short"
},
"offset": 1392
}
},
"kind": "struct",
"size": 140
},
"_VECTOR": {
"fields": {
"Begin": {
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_COMMAND"
}
},
"offset": 0
},
"End": {
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_COMMAND"
}
},
"offset": 8
},
"EndCapacity": {
"type": {
"kind": "pointer",
"subtype": {
"kind": "base",
"name": "unsigned long"
}
},
"offset": 16
}
},
"kind": "struct",
"size": 24
},
"_COMMAND": {
"fields": {
"Chars": {
"type": {
"count": 1,
"kind": "array",
"subtype": {
"kind": "base",
"name": "unsigned char"
}
},
"offset": 0
},
"Pointer": {
"type": {
"kind": "pointer",
"subtype": {
"kind": "base",
"name": "string"
}
},
"offset": 0
},
"Length": {
"type": {
"kind": "base",
"name": "unsigned int"
},
"offset": 16
},
"Allocated": {
"type": {
"kind": "base",
"name": "unsigned int"
},
"offset": 24
}
},
"kind": "struct",
"size": 32
},
"_CONSOLE_PROCESS_LIST": {
"fields": {
"ListEntry": {
"type": {
"kind": "struct",
"name": "nt_symbols!_LIST_ENTRY"
},
"offset": 0
},
"ConsoleProcess": {
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_CONSOLE_PROCESS"
}
},
"offset": 16
}
},
"kind": "struct",
"size": 24
},
"_CONSOLE_PROCESS_HANDLE": {
"fields": {
"ProcessHandle": {
"type": {
"kind": "base",
"name": "unsigned int"
},
"offset": 48
}
},
"kind": "struct",
"size": 52
},
"_CONSOLE_PROCESS": {
"fields": {
"ProcessId": {
"type": {
"kind": "base",
"name": "unsigned int"
},
"offset": 28
},
"ThreadId": {
"type": {
"kind": "base",
"name": "unsigned int"
},
"offset": 32
},
"ProcessHandle": {
"type": {
"kind": "base",
"name": "unsigned int"
},
"offset": 48
}
},
"kind": "struct",
"size": 24
},
"_COMMAND_HISTORY": {
"fields": {
"ListEntry": {
"type": {
"kind": "struct",
"name": "nt_symbols!_LIST_ENTRY"
},
"offset": 0
},
"CommandBucket": {
"type": {
"kind": "struct",
"name": "_VECTOR"
},
"offset": 16
},
"CommandCountMax": {
"type": {
"kind": "base",
"name": "unsigned short"
},
"offset": 40
},
"Application": {
"type": {
"kind": "struct",
"name": "_COMMAND"
},
"offset": 48
},
"ConsoleProcessHandle": {
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_CONSOLE_PROCESS_HANDLE"
}
},
"offset": 80
},
"Flags": {
"type": {
"kind": "base",
"name": "unsigned short"
},
"offset": 88
},
"LastDisplayed": {
"type": {
"kind": "base",
"name": "short"
},
"offset": 92
}
},
"kind": "struct",
"size": 96
},
"_SCREEN_INFORMATION": {
"fields": {
"TextBufferInfo": {
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_TEXT_BUFFER_INFO"
}
},
"offset": 32
},
"Next": {
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_SCREEN_INFORMATION"
}
},
"offset": 36
}
},
"kind": "struct",
"size": 72
},
"_ROW_POINTER": {
"fields": {
"Row": {
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_ROW"
}
},
"offset": 0
}
},
"kind": "struct",
"size": 8
},
"_ROWS_ARRAY": {
"fields": {
"Rows": {
"type": {
"count": 1,
"kind": "array",
"subtype": {
"kind": "struct",
"name": "_ROW_POINTER"
}
},
"offset": 0
}
},
"kind": "struct",
"size": 8
},
"_TEXT_BUFFER_INFO": {
"fields": {
"BufferDeque": {
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_DEQUE"
}
},
"offset": 0
},
"BufferRows": {
"type": {
"kind": "pointer",
"name": "void",
"subtype": {
"kind": "struct",
"name": "_ROWS_ARRAY"
}
},
"offset": 8
},
"BufferCapacity": {
"type": {
"kind": "base",
"name": "short"
},
"offset": 32
},
"ThisBuffer": {
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_TEXT_BUFFER_INFO"
}
},
"offset": 48
},
"BufferEnd": {
"type": {
"kind": "base",
"name": "short"
},
"offset": 56
},
"BufferLastIndex": {
"type": {
"kind": "base",
"name": "short"
},
"offset": 58
},
"BufferStart": {
"type": {
"kind": "base",
"name": "short"
},
"offset": 112
}
},
"kind": "struct",
"size": 72
},
"_CHAR_ROW_CELL": {
"fields": {
"Text": {
"type": {
"kind": "struct",
"name": "nt_symbols!_UNICODE_STRING"
},
"offset": 0
},
"DbcsAttribute": {
"type": {
"kind": "base",
"name": "unsigned int"
},
"offset": 2
}
},
"kind": "struct",
"size": 3
},
"_CHAR_ROW_CELL_ARRAY": {
"fields": {
"Chars": {
"type": {
"count": 1,
"kind": "array",
"subtype": {
"kind": "struct",
"name": "_CHAR_ROW_CELL"
}
},
"offset": 0
}
},
"kind": "struct",
"size": 8
},
"_ROW": {
"fields": {
"CharRow": {
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_CHAR_ROW_CELL_ARRAY"
}
},
"offset": 8
},
"RowLength": {
"type": {
"kind": "base",
"name": "short"
},
"offset": 64
},
"Index": {
"type": {
"kind": "base",
"name": "short"
},
"offset": 72
},
"RowLength2": {
"type": {
"kind": "base",
"name": "short"
},
"offset": 80
},
"TextBuffer": {
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_TEXT_BUFFER_INFO"
}
},
"offset": 88
} },
"kind": "struct",
"size": 96
},
"_DEQUE": {
"fields": {
"Blink": {
"type": {
"kind": "pointer",
"subtype": {
"kind": "base",
"name": "void"
}
},
"offset": 0
}
},
"kind": "struct",
"size": 8
}
},
"metadata": {
"producer": {
"version": "0.0.1",
"name": "Dave Lassalle",
"datetime": "2024-07-31T15:05:35-06:00"
},
"format": "4.1.0"
}
}
volatility3/framework/symbols/windows/extensions/consoles.py
+5
View File
@@ -20,8 +20,13 @@ class ROW(objects.StructType):
0x28,
0x30,
0x48,
0x50,
0x60,
0x80,
0xa8,
0xc0,
0xc8,
0x98,
0xF8,
0xF0,
0xA0,