diff --git a/volatility3/cli/volshell/windows.py b/volatility3/cli/volshell/windows.py index 9b89a8b81..cf8fd400d 100644 --- a/volatility3/cli/volshell/windows.py +++ b/volatility3/cli/volshell/windows.py @@ -18,7 +18,7 @@ class Volshell(generic.Volshell): return [ requirements.ModuleRequirement(name="kernel", description="Windows kernel"), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.IntRequirement( name="pid", description="Process ID", optional=True @@ -38,11 +38,7 @@ class Volshell(generic.Volshell): def list_processes(self): """Returns a list of EPROCESS objects from the primary layer""" # We always use the main kernel memory and associated symbols - return list( - pslist.PsList.list_processes( - self.context, self.current_layer, self.current_symbol_table - ) - ) + return list(pslist.PsList.list_processes(self.context, self.config["kernel"])) def get_process(self, pid=None, virtaddr=None, physaddr=None): """Returns the _EPROCESS object that matches the pid. If a physical or a virtual address is provided, construct the _EPROCESS object at said address. Only one parameter is allowed. diff --git a/volatility3/framework/layers/registry.py b/volatility3/framework/layers/registry.py index 21e1a938e..6d96a76a1 100644 --- a/volatility3/framework/layers/registry.py +++ b/volatility3/framework/layers/registry.py @@ -66,7 +66,7 @@ class RegistryHive(linear.LinearlyMappedLayer): # Win10 17063 introduced the Registry process to map most hives. Check # if it exists and update RegistryHive._base_layer for proc in pslist.PsList.list_processes( - self.context, self.config["base_layer"], self.config["nt_symbols"] + self.context, self.config["kernel_module_name"] ): proc_name = proc.ImageFileName.cast( "string", max_length=proc.ImageFileName.vol.count, errors="replace" diff --git a/volatility3/framework/plugins/windows/cmdline.py b/volatility3/framework/plugins/windows/cmdline.py index bad333a4c..dbfac35bf 100644 --- a/volatility3/framework/plugins/windows/cmdline.py +++ b/volatility3/framework/plugins/windows/cmdline.py @@ -2,7 +2,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from typing import List +from typing import List, Optional from volatility3.framework import constants, exceptions, renderers, interfaces from volatility3.framework.configuration import requirements @@ -28,7 +28,7 @@ class CmdLine(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", @@ -41,7 +41,7 @@ class CmdLine(interfaces.plugins.PluginInterface): @classmethod def get_cmdline( cls, context: interfaces.context.ContextInterface, kernel_table_name: str, proc - ): + ) -> Optional[str]: """Extracts the cmdline from PEB Args: @@ -54,15 +54,16 @@ class CmdLine(interfaces.plugins.PluginInterface): """ proc_layer_name = proc.add_process_layer() + if not proc_layer_name: + return None peb = context.object( kernel_table_name + constants.BANG + "_PEB", layer_name=proc_layer_name, offset=proc.Peb, ) - result_text = peb.ProcessParameters.CommandLine.get_string() - return result_text + return peb.ProcessParameters.CommandLine.get_string() def _generator(self, procs): kernel = self.context.modules[self.config["kernel"]] @@ -99,16 +100,14 @@ class CmdLine(interfaces.plugins.PluginInterface): yield (0, (proc.UniqueProcessId, process_name, result_text)) def run(self): - kernel = self.context.modules[self.config["kernel"]] filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) return renderers.TreeGrid( [("PID", int), ("Process", str), ("Args", str)], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/cmdscan.py b/volatility3/framework/plugins/windows/cmdscan.py index 051ca8db0..fd0dd76b9 100644 --- a/volatility3/framework/plugins/windows/cmdscan.py +++ b/volatility3/framework/plugins/windows/cmdscan.py @@ -36,7 +36,7 @@ class CmdScan(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.PluginRequirement( name="consoles", plugin=consoles.Consoles, version=(2, 0, 0) @@ -359,8 +359,6 @@ class CmdScan(interfaces.plugins.PluginInterface): return process_name != "conhost.exe" def run(self): - kernel = self.context.modules[self.config["kernel"]] - return renderers.TreeGrid( [ ("PID", int), @@ -372,9 +370,8 @@ class CmdScan(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=self._conhost_proc_filter, ) ), diff --git a/volatility3/framework/plugins/windows/consoles.py b/volatility3/framework/plugins/windows/consoles.py index 99eb81e5b..a4003956f 100644 --- a/volatility3/framework/plugins/windows/consoles.py +++ b/volatility3/framework/plugins/windows/consoles.py @@ -43,7 +43,7 @@ class Consoles(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="verinfo", component=verinfo.VerInfo, version=(1, 0, 0) @@ -932,8 +932,6 @@ class Consoles(interfaces.plugins.PluginInterface): return process_name.lower() != "conhost.exe" def run(self): - kernel = self.context.modules[self.config["kernel"]] - return renderers.TreeGrid( [ ("PID", int), @@ -945,9 +943,8 @@ class Consoles(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=self._conhost_proc_filter, ) ), diff --git a/volatility3/framework/plugins/windows/debugregisters.py b/volatility3/framework/plugins/windows/debugregisters.py index 5dbeb9ff4..394c30e25 100644 --- a/volatility3/framework/plugins/windows/debugregisters.py +++ b/volatility3/framework/plugins/windows/debugregisters.py @@ -35,7 +35,7 @@ class DebugRegisters(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.PluginRequirement( name="threads", plugin=threads.Threads, version=(2, 0, 0) @@ -117,11 +117,7 @@ class DebugRegisters(interfaces.plugins.PluginInterface): proc_modules = None - procs = pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, - ) + procs = pslist.PsList.list_processes(self.context, self.config["kernel"]) for proc in procs: for thread in threads.Threads.list_threads(kernel, proc): diff --git a/volatility3/framework/plugins/windows/direct_system_calls.py b/volatility3/framework/plugins/windows/direct_system_calls.py index af626f511..eaf35e842 100644 --- a/volatility3/framework/plugins/windows/direct_system_calls.py +++ b/volatility3/framework/plugins/windows/direct_system_calls.py @@ -53,7 +53,9 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): """Detects the Direct System Call technique used to bypass EDRs""" _required_framework_version = (2, 4, 0) - _version = (1, 0, 1) + + # 2.0.0 - changes signature of `get_tasks_to_scan` + _version = (2, 0, 0) # DLLs that are expected to host system call invocations valid_syscall_handlers = ("ntdll.dll", "win32u.dll") @@ -90,7 +92,7 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="yarascanner", component=yarascan.YaraScanner, version=(2, 1, 0) @@ -334,8 +336,7 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): def get_tasks_to_scan( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table_name: str, + kernel_module_name: str, ) -> Generator[ Tuple[interfaces.objects.ObjectInterface, str, str, str], None, None ]: @@ -350,12 +351,15 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): # gather active processes filter_func = pslist.PsList.create_active_process_filter() - is_32bit_arch = not symbols.symbol_table_is_64bit(context, symbol_table_name) + kernel = context.modules[kernel_module_name] + + is_32bit_arch = not symbols.symbol_table_is_64bit( + context, kernel.symbol_table_name + ) for proc in pslist.PsList.list_processes( - context=context, - layer_name=layer_name, - symbol_table=symbol_table_name, + context, + kernel_module_name, filter_func=filter_func, ): proc_name = utility.array_to_string(proc.ImageFileName) @@ -426,10 +430,8 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): ) return - kernel = self.context.modules[self.config["kernel"]] - for proc, proc_name, proc_layer_name, architecture in self.get_tasks_to_scan( - self.context, kernel.layer_name, kernel.symbol_table_name + self.context, self.config["kernel"] ): proc_layer = self.context.layers[proc_layer_name] diff --git a/volatility3/framework/plugins/windows/dlllist.py b/volatility3/framework/plugins/windows/dlllist.py index 1dafb6bf5..e7ff81f69 100644 --- a/volatility3/framework/plugins/windows/dlllist.py +++ b/volatility3/framework/plugins/windows/dlllist.py @@ -34,7 +34,7 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="psscan", component=psscan.PsScan, version=(1, 1, 0) @@ -191,13 +191,8 