WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-29 11:19:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Windows PsList: Update dependents

Browse Source 
This updates all dependents on windows.pslist.PsList that could be
updated without breaking interface changes of their own to use the
latest windows.pslist.PsList plugin version with a simplified method
signature

Co-authored-by: Andrew Case <andrew@dfir.org>
This commit is contained in:
David McDonald
2025-03-05 17:59:38 -06:00
co-authored by Andrew Case
parent f06c87cb39
commit b6ec262deb
32 changed files with 106 additions and 171 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/cli/volshell/windows.py
+2 -6
View File
@@ -18,7 +18,7 @@ class Volshell(generic.Volshell):
return [
requirements.ModuleRequirement(name="kernel", description="Windows kernel"),
requirements.PluginRequirement(
name="pslist", plugin=pslist.PsList, version=(2, 0, 0)
name="pslist", plugin=pslist.PsList, version=(3, 0, 0)
),
requirements.IntRequirement(
name="pid", description="Process ID", optional=True
@@ -38,11 +38,7 @@ class Volshell(generic.Volshell):
def list_processes(self):
"""Returns a list of EPROCESS objects from the primary layer"""
# We always use the main kernel memory and associated symbols
return list(
pslist.PsList.list_processes(
self.context, self.current_layer, self.current_symbol_table
)
)
return list(pslist.PsList.list_processes(self.context, self.config["kernel"]))
def get_process(self, pid=None, virtaddr=None, physaddr=None):
"""Returns the _EPROCESS object that matches the pid. If a physical or a virtual address is provided, construct the _EPROCESS object at said address. Only one parameter is allowed.
volatility3/framework/layers/registry.py
+1 -1
View File
@@ -66,7 +66,7 @@ class RegistryHive(linear.LinearlyMappedLayer):
# Win10 17063 introduced the Registry process to map most hives. Check
# if it exists and update RegistryHive._base_layer
for proc in pslist.PsList.list_processes(
self.context, self.config["base_layer"], self.config["nt_symbols"]
self.context, self.config["kernel_module_name"]
):
proc_name = proc.ImageFileName.cast(
"string", max_length=proc.ImageFileName.vol.count, errors="replace"
volatility3/framework/plugins/windows/cmdline.py
+8 -9
View File
@@ -2,7 +2,7 @@
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
import logging
from typing import List
from typing import List, Optional
from volatility3.framework import constants, exceptions, renderers, interfaces
from volatility3.framework.configuration import requirements
@@ -28,7 +28,7 @@ class CmdLine(interfaces.plugins.PluginInterface):
architectures=["Intel32", "Intel64"],
),
requirements.PluginRequirement(
name="pslist", plugin=pslist.PsList, version=(2, 0, 0)
name="pslist", plugin=pslist.PsList, version=(3, 0, 0)
),
requirements.ListRequirement(
name="pid",
@@ -41,7 +41,7 @@ class CmdLine(interfaces.plugins.PluginInterface):
@classmethod
def get_cmdline(
cls, context: interfaces.context.ContextInterface, kernel_table_name: str, proc
):
) -> Optional[str]:
"""Extracts the cmdline from PEB
Args:
@@ -54,15 +54,16 @@ class CmdLine(interfaces.plugins.PluginInterface):
"""
proc_layer_name = proc.add_process_layer()
if not proc_layer_name:
return None
peb = context.object(
kernel_table_name + constants.BANG + "_PEB",
layer_name=proc_layer_name,
offset=proc.Peb,
)
result_text = peb.ProcessParameters.CommandLine.get_string()
return result_text
return peb.ProcessParameters.CommandLine.get_string()
def _generator(self, procs):
kernel = self.context.modules[self.config["kernel"]]
@@ -99,16 +100,14 @@ class CmdLine(interfaces.plugins.PluginInterface):
yield (0, (proc.UniqueProcessId, process_name, result_text))
def run(self):
kernel = self.context.modules[self.config["kernel"]]
filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None))
return renderers.TreeGrid(
[("PID", int), ("Process", str), ("Args", str)],
self._generator(
pslist.PsList.list_processes(
context=self.context,
layer_name=kernel.layer_name,
symbol_table=kernel.symbol_table_name,
self.context,
self.config["kernel"],
filter_func=filter_func,
)
),
volatility3/framework/plugins/windows/cmdscan.py
+3 -6
View File
@@ -36,7 +36,7 @@ class CmdScan(interfaces.plugins.PluginInterface):
architectures=["Intel32", "Intel64"],
),
requirements.VersionRequirement(
name="pslist", component=pslist.PsList, version=(2, 0, 0)
name="pslist", component=pslist.PsList, version=(3, 0, 0)
),
requirements.PluginRequirement(
name="consoles", plugin=consoles.Consoles, version=(2, 0, 0)
@@ -359,8 +359,6 @@ class CmdScan(interfaces.plugins.PluginInterface):
return process_name != "conhost.exe"
def run(self):
kernel = self.context.modules[self.config["kernel"]]
return renderers.TreeGrid(
[
("PID", int),
@@ -372,9 +370,8 @@ class CmdScan(interfaces.plugins.PluginInterface):
],
self._generator(
pslist.PsList.list_processes(
context=self.context,
layer_name=kernel.layer_name,
symbol_table=kernel.symbol_table_name,
self.context,
self.config["kernel"],
filter_func=self._conhost_proc_filter,
)
),
volatility3/framework/plugins/windows/consoles.py
+3 -6
View File
@@ -43,7 +43,7 @@ class Consoles(interfaces.plugins.PluginInterface):
architectures=["Intel32", "Intel64"],
),
requirements.VersionRequirement(
name="pslist", component=pslist.PsList, version=(2, 0, 0)
name="pslist", component=pslist.PsList, version=(3, 0, 0)
),
requirements.VersionRequirement(
name="verinfo", component=verinfo.VerInfo, version=(1, 0, 0)
@@ -932,8 +932,6 @@ class Consoles(interfaces.plugins.PluginInterface):
return process_name.lower() != "conhost.exe"
def run(self):
kernel = self.context.modules[self.config["kernel"]]
return renderers.TreeGrid(
[
("PID", int),
@@ -945,9 +943,8 @@ class Consoles(interfaces.plugins.PluginInterface):
],
self._generator(
pslist.PsList.list_processes(
context=self.context,
layer_name=kernel.layer_name,
symbol_table=kernel.symbol_table_name,
self.context,
self.config["kernel"],
filter_func=self._conhost_proc_filter,
)
),
volatility3/framework/plugins/windows/debugregisters.py
+2 -6
View File
@@ -35,7 +35,7 @@ class DebugRegisters(interfaces.plugins.PluginInterface):
architectures=["Intel32", "Intel64"],
),
requirements.VersionRequirement(
name="pslist", component=pslist.PsList, version=(2, 0, 0)
name="pslist", component=pslist.PsList, version=(3, 0, 0)
),
requirements.PluginRequirement(
name="threads", plugin=threads.Threads, version=(2, 0, 0)
@@ -117,11 +117,7 @@ class DebugRegisters(interfaces.plugins.PluginInterface):
proc_modules = None
procs = pslist.PsList.list_processes(
context=self.context,
layer_name=kernel.layer_name,
symbol_table=kernel.symbol_table_name,
)
procs = pslist.PsList.list_processes(self.context, self.config["kernel"])
for proc in procs:
for thread in threads.Threads.list_threads(kernel, proc):
volatility3/framework/plugins/windows/direct_system_calls.py
+13 -11
View File
@@ -53,7 +53,9 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface):
"""Detects the Direct System Call technique used to bypass EDRs"""
_required_framework_version = (2, 4, 0)
_version = (1, 0, 1)
# 2.0.0 - changes signature of `get_tasks_to_scan`
_version = (2, 0, 0)
# DLLs that are expected to host system call invocations
valid_syscall_handlers = ("ntdll.dll", "win32u.dll")
@@ -90,7 +92,7 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface):
architectures=["Intel32", "Intel64"],
),
requirements.PluginRequirement(
name="pslist", plugin=pslist.PsList, version=(2, 0, 0)
name="pslist", plugin=pslist.PsList, version=(3, 0, 0)
),
requirements.VersionRequirement(
name="yarascanner", component=yarascan.YaraScanner, version=(2, 1, 0)
@@ -334,8 +336,7 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface):
def get_tasks_to_scan(
cls,
