From b4c36bcd151fbbf8e55d4bb7ed2329d1154a39a1 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 4 Jan 2017 22:29:47 +0000 Subject: [PATCH] Make the config_prefix parameter optional. --- .../framework/symbols/windows/extensions/__init__.py | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 679f12c68..67ed92690 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -1,4 +1,6 @@ import collections.abc +import random +import string from volatility.framework import interfaces from volatility.framework import objects @@ -13,8 +15,14 @@ class _ETHREAD(objects.Struct): class _EPROCESS(objects.Struct): - def add_process_layer(self, context, config_prefix, preferred_name = None): - """Constructs a new layer """ + def add_process_layer(self, context, config_prefix = None, preferred_name = None): + """Constructs a new layer based on the process's DirectoryTableBase""" + + if config_prefix is None: + # TODO: Ensure collisions can't happen by verifying the config_prefix is empty + random_prefix = ''.join( + random.SystemRandom().choice(string.ascii_uppercase + string.digits) for _ in range(8)) + config_prefix = interfaces.configuration.path_join("temporary", "_" + random_prefix) # Figure out a suitable name we can use for the new layer if preferred_name is None: