From ab075ac667ca95793232d2f30f27b926867ca7fc Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 20 Aug 2021 00:52:43 +0100 Subject: [PATCH] Windows: Fix pstree physical/virtual offsets --- volatility3/framework/plugins/windows/pstree.py | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/plugins/windows/pstree.py b/volatility3/framework/plugins/windows/pstree.py index b8c99688f..3459d4ed5 100644 --- a/volatility3/framework/plugins/windows/pstree.py +++ b/volatility3/framework/plugins/windows/pstree.py @@ -2,7 +2,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import datetime -from typing import Dict, Set +from typing import Dict, Set, Tuple from volatility3.framework import objects, interfaces, renderers from volatility3.framework.configuration import requirements @@ -18,7 +18,7 @@ class PsTree(interfaces.plugins.PluginInterface): def __init__(self, *args, **kwargs) -> None: super().__init__(*args, **kwargs) - self._processes: Dict[int, interfaces.objects.ObjectInterface] = {} + self._processes: Dict[int, Tuple[interfaces.objects.ObjectInterface, int]] = {} self._levels: Dict[int, int] = {} self._children: Dict[int, Set[int]] = {} @@ -45,12 +45,12 @@ class PsTree(interfaces.plugins.PluginInterface): seen = set([]) seen.add(pid) level = 0 - proc = self._processes.get(pid, None) + proc, _ = self._processes.get(pid, None) while proc is not None and proc.InheritedFromUniqueProcessId not in seen: child_list = self._children.get(proc.InheritedFromUniqueProcessId, set([])) child_list.add(proc.UniqueProcessId) self._children[proc.InheritedFromUniqueProcessId] = child_list - proc = self._processes.get(proc.InheritedFromUniqueProcessId, None) + proc, _ = self._processes.get(proc.InheritedFromUniqueProcessId, (None, None)) level += 1 self._levels[pid] = level @@ -65,14 +65,14 @@ class PsTree(interfaces.plugins.PluginInterface): memory = self.context.layers[layer_name] (_, _, offset, _, _) = list(memory.mapping(offset = proc.vol.offset, length = 0))[0] - self._processes[proc.UniqueProcessId] = proc + self._processes[proc.UniqueProcessId] = proc, offset # Build the child/level maps for pid in self._processes: self.find_level(pid) def yield_processes(pid): - proc = self._processes[pid] + proc, offset = self._processes[pid] row = (proc.UniqueProcessId, proc.InheritedFromUniqueProcessId, proc.ImageFileName.cast("string", max_length = proc.ImageFileName.vol.count, errors = 'replace'), format_hints.Hex(offset), proc.ActiveThreads, proc.get_handle_count(), proc.get_session_id(),