WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 19:57:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Minor performance fix for PE extension and yapf of poolscanner.

Browse Source
This commit is contained in:
Mike Auty
2019-02-18 00:07:19 +00:00
parent 6b3eef4083
commit b335b2320d
2 changed files with 13 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/poolscanner.py
+9 -13
View File
@@ -143,14 +143,12 @@ class PoolScanner(plugins.PluginInterface):
symbol_table = self.config["nt_symbols"]
constraints = self.builtin_constraints(symbol_table)
for constraint, mem_object, header in self.generate_pool_scan(self.context,
self.config["primary"],
symbol_table,
constraints):
for constraint, mem_object, header in self.generate_pool_scan(self.context, self.config["primary"],
symbol_table, constraints):
# generate some type-specific info for sanity checking
if constraint.object_type == "Process":
name = mem_object.ImageFileName.cast(
"string", max_length=mem_object.ImageFileName.vol.count, errors="replace")
"string", max_length = mem_object.ImageFileName.vol.count, errors = "replace")
elif constraint.object_type == "File":
try:
name = mem_object.FileName.String
@@ -206,7 +204,7 @@ class PoolScanner(plugins.PluginInterface):
object_type = "File",
size = (150, None),
page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE),
]
]
if not tags_filter:
return builtins
@@ -219,14 +217,13 @@ class PoolScanner(plugins.PluginInterface):
layer_name: str,
symbol_table: str,
constraints: List[PoolConstraint]) \
-> Generator[Tuple[PoolConstraint, interfaces.objects.ObjectInterface, interfaces.objects.ObjectInterface], None, None]:
-> Generator[Tuple[
PoolConstraint, interfaces.objects.ObjectInterface, interfaces.objects.ObjectInterface], None, None]:
# get the object type map
type_map = handles.Handles.list_objects(
context = context, layer_name = layer_name, symbol_table = symbol_table)
type_map = handles.Handles.list_objects(context = context, layer_name = layer_name, symbol_table = symbol_table)
cookie = handles.Handles.find_cookie(
context = context, layer_name = layer_name, symbol_table = symbol_table)
cookie = handles.Handles.find_cookie(context = context, layer_name = layer_name, symbol_table = symbol_table)
is_windows_10 = cls.is_windows_10(context = context, symbol_table = symbol_table)
is_windows_8_or_later = cls.is_windows_8_or_later(
@@ -239,8 +236,7 @@ class PoolScanner(plugins.PluginInterface):
if not is_windows_10:
scan_layer = context.memory[scan_layer].config['memory_layer']
for constraint, header in cls.pool_scan(
context, scan_layer, symbol_table, constraints, alignment = 8):
for constraint, header in cls.pool_scan(context, scan_layer, symbol_table, constraints, alignment = 8):
mem_object = header.get_object(
type_name = constraint.type_name,
volatility/framework/symbols/windows/extensions/pe.py
+4 -3
View File
@@ -119,8 +119,9 @@ class _IMAGE_DOS_HEADER(objects.Struct):
if size_of_image > (1024 * 1024 * 100):
raise ValueError("The claimed SizeOfImage is too large: {}".format(size_of_image))
raw_data = self._context.memory[layer_name].read(
self.vol.offset, nt_header.OptionalHeader.SizeOfImage, pad = True)
read_layer = self._context.memory[layer_name]
raw_data = read_layer.read(self.vol.offset, nt_header.OptionalHeader.SizeOfImage, pad = True)
# fix the PE image base before yielding the initial view of the data
fixed_data = self.fix_image_base(raw_data, nt_header)
@@ -151,7 +152,7 @@ class _IMAGE_DOS_HEADER(objects.Struct):
for sect in nt_header.get_sections():
sectheader = self._context.memory[layer_name].read(sect.vol.offset, sect_header_size)
sectheader = read_layer.read(sect.vol.offset, sect_header_size)
sectheader = self.replace_header_field(sect, sectheader, sect.PointerToRawData, sect.VirtualAddress)
sectheader = self.replace_header_field(sect, sectheader, sect.SizeOfRawData, sect_sizes[counter])
sectheader = self.replace_header_field(sect, sectheader, sect.Misc.VirtualSize, sect_sizes[counter])