WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-12 12:47:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1143 from volatilityfoundation/dumpfiles_dump_only_once_per_file_object

Browse Source 
Prevent duplicate processing of the same file object
This commit is contained in:
ikelos
2024-05-08 21:26:45 +01:00
committed by GitHub
parent 1c5c57e155 3f3f1a9c0d
commit a66aa02050
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/dumpfiles.py
+10
View File
@@ -244,6 +244,8 @@ class DumpFiles(interfaces.plugins.PluginInterface):
symbol_table=kernel.symbol_table_name,
)
dumped_files = set()
for proc in procs:
try:
object_table = proc.ObjectTable
@@ -267,6 +269,10 @@ class DumpFiles(interfaces.plugins.PluginInterface):
if not file_re.search(name):
continue
if file_obj.vol.offset in dumped_files:
continue
dumped_files.add(file_obj.vol.offset)
for result in self.process_file_object(
self.context, kernel.layer_name, self.open, file_obj
):
@@ -303,6 +309,10 @@ class DumpFiles(interfaces.plugins.PluginInterface):
if not file_re.search(name):
continue
if file_obj.vol.offset in dumped_files:
continue
dumped_files.add(file_obj.vol.offset)
for result in self.process_file_object(
self.context, kernel.layer_name, self.open, file_obj
):