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ) def generate_timeline(self): - kernel = self.context.modules[self.config["kernel"]] for row in self._generator( - pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, - ) + pslist.PsList.list_processes(self.context, self.config["kernel"]) ): _depth, row_data = row if not isinstance(row_data[6], datetime.datetime): @@ -222,9 +217,8 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ) else: procs = pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ) diff --git a/volatility3/framework/plugins/windows/dumpfiles.py b/volatility3/framework/plugins/windows/dumpfiles.py index 42f245800..74a328f78 100755 --- a/volatility3/framework/plugins/windows/dumpfiles.py +++ b/volatility3/framework/plugins/windows/dumpfiles.py @@ -68,7 +68,7 @@ class DumpFiles(interfaces.plugins.PluginInterface): optional=True, ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="handles", component=handles.Handles, version=(2, 0, 0) @@ -352,7 +352,6 @@ class DumpFiles(interfaces.plugins.PluginInterface): offsets = list() # a list of processes matching the pid filter. all files for these process(es) will be dumped. procs = list() - kernel = self.context.modules[self.config["kernel"]] if self.config["filter"] and ( self.config["virtaddr"] or self.config["physaddr"] @@ -373,8 +372,7 @@ class DumpFiles(interfaces.plugins.PluginInterface): ) procs = pslist.PsList.list_processes( self.context, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], filter_func=filter_func, ) diff --git a/volatility3/framework/plugins/windows/envars.py b/volatility3/framework/plugins/windows/envars.py index 6ea95b33e..f390c09d5 100644 --- a/volatility3/framework/plugins/windows/envars.py +++ b/volatility3/framework/plugins/windows/envars.py @@ -40,7 +40,7 @@ class Envars(interfaces.plugins.PluginInterface): optional=True, ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.PluginRequirement( name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) @@ -214,7 +214,6 @@ class Envars(interfaces.plugins.PluginInterface): def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) - kernel = self.context.modules[self.config["kernel"]] return renderers.TreeGrid( [ @@ -226,9 +225,8 @@ class Envars(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/getsids.py b/volatility3/framework/plugins/windows/getsids.py index 53be50ba8..ba1820a30 100644 --- a/volatility3/framework/plugins/windows/getsids.py +++ b/volatility3/framework/plugins/windows/getsids.py @@ -84,7 +84,7 @@ class GetSIDs(interfaces.plugins.PluginInterface): optional=True, ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.PluginRequirement( name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) @@ -215,15 +215,13 @@ class GetSIDs(interfaces.plugins.PluginInterface): def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) - kernel = self.context.modules[self.config["kernel"]] return renderers.TreeGrid( [("PID", int), ("Process", str), ("SID", str), ("Name", str)], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py index 8887859f9..d9e97c1b5 100644 --- a/volatility3/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -36,7 +36,7 @@ class Handles(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="psscan", component=psscan.PsScan, version=(1, 1, 0) @@ -393,9 +393,8 @@ class Handles(interfaces.plugins.PluginInterface): ) else: procs = pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ) diff --git a/volatility3/framework/plugins/windows/hollowprocesses.py b/volatility3/framework/plugins/windows/hollowprocesses.py index 30d4b602c..7990cb112 100644 --- a/volatility3/framework/plugins/windows/hollowprocesses.py +++ b/volatility3/framework/plugins/windows/hollowprocesses.py @@ -48,7 +48,7 @@ class HollowProcesses(interfaces.plugins.PluginInterface): optional=True, ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) @@ -205,7 +205,6 @@ class HollowProcesses(interfaces.plugins.PluginInterface): def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) - kernel = self.context.modules[self.config["kernel"]] return renderers.TreeGrid( [ @@ -215,9 +214,8 @@ class