context: interfaces.context.ContextInterface,
layer_name: str,
symbol_table_name: str,
kernel_module_name: str,
) -> Generator[
Tuple[interfaces.objects.ObjectInterface, str, str, str], None, None
]:
@@ -350,12 +351,15 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface):
# gather active processes
filter_func = pslist.PsList.create_active_process_filter()
is_32bit_arch = not symbols.symbol_table_is_64bit(context, symbol_table_name)
kernel = context.modules[kernel_module_name]
is_32bit_arch = not symbols.symbol_table_is_64bit(
context, kernel.symbol_table_name
)
for proc in pslist.PsList.list_processes(
context=context,
layer_name=layer_name,
symbol_table=symbol_table_name,
context,
kernel_module_name,
filter_func=filter_func,
):
proc_name = utility.array_to_string(proc.ImageFileName)
@@ -426,10 +430,8 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface):
)
return
kernel = self.context.modules[self.config["kernel"]]
for proc, proc_name, proc_layer_name, architecture in self.get_tasks_to_scan(
self.context, kernel.layer_name, kernel.symbol_table_name
self.context, self.config["kernel"]
):
proc_layer = self.context.layers[proc_layer_name]
volatility3/framework/plugins/windows/dlllist.py
+4 -10
View File
@@ -34,7 +34,7 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
architectures=["Intel32", "Intel64"],
),
requirements.VersionRequirement(
name="pslist", component=pslist.PsList, version=(2, 0, 0)
name="pslist", component=pslist.PsList, version=(3, 0, 0)
),
requirements.VersionRequirement(
name="psscan", component=psscan.PsScan, version=(1, 1, 0)
@@ -191,13 +191,8 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
)
def generate_timeline(self):
kernel = self.context.modules[self.config["kernel"]]
for row in self._generator(
pslist.PsList.list_processes(
context=self.context,
layer_name=kernel.layer_name,
symbol_table=kernel.symbol_table_name,
)
pslist.PsList.list_processes(self.context, self.config["kernel"])
):
_depth, row_data = row
if not isinstance(row_data[6], datetime.datetime):
@@ -222,9 +217,8 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
)
else:
procs = pslist.PsList.list_processes(
context=self.context,
layer_name=kernel.layer_name,
symbol_table=kernel.symbol_table_name,
self.context,
self.config["kernel"],
filter_func=filter_func,
)
volatility3/framework/plugins/windows/dumpfiles.py
+2 -4
View File
@@ -68,7 +68,7 @@ class DumpFiles(interfaces.plugins.PluginInterface):
optional=True,
),
requirements.VersionRequirement(
name="pslist", component=pslist.PsList, version=(2, 0, 0)
name="pslist", component=pslist.PsList, version=(3, 0, 0)
),
requirements.VersionRequirement(
name="handles", component=handles.Handles, version=(2, 0, 0)
@@ -352,7 +352,6 @@ class DumpFiles(interfaces.plugins.PluginInterface):
offsets = list()
# a list of processes matching the pid filter. all files for these process(es) will be dumped.
procs = list()
kernel = self.context.modules[self.config["kernel"]]
if self.config["filter"] and (
self.config["virtaddr"] or self.config["physaddr"]
@@ -373,8 +372,7 @@ class DumpFiles(interfaces.plugins.PluginInterface):
)
procs = pslist.PsList.list_processes(
self.context,
kernel.layer_name,
kernel.symbol_table_name,
self.config["kernel"],
filter_func=filter_func,
)
volatility3/framework/plugins/windows/envars.py
+3 -5
View File
@@ -40,7 +40,7 @@ class Envars(interfaces.plugins.PluginInterface):
optional=True,
),
requirements.PluginRequirement(
name="pslist", plugin=pslist.PsList, version=(2, 0, 0)
name="pslist", plugin=pslist.PsList, version=(3, 0, 0)
),
requirements.PluginRequirement(
name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0)
@@ -214,7 +214,6 @@ class Envars(interfaces.plugins.PluginInterface):
def run(self):
filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None))
kernel = self.context.modules[self.config["kernel"]]
return renderers.TreeGrid(
[
