diff --git a/volatility/framework/layers/registry.py b/volatility/framework/layers/registry.py index 410aac652..b0112d9fe 100644 --- a/volatility/framework/layers/registry.py +++ b/volatility/framework/layers/registry.py @@ -24,7 +24,7 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface): self._base_layer = self.config["base_layer"] self._hive_offset = self.config["hive_offset"] - self._table_name = self.config["ntsymbols"] + self._table_name = self.config["nt_symbols"] self._reg_table_name = context.symbol_space.free_table_name("registry") @@ -127,7 +127,7 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface): def get_requirements(cls): return [IntRequirement(name = 'hive_offset', description = '', default = 0, optional = False), - requirements.SymbolRequirement(name = "ntsymbols", description = "Windows OS"), + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"), TranslationLayerRequirement(name = 'base_layer', optional = False)] def _translate(self, offset): diff --git a/volatility/plugins/windows/hivelist.py b/volatility/plugins/windows/hivelist.py index aea77284a..7d6464ef2 100644 --- a/volatility/plugins/windows/hivelist.py +++ b/volatility/plugins/windows/hivelist.py @@ -12,7 +12,7 @@ class HiveList(plugins.PluginInterface): return [requirements.TranslationLayerRequirement(name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt", description = "Windows OS")] + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS")] def update_configuration(self): """No operation since all values provided by config/requirements initially""" @@ -30,7 +30,7 @@ class HiveList(plugins.PluginInterface): # We only use the object factory to demonstrate how to use one kvo = self.context.memory[layer_name].config['kernel_virtual_offset'] - ntkrnlmp = self.context.module(self.config["nt"], layer_name = layer_name, offset = kvo) + ntkrnlmp = self.context.module(self.config["nt_symbols"], layer_name = layer_name, offset = kvo) list_head = ntkrnlmp.get_symbol("CmpHiveListHead").address list_entry = ntkrnlmp.object(type_name = "_LIST_ENTRY", offset = kvo + list_head) diff --git a/volatility/plugins/windows/modules.py b/volatility/plugins/windows/modules.py index d7b172211..c6d3c985d 100644 --- a/volatility/plugins/windows/modules.py +++ b/volatility/plugins/windows/modules.py @@ -13,7 +13,7 @@ class Modules(plugins.PluginInterface): return [requirements.TranslationLayerRequirement(name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt", description = "Windows OS")] + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS")] def update_configuration(self): """No operation since all values provided by config/requirements initially""" @@ -44,7 +44,7 @@ class Modules(plugins.PluginInterface): layer_name = self.config['primary'] kvo = self.context.memory[layer_name].config['kernel_virtual_offset'] - ntkrnlmp = self.context.module(self.config["nt"], layer_name = layer_name, offset = kvo) + ntkrnlmp = self.context.module(self.config["nt_symbols"], layer_name = layer_name, offset = kvo) list_head = ntkrnlmp.get_symbol("PsLoadedModuleList").address list_entry = ntkrnlmp.object(type_name = "_LIST_ENTRY", offset = kvo + list_head) diff --git a/volatility/plugins/windows/printkey.py b/volatility/plugins/windows/printkey.py index a6c6a7559..659ddae89 100644 --- a/volatility/plugins/windows/printkey.py +++ b/volatility/plugins/windows/printkey.py @@ -73,7 +73,7 @@ class PrintKey(plugins.PluginInterface): try: import volatility.plugins.windows.hivelist as hivelist plugin_config_path = self.make_subconfig(primary = self.config['primary'], - nt = self.config['ntsymbols']) + nt_symbols = self.config['nt_symbols']) plugin = hivelist.HiveList(self.context, plugin_config_path) hive_offsets = [hive.vol.offset for hive in plugin.list_hives()] except: @@ -86,7 +86,7 @@ class PrintKey(plugins.PluginInterface): # Construct the hive reg_config_path = self.make_subconfig(hive_offset = hive_offset, base_layer = self.config['primary'], - ntsymbols = self.config['ntsymbols']) + nt_symbols = self.config['nt_symbols']) hive = RegistryHive(self.context, reg_config_path, name = 'hive' + hex(hive_offset), os = 'Windows') self.context.memory.add_layer(hive) diff --git a/volatility/plugins/windows/pslist.py b/volatility/plugins/windows/pslist.py index 6b9a6ba9b..00a269fb8 100644 --- a/volatility/plugins/windows/pslist.py +++ b/volatility/plugins/windows/pslist.py @@ -11,7 +11,7 @@ class PsList(plugins.PluginInterface): return [requirements.TranslationLayerRequirement(name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt", description = "Windows OS"), + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"), requirements.IntRequirement(name = 'pid', description = "Process ID", optional = True)] @@ -32,7 +32,7 @@ class PsList(plugins.PluginInterface): # We only use the object factory to demonstrate how to use one kvo = self.context.memory[layer_name].config['kernel_virtual_offset'] - ntkrnlmp = self.context.module(self.config['nt'], layer_name = layer_name, offset = kvo) + ntkrnlmp = self.context.module(self.config['nt_symbols'], layer_name = layer_name, offset = kvo) ps_aph_offset = ntkrnlmp.get_symbol("PsActiveProcessHead").address list_entry = ntkrnlmp.object(type_name = "_LIST_ENTRY", offset = kvo + ps_aph_offset) @@ -41,11 +41,11 @@ class PsList(plugins.PluginInterface): # # ``` # reloff = self.context.symbol_space.get_type( - # self.config['nt'] + constants.BANG + "_EPROCESS").relative_child_offset( + # self.config['nt_symbols'] + constants.BANG + "_EPROCESS").relative_child_offset( # "ActiveProcessLinks") # ``` # - # Note: "nt!_EPROCESS" could have been used, but would rely on the "nt" symbol table not already + # Note: "nt_symbols!_EPROCESS" could have been used, but would rely on the "nt_symbols" symbol table not already # having been present. Strictly, the value of the requirement should be joined with the BANG character # defined in the constants file reloff = ntkrnlmp.get_type("_EPROCESS").relative_child_offset("ActiveProcessLinks") diff --git a/volatility/plugins/windows/volshell.py b/volatility/plugins/windows/volshell.py index c7f121094..902c76cea 100644 --- a/volatility/plugins/windows/volshell.py +++ b/volatility/plugins/windows/volshell.py @@ -11,7 +11,7 @@ class Volshell(plugins.PluginInterface): @classmethod def get_requirements(cls): return (volshell.Volshell.get_requirements() + - [requirements.SymbolRequirement(name = "nt", description = "Windows OS"), + [requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"), requirements.IntRequirement(name = 'pid', description = "Process ID", optional = True)]) @@ -25,7 +25,7 @@ class Volshell(plugins.PluginInterface): # We only use the object factory to demonstrate how to use one layer_name = self.config['primary'] kvo = self.context.memory[layer_name].config['kernel_virtual_offset'] - ntkrnlmp = self.context.module(self.config['nt'], layer_name = layer_name, offset = kvo) + ntkrnlmp = self.context.module(self.config['nt_symbols'], layer_name = layer_name, offset = kvo) ps_aph_offset = ntkrnlmp.get_symbol("PsActiveProcessHead").address list_entry = ntkrnlmp.object(type_name = "_LIST_ENTRY", offset = kvo + ps_aph_offset) @@ -34,7 +34,7 @@ class Volshell(plugins.PluginInterface): # # ``` # reloff = self.context.symbol_space.get_type( - # self.config['nt'] + constants.BANG + "_EPROCESS").relative_child_offset( + # self.config['nt_symbols'] + constants.BANG + "_EPROCESS").relative_child_offset( # "ActiveProcessLinks") # ``` # @@ -54,7 +54,7 @@ class Volshell(plugins.PluginInterface): # Provide some OS-agnostic convenience elements for ease layer_name = self.config['primary'] kvo = self.context.memory[layer_name].config['kernel_virtual_offset'] - nt = self.context.module(self.config['nt'], layer_name = layer_name, offset = kvo) + nt = self.context.module(self.config['nt_symbols'], layer_name = layer_name, offset = kvo) ps = lambda: list(self.list_processes())