HollowProcesses(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/iat.py b/volatility3/framework/plugins/windows/iat.py index 3bf7f57ed..0fe39e685 100644 --- a/volatility3/framework/plugins/windows/iat.py +++ b/volatility3/framework/plugins/windows/iat.py @@ -28,7 +28,7 @@ class IAT(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", @@ -126,8 +126,6 @@ class IAT(interfaces.plugins.PluginInterface): continue def run(self): - kernel = self.context.modules[self.config["kernel"]] - return renderers.TreeGrid( [ ("PID", int), @@ -139,9 +137,8 @@ class IAT(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=pslist.PsList.create_pid_filter( self.config.get("pid", None) ), diff --git a/volatility3/framework/plugins/windows/joblinks.py b/volatility3/framework/plugins/windows/joblinks.py index d84c133c0..f6a59d7d1 100644 --- a/volatility3/framework/plugins/windows/joblinks.py +++ b/volatility3/framework/plugins/windows/joblinks.py @@ -36,16 +36,18 @@ class JobLinks(interfaces.plugins.PluginInterface): optional=True, ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), ] def _generator(self) -> Iterator[Tuple]: kernel = self.context.modules[self.config["kernel"]] + memory = self.context.layers[kernel.layer_name] for proc in pslist.PsList.list_processes( - self.context, kernel.layer_name, kernel.symbol_table_name + self.context, + self.config["kernel"], ): try: if not self.config["physical"]: diff --git a/volatility3/framework/plugins/windows/ldrmodules.py b/volatility3/framework/plugins/windows/ldrmodules.py index a888f22e1..e1eb14599 100644 --- a/volatility3/framework/plugins/windows/ldrmodules.py +++ b/volatility3/framework/plugins/windows/ldrmodules.py @@ -29,7 +29,7 @@ class LdrModules(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) @@ -107,7 +107,6 @@ class LdrModules(interfaces.plugins.PluginInterface): def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) - kernel = self.context.modules[self.config["kernel"]] return renderers.TreeGrid( [ @@ -121,9 +120,8 @@ class LdrModules(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/malfind.py b/volatility3/framework/plugins/windows/malfind.py index 14362776b..9d79be9dd 100644 --- a/volatility3/framework/plugins/windows/malfind.py +++ b/volatility3/framework/plugins/windows/malfind.py @@ -41,7 +41,7 @@ class Malfind(interfaces.plugins.PluginInterface): optional=True, ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) @@ -238,7 +238,6 @@ class Malfind(interfaces.plugins.PluginInterface): def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) - kernel = self.context.modules[self.config["kernel"]] return renderers.TreeGrid( [ @@ -257,9 +256,8 @@ class Malfind(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/memmap.py b/volatility3/framework/plugins/windows/memmap.py index 62ab3c510..790c37aab 100644 --- a/volatility3/framework/plugins/windows/memmap.py +++ b/volatility3/framework/plugins/windows/memmap.py @@ -28,7 +28,7 @@ class Memmap(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.IntRequirement( name="pid", @@ -97,7 +97,6 @@ class Memmap(interfaces.plugins.PluginInterface): def run(self): filter_func = pslist.PsList.create_pid_filter([self.config.get("pid", None)]) - kernel = self.context.modules[self.config["kernel"]] return renderers.TreeGrid( [ @@ -109,9 +108,8 @@ class Memmap(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/privileges.py b/volatility3/framework/plugins/windows/privileges.py index 7b4d00205..a0282e8c8 100644 --- a/volatility3/framework/plugins/windows/privileges.py +++ b/volatility3/framework/plugins/windows/privileges.py @@ -61,7 +61,7 @@ class Privs(interfaces.plugins.PluginInterface): optional=True, ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), ] @@ -107,7 +107,6 @@ class Privs(interfaces.plugins.PluginInterface): def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) - kernel = self.context.modules[self.config["kernel"]] return renderers.TreeGrid( [ @@ -120,9 +119,8 @@ class Privs(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/processghosting.py b/volatility3/framework/plugins/windows/processghosting.py index 50f02c926..b94adee47 100644 --- a/volatility3/framework/plugins/windows/processghosting.py +++ b/volatility3/framework/plugins/windows/processghosting.py @@ -29,7 +29,7 @@ class ProcessGhosting(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), ] @@ -83,7 +83,6 @@ class ProcessGhosting(interfaces.plugins.PluginInterface): def run(self): filter_func = pslist.PsList.create_active_process_filter() - kernel = self.context.modules[self.config["kernel"]] return renderers.TreeGrid( [ @@ -95,9 +94,8 @@ class ProcessGhosting(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/psscan.py b/volatility3/framework/plugins/windows/psscan.py index 81e5fb792..a19423029 100644 --- a/volatility3/framework/plugins/windows/psscan.py +++ b/volatility3/framework/plugins/windows/psscan.py @@ -34,7 +34,7 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="info", component=info.Info, version=(1, 0, 0) diff --git a/volatility3/framework/plugins/windows/pstree.py b/volatility3/framework/plugins/windows/pstree.py index 4f3fe0455..d0cea43ff 100644 --- a/volatility3/framework/plugins/windows/pstree.py +++ b/volatility3/framework/plugins/windows/pstree.py @@ -40,7 +40,7 @@ class PsTree(interfaces.plugins.PluginInterface): optional=True, ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", @@ -84,9 +84,7 @@ class PsTree(interfaces.plugins.PluginInterface): """Generates the Tree of processes.""" kernel = self.context.modules[self.config["kernel"]] - for proc in pslist.PsList.list_processes( - self.context, kernel.layer_name, kernel.symbol_table_name - ): + for proc in pslist.PsList.list_processes(self.context, self.config["kernel"]): if not self.config.get("physical", pslist.PsList.PHYSICAL_DEFAULT): offset = proc.vol.offset else: diff --git a/volatility3/framework/plugins/windows/psxview.py b/volatility3/framework/plugins/windows/psxview.py index aa379bdc5..f7df979a8 100644 --- a/volatility3/framework/plugins/windows/psxview.py +++ b/volatility3/framework/plugins/windows/psxview.py @@ -53,7 +53,7 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter name="info", component=info.Info, version=(1, 0, 0) ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="psscan", component=psscan.PsScan, version=(1, 0, 0) @@ -181,23 +181,20 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter def _generator(self): kernel = self.context.modules[self.config["kernel"]] - layer_name = kernel.layer_name - symbol_table = kernel.symbol_table_name - kdbg_list_processes = list( - pslist.PsList.list_processes( - context=self.context, layer_name=layer_name, symbol_table=symbol_table - ) + pslist.PsList.list_processes(self.context, self.config["kernel"]) ) # get processes from each source processes: Dict[str, Dict[int, extensions.EPROCESS]] = {} processes["pslist"] = self._check_pslist(kdbg_list_processes) - processes["psscan"] = self._check_psscan(layer_name, symbol_table) + processes["psscan"] = self._check_psscan( + kernel.layer_name, kernel.symbol_table_name + ) processes["thrdscan"] = self._check_thrdscan() processes["csrss"] = self._check_csrss_handles( - kdbg_list_processes, layer_name, symbol_table + kdbg_list_processes, kernel.layer_name, kernel.symbol_table_name ) # Unique set of all offsets from all sources diff --git a/volatility3/framework/plugins/windows/sessions.py b/volatility3/framework/plugins/windows/sessions.py index d766b40ea..99a3cf335 100644 --- a/volatility3/framework/plugins/windows/sessions.py +++ b/volatility3/framework/plugins/windows/sessions.py @@ -28,7 +28,7 @@ class Sessions(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", @@ -39,7 +39,6 @@ class Sessions(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) ] def _generator(self): - kernel = self.context.modules[self.config["kernel"]] filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) # Collect all the values as we will want to group them later @@ -47,8 +46,7 @@ class Sessions(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) for proc in pslist.PsList.list_processes( self.context, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], filter_func=filter_func, ): session_id = proc.get_session_id() diff --git a/volatility3/framework/plugins/windows/skeleton_key_check.py