@@ -226,9 +225,8 @@ class Envars(interfaces.plugins.PluginInterface):
],
self._generator(
pslist.PsList.list_processes(
context=self.context,
layer_name=kernel.layer_name,
symbol_table=kernel.symbol_table_name,
self.context,
self.config["kernel"],
filter_func=filter_func,
)
),
volatility3/framework/plugins/windows/getsids.py
+3 -5
View File
@@ -84,7 +84,7 @@ class GetSIDs(interfaces.plugins.PluginInterface):
optional=True,
),
requirements.PluginRequirement(
name="pslist", plugin=pslist.PsList, version=(2, 0, 0)
name="pslist", plugin=pslist.PsList, version=(3, 0, 0)
),
requirements.PluginRequirement(
name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0)
@@ -215,15 +215,13 @@ class GetSIDs(interfaces.plugins.PluginInterface):
def run(self):
filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None))
kernel = self.context.modules[self.config["kernel"]]
return renderers.TreeGrid(
[("PID", int), ("Process", str), ("SID", str), ("Name", str)],
self._generator(
pslist.PsList.list_processes(
context=self.context,
layer_name=kernel.layer_name,
symbol_table=kernel.symbol_table_name,
self.context,
self.config["kernel"],
filter_func=filter_func,
)
),
volatility3/framework/plugins/windows/handles.py
+3 -4
View File
@@ -36,7 +36,7 @@ class Handles(interfaces.plugins.PluginInterface):
architectures=["Intel32", "Intel64"],
),
requirements.PluginRequirement(
name="pslist", plugin=pslist.PsList, version=(2, 0, 0)
name="pslist", plugin=pslist.PsList, version=(3, 0, 0)
),
requirements.VersionRequirement(
name="psscan", component=psscan.PsScan, version=(1, 1, 0)
@@ -393,9 +393,8 @@ class Handles(interfaces.plugins.PluginInterface):
)
else:
procs = pslist.PsList.list_processes(
context=self.context,
layer_name=kernel.layer_name,
symbol_table=kernel.symbol_table_name,
self.context,
self.config["kernel"],
filter_func=filter_func,
)
volatility3/framework/plugins/windows/hollowprocesses.py
+3 -5
View File
@@ -48,7 +48,7 @@ class HollowProcesses(interfaces.plugins.PluginInterface):
optional=True,
),
requirements.VersionRequirement(
name="pslist", component=pslist.PsList, version=(2, 0, 0)
name="pslist", component=pslist.PsList, version=(3, 0, 0)
),
requirements.VersionRequirement(
name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0)
@@ -205,7 +205,6 @@ class HollowProcesses(interfaces.plugins.PluginInterface):
def run(self):
filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None))
kernel = self.context.modules[self.config["kernel"]]
return renderers.TreeGrid(
[
@@ -215,9 +214,8 @@ class HollowProcesses(interfaces.plugins.PluginInterface):
],
self._generator(
pslist.PsList.list_processes(
context=self.context,
layer_name=kernel.layer_name,
symbol_table=kernel.symbol_table_name,
self.context,
self.config["kernel"],
filter_func=filter_func,
)
),
volatility3/framework/plugins/windows/iat.py
+3 -6
View File
@@ -28,7 +28,7 @@ class IAT(interfaces.plugins.PluginInterface):
architectures=["Intel32", "Intel64"],
),
requirements.VersionRequirement(
name="pslist", component=pslist.PsList, version=(2, 0, 0)
name="pslist", component=pslist.PsList, version=(3, 0, 0)
),
requirements.ListRequirement(
name="pid",
@@ -126,8 +126,6 @@ class IAT(interfaces.plugins.PluginInterface):
continue
def run(self):
kernel = self.context.modules[self.config["kernel"]]
return renderers.TreeGrid(
[
("PID", int),
@@ -139,9 +137,8 @@ class IAT(interfaces.plugins.PluginInterface):
],
self._generator(
pslist.PsList.list_processes(
context=self.context,
layer_name=kernel.layer_name,
symbol_table=kernel.symbol_table_name,
self.context,
self.config["kernel"],
filter_func=pslist.PsList.create_pid_filter(
self.config.get("pid", None)
),
volatility3/framework/plugins/windows/joblinks.py
+4 -2
View File
@@ -36,16 +36,18 @@ class JobLinks(interfaces.plugins.PluginInterface):
optional=True,
),
requirements.VersionRequirement(
name="pslist", component=pslist.PsList, version=(2, 0, 0)
name="pslist", component=pslist.PsList, version=(3, 0, 0)
),
]
def _generator(self) -> Iterator[Tuple]:
kernel = self.context.modules[self.config["kernel"]]
memory = self.context.layers[kernel.layer_name]
for proc in pslist.PsList.list_processes(
self.context, kernel.layer_name, kernel.symbol_table_name
self.context,
self.config["kernel"],
):
try:
if not self.config["physical"]:
volatility3/framework/plugins/windows/ldrmodules.py
+3 -5
View File
@@ -29,7 +29,7 @@ class LdrModules(interfaces.plugins.PluginInterface):
architectures=["Intel32", "Intel64"],
),
requirements.VersionRequirement(
name="pslist", component=pslist.PsList, version=(2, 0, 0)
name="pslist", component=pslist.PsList, version=(3, 0, 0)
),
requirements.VersionRequirement(
name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0)
@@ -107,7 +107,6 @@ class LdrModules(interfaces.plugins.PluginInterface):
def run(self):
filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None))
kernel = self.context.modules[self.config["kernel"]]
return renderers.TreeGrid(
[
@@ -121,9 +120,8 @@ class LdrModules(interfaces.plugins.PluginInterface):
],
self._generator(
pslist.PsList.list_processes(
context=self.context,
layer_name=kernel.layer_name,
symbol_table=kernel.symbol_table_name,
self.context,
self.config["kernel"],
filter_func=filter_func,
)
),
volatility3/framework/plugins/windows/malfind.py
+3 -5
View File
@@ -41,7 +41,7 @@ class Malfind(interfaces.plugins.PluginInterface):
optional=True,
),
requirements.VersionRequirement(
name="pslist", component=pslist.PsList, version=(2, 0, 0)
name="pslist", component=pslist.PsList, version=(3, 0, 0)
),
requirements.VersionRequirement(
name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0)
@@ -238,7 +238,6 @@ class Malfind(interfaces.plugins.PluginInterface):
def run(self):
filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None))
kernel = self.context.modules[self.config["kernel"]]
return renderers.TreeGrid(
[
@@ -257,9 +256,8 @@ class Malfind(interfaces.plugins.PluginInterface):
],
self._generator(
pslist.PsList.list_processes(
context=self.context,
layer_name=kernel.layer_name,
symbol_table=kernel.symbol_table_name,
self.context,
self.config["kernel"],
filter_func=filter_func,
)
),
volatility3/framework/plugins/windows/memmap.py
+3 -5
View File
@@ -28,7 +28,7 @@ class Memmap(interfaces.plugins.PluginInterface):
architectures=["Intel32", "Intel64"],
),
requirements.PluginRequirement(
name="pslist", plugin=pslist.PsList, version=(2, 0, 0)
name="pslist", plugin=pslist.PsList, version=(3, 0, 0)
),
requirements.IntRequirement(
name="pid",
@@ -97,7 +97,6 @@ class Memmap(interfaces.plugins.PluginInterface):
def run(self):
filter_func = pslist.PsList.create_pid_filter([self.config.get("pid", None)])
kernel = self.context.modules[self.config["kernel"]]
return renderers.TreeGrid(
[
@@ -109,9 +108,8 @@ class Memmap(interfaces.plugins.PluginInterface):
],
self._generator(
pslist.PsList.list_processes(
context=self.context,
layer_name=kernel.layer_name,
symbol_table=kernel.symbol_table_name,
self.context,
self.config["kernel"],
filter_func=filter_func,
)
),
volatility3/framework/plugins/windows/privileges.py
+3 -5
View File
@@ -61,7 +61,7 @@ class Privs(interfaces.plugins.PluginInterface):
optional=True,
),
requirements.PluginRequirement(
name="pslist", plugin=pslist.PsList, version=(2, 0, 0)
name="pslist", plugin=pslist.PsList, version=(3, 0, 0)
),
]
@@ -107,7 +107,6 @@ class Privs(interfaces.plugins.PluginInterface):
def run(self):
filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None))
kernel = self.context.modules[self.config["kernel"]]
return renderers.TreeGrid(
[
@@ -120,9 +119,8 @@ class Privs(interfaces.plugins.PluginInterface):
],
self._generator(
pslist.PsList.list_processes(
context=self.context,
layer_name=kernel.layer_name,
symbol_table=kernel.symbol_table_name,
self.context,