b/volatility3/framework/plugins/windows/skeleton_key_check.py index 5b50c9438..b57683f04 100644 --- a/volatility3/framework/plugins/windows/skeleton_key_check.py +++ b/volatility3/framework/plugins/windows/skeleton_key_check.py @@ -52,7 +52,7 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) @@ -660,8 +660,6 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface): return process_name != "lsass.exe" def run(self): - kernel = self.context.modules[self.config["kernel"]] - return renderers.TreeGrid( [ ("PID", int), @@ -672,9 +670,8 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=self._lsass_proc_filter, ) ), diff --git a/volatility3/framework/plugins/windows/suspended_threads.py b/volatility3/framework/plugins/windows/suspended_threads.py index 2a14bd795..2c3d584df 100644 --- a/volatility3/framework/plugins/windows/suspended_threads.py +++ b/volatility3/framework/plugins/windows/suspended_threads.py @@ -30,7 +30,7 @@ class SuspendedThreads(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="pe_symbols", component=pe_symbols.PESymbols, version=(2, 0, 0) @@ -61,11 +61,7 @@ class SuspendedThreads(interfaces.plugins.PluginInterface): proc_modules = None # walk the threads of each process checking for suspended threads - for proc in pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, - ): + for proc in pslist.PsList.list_processes(self.context, self.config["kernel"]): for thread in threads.Threads.list_threads(kernel, proc): try: # we only care if the thread is suspended diff --git a/volatility3/framework/plugins/windows/suspicious_threads.py b/volatility3/framework/plugins/windows/suspicious_threads.py index f5da54da7..938c6a940 100644 --- a/volatility3/framework/plugins/windows/suspicious_threads.py +++ b/volatility3/framework/plugins/windows/suspicious_threads.py @@ -37,6 +37,9 @@ class SuspiciousThreads(interfaces.plugins.PluginInterface): requirements.PluginRequirement( name="thrdscan", plugin=thrdscan.ThrdScan, version=(1, 1, 0) ), + requirements.PluginRequirement( + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + ), requirements.PluginRequirement( name="threads", plugin=threads.Threads, version=(2, 0, 0) ), @@ -135,9 +138,8 @@ class SuspiciousThreads(interfaces.plugins.PluginInterface): filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) for proc in pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ): ranges = self._get_ranges(kernel, all_ranges, proc) diff --git a/volatility3/framework/plugins/windows/vadinfo.py b/volatility3/framework/plugins/windows/vadinfo.py index 35bf54d98..46afcaca8 100644 --- a/volatility3/framework/plugins/windows/vadinfo.py +++ b/volatility3/framework/plugins/windows/vadinfo.py @@ -64,7 +64,7 @@ class VadInfo(interfaces.plugins.PluginInterface): optional=True, ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.BooleanRequirement( name="dump", @@ -273,8 +273,6 @@ class VadInfo(interfaces.plugins.PluginInterface): ) def run(self) -> renderers.TreeGrid: - kernel = self.context.modules[self.config["kernel"]] - filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) return renderers.TreeGrid( @@ -294,9 +292,8 @@ class VadInfo(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/vadregexscan.py b/volatility3/framework/plugins/windows/vadregexscan.py index 0d35cd658..0d9b6a72e 100644 --- a/volatility3/framework/plugins/windows/vadregexscan.py +++ b/volatility3/framework/plugins/windows/vadregexscan.py @@ -33,7 +33,7 @@ class VadRegExScan(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", @@ -111,11 +111,9 @@ class VadRegExScan(plugins.PluginInterface): def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) - kernel = self.context.modules[self.config["kernel"]] procs = pslist.PsList.list_processes( self.context, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], filter_func=filter_func, ) return renderers.TreeGrid( diff --git a/volatility3/framework/plugins/windows/vadwalk.py b/volatility3/framework/plugins/windows/vadwalk.py index 930388b3a..0d6a8b245 100644 --- a/volatility3/framework/plugins/windows/vadwalk.py +++ b/volatility3/framework/plugins/windows/vadwalk.