self.config["kernel"],
filter_func=filter_func,
)
),
volatility3/framework/plugins/windows/processghosting.py
+3 -5
View File
@@ -29,7 +29,7 @@ class ProcessGhosting(interfaces.plugins.PluginInterface):
architectures=["Intel32", "Intel64"],
),
requirements.VersionRequirement(
name="pslist", component=pslist.PsList, version=(2, 0, 0)
name="pslist", component=pslist.PsList, version=(3, 0, 0)
),
]
@@ -83,7 +83,6 @@ class ProcessGhosting(interfaces.plugins.PluginInterface):
def run(self):
filter_func = pslist.PsList.create_active_process_filter()
kernel = self.context.modules[self.config["kernel"]]
return renderers.TreeGrid(
[
@@ -95,9 +94,8 @@ class ProcessGhosting(interfaces.plugins.PluginInterface):
],
self._generator(
pslist.PsList.list_processes(
context=self.context,
layer_name=kernel.layer_name,
symbol_table=kernel.symbol_table_name,
self.context,
self.config["kernel"],
filter_func=filter_func,
)
),
volatility3/framework/plugins/windows/psscan.py
+1 -1
View File
@@ -34,7 +34,7 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
architectures=["Intel32", "Intel64"],
),
requirements.PluginRequirement(
name="pslist", plugin=pslist.PsList, version=(2, 0, 0)
name="pslist", plugin=pslist.PsList, version=(3, 0, 0)
),
requirements.VersionRequirement(
name="info", component=info.Info, version=(1, 0, 0)
volatility3/framework/plugins/windows/pstree.py
+2 -4
View File
@@ -40,7 +40,7 @@ class PsTree(interfaces.plugins.PluginInterface):
optional=True,
),
requirements.VersionRequirement(
name="pslist", component=pslist.PsList, version=(2, 0, 0)
name="pslist", component=pslist.PsList, version=(3, 0, 0)
),
requirements.ListRequirement(
name="pid",
@@ -84,9 +84,7 @@ class PsTree(interfaces.plugins.PluginInterface):
"""Generates the Tree of processes."""
kernel = self.context.modules[self.config["kernel"]]
for proc in pslist.PsList.list_processes(
self.context, kernel.layer_name, kernel.symbol_table_name
):
for proc in pslist.PsList.list_processes(self.context, self.config["kernel"]):
if not self.config.get("physical", pslist.PsList.PHYSICAL_DEFAULT):
offset = proc.vol.offset
else:
volatility3/framework/plugins/windows/psxview.py
+6 -9
View File
@@ -53,7 +53,7 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter
name="info", component=info.Info, version=(1, 0, 0)
),
requirements.VersionRequirement(
name="pslist", component=pslist.PsList, version=(2, 0, 0)
name="pslist", component=pslist.PsList, version=(3, 0, 0)
),
requirements.VersionRequirement(
name="psscan", component=psscan.PsScan, version=(1, 0, 0)
@@ -181,23 +181,20 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter
def _generator(self):
kernel = self.context.modules[self.config["kernel"]]
layer_name = kernel.layer_name
symbol_table = kernel.symbol_table_name
kdbg_list_processes = list(
pslist.PsList.list_processes(
context=self.context, layer_name=layer_name, symbol_table=symbol_table
)
pslist.PsList.list_processes(self.context, self.config["kernel"])
)
# get processes from each source
processes: Dict[str, Dict[int, extensions.EPROCESS]] = {}
processes["pslist"] = self._check_pslist(kdbg_list_processes)
processes["psscan"] = self._check_psscan(layer_name, symbol_table)
processes["psscan"] = self._check_psscan(
kernel.layer_name, kernel.symbol_table_name
)
processes["thrdscan"] = self._check_thrdscan()
processes["csrss"] = self._check_csrss_handles(
kdbg_list_processes, layer_name, symbol_table
kdbg_list_processes, kernel.layer_name, kernel.symbol_table_name
)
# Unique set of all offsets from all sources
volatility3/framework/plugins/windows/sessions.py
+2 -4
View File
@@ -28,7 +28,7 @@ class Sessions(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface)
architectures=["Intel32", "Intel64"],
),
requirements.PluginRequirement(
name="pslist", plugin=pslist.PsList, version=(2, 0, 0)
name="pslist", plugin=pslist.PsList, version=(3, 0, 0)
),
requirements.ListRequirement(
name="pid",
@@ -39,7 +39,6 @@ class Sessions(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface)
]
def _generator(self):
kernel = self.context.modules[self.config["kernel"]]
filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None))
# Collect all the values as we will want to group them later
@@ -47,8 +46,7 @@ class Sessions(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface)
for proc in pslist.PsList.list_processes(
self.context,
kernel.layer_name,
kernel.symbol_table_name,
self.config["kernel"],
filter_func=filter_func,
):
session_id = proc.get_session_id()
volatility3/framework/plugins/windows/skeleton_key_check.py
+3 -6
View File
@@ -52,7 +52,7 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface):
architectures=["Intel32", "Intel64"],
),
requirements.VersionRequirement(
name="pslist", component=pslist.PsList, version=(2, 0, 0)
name="pslist", component=pslist.PsList, version=(3, 0, 0)
),
requirements.VersionRequirement(
name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0)
@@ -660,8 +660,6 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface):
return process_name != "lsass.exe"
def run(self):
kernel = self.context.modules[self.config["kernel"]]
return renderers.TreeGrid(
[
("PID", int),
@@ -672,9 +670,8 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface):
],
self._generator(
pslist.PsList.list_processes(
context=self.context,
layer_name=kernel.layer_name,
symbol_table=kernel.symbol_table_name,
self.context,
self.config["kernel"],
filter_func=self._lsass_proc_filter,
)
),
volatility3/framework/plugins/windows/suspended_threads.py
+2 -6
View File
@@ -30,7 +30,7 @@ class SuspendedThreads(interfaces.plugins.PluginInterface):
architectures=["Intel32", "Intel64"],
),
requirements.VersionRequirement(
name="pslist", component=pslist.PsList, version=(2, 0, 0)
name="pslist", component=pslist.PsList, version=(3, 0, 0)
),
requirements.VersionRequirement(
name="pe_symbols", component=pe_symbols.PESymbols, version=(2, 0, 0)
@@ -61,11 +61,7 @@ class SuspendedThreads(interfaces.plugins.PluginInterface):
proc_modules = None
# walk the threads of each process checking for suspended threads
for proc in pslist.PsList.list_processes(
context=self.context,
layer_name=kernel.layer_name,
symbol_table=kernel.symbol_table_name,
):
for proc in pslist.PsList.list_processes(self.context, self.config["kernel"]):
for thread in threads.Threads.list_threads(kernel, proc):
try:
# we only care if the thread is suspended
volatility3/framework/plugins/windows/suspicious_threads.py
+5 -3
View File
@@ -37,6 +37,9 @@ class SuspiciousThreads(interfaces.plugins.PluginInterface):
requirements.PluginRequirement(
name="thrdscan", plugin=thrdscan.ThrdScan, version=(1, 1, 0)
),
requirements.PluginRequirement(
name="pslist", plugin=pslist.PsList, version=(3, 0, 0)
),
requirements.PluginRequirement(
name="threads", plugin=threads.Threads, version=(2, 0, 0)
),
@@ -135,9 +138,8 @@ class SuspiciousThreads(interfaces.plugins.PluginInterface):
filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None))
for proc in pslist.PsList.list_processes(
context=self.context,
layer_name=kernel.layer_name,
symbol_table=kernel.symbol_table_name,
self.context,
self.config["kernel"],
filter_func=filter_func,
):
ranges = self._get_ranges(kernel, all_ranges, proc)
volatility3/framework/plugins/windows/vadinfo.py
+3 -6
View File
@@ -64,7 +64,7 @@ class VadInfo(interfaces.plugins.PluginInterface):
optional=True,
),
requirements.PluginRequirement(
name="pslist", plugin=pslist.PsList, version=(2, 0, 0)
name="pslist", plugin=pslist.PsList, version=(3, 0, 0)
),
requirements.BooleanRequirement(
name="dump",
@@ -273,8 +273,6 @@ class VadInfo(interfaces.plugins.PluginInterface):
)
def run(self) -> renderers.TreeGrid:
kernel = self.context.modules[self.config["kernel"]]
filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None))
return renderers.TreeGrid(
@@ -294,9 +292,8 @@ class VadInfo(interfaces.plugins.PluginInterface):
],
self._generator(
pslist.PsList.list_processes(
context=self.context,
layer_name=kernel.layer_name,
symbol_table=kernel.symbol_table_name,
self.context,
self.config["kernel"],
filter_func=filter_func,
)
),
volatility3/framework/plugins/windows/vadregexscan.py
+2 -4
View File
@@ -33,7 +33,7 @@ class VadRegExScan(plugins.PluginInterface):
architectures=["Intel32", "Intel64"],
),
requirements.PluginRequirement(
name="pslist", plugin=pslist.PsList, version=(2, 0, 0)
name="pslist", plugin=pslist.PsList, version=(3, 0, 0)
),
requirements.ListRequirement(
name="pid",
@@ -111,11 +111,9 @@ class VadRegExScan(plugins.PluginInterface):
def run(self):
filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None))
kernel = self.context.modules[self.config["kernel"]]
procs = pslist.PsList.list_processes(
self.context,
kernel.layer_name,
kernel.symbol_table_name,
self.config["kernel"],
filter_func=filter_func,
)
return renderers.TreeGrid(
volatility3/framework/plugins/windows/vadwalk.py
+3 -5
View File
@@ -29,7 +29,7 @@ class VadWalk(interfaces.plugins.PluginInterface):
architectures=["Intel32", "Intel64"],
),
requirements.PluginRequirement(
name="pslist", plugin=pslist.PsList, version=(2, 0, 0)
name="pslist", plugin=pslist.PsList, version=(3, 0, 0)
),
requirements.PluginRequirement(
name="vadinfo", plugin=vadinfo.VadInfo, version=(2, 0, 0)
@@ -67,7 +67,6 @@ class VadWalk(interfaces.plugins.PluginInterface):
)
def run(self) -> renderers.TreeGrid:
kernel = self.context.modules[self.config["kernel"]]
filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None))
return renderers.TreeGrid(
@@ -84,9 +83,8 @@ class VadWalk(interfaces.plugins.PluginInterface):
],
self._generator(
pslist.PsList.list_processes(
context=self.context,
layer_name=kernel.layer_name,
symbol_table=kernel.symbol_table_name,
self.context,
self.config["kernel"],
filter_func=filter_func,
)
),
volatility3/framework/plugins/windows/vadyarascan.py
+3 -6
View File
@@ -30,7 +30,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
architectures=["Intel32", "Intel64"],
),
requirements.PluginRequirement(
name="pslist", plugin=pslist.PsList, version=(2, 0, 0)
name="pslist", plugin=pslist.PsList, version=(3, 0, 0)
),
requirements.VersionRequirement(
name="yarascanner", component=yarascan.YaraScanner, version=(2, 0, 0)
@@ -53,8 +53,6 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
return yarascan_requirements + vadyarascan_requirements
def _generator(self):
kernel = self.context.modules[self.config["kernel"]]
rules = yarascan.YaraScan.process_yara_options(dict(self.config))
filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None))
@@ -62,9 +60,8 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
sanity_check = 1024 * 1024 * 1024 # 1 GB
for task in pslist.PsList.list_processes(
context=self.context,
layer_name=kernel.layer_name,
symbol_table=kernel.symbol_table_name,
self.context,
self.config["kernel"],
filter_func=filter_func,
):
layer_name = task.add_process_layer()
volatility3/framework/plugins/windows/verinfo.py
+2 -6
View File
@@ -43,7 +43,7 @@ class VerInfo(interfaces.plugins.PluginInterface):
architectures=["Intel32", "Intel64"],
),
requirements.PluginRequirement(
name="pslist", plugin=pslist.PsList, version=(2, 0, 0)
name="pslist", plugin=pslist.PsList, version=(3, 0, 0)
),
requirements.PluginRequirement(
name="modules", plugin=modules.Modules, version=(3, 0, 0)
@@ -253,11 +253,7 @@ class VerInfo(interfaces.plugins.PluginInterface):
)
def run(self):
kernel = self.context.modules[self.config["kernel"]]
procs = pslist.PsList.list_processes(
self.context, kernel.layer_name, kernel.symbol_table_name
)
procs = pslist.PsList.list_processes(self.context, self.config["kernel"])
mods = modules.Modules.list_modules(self.context, self.config["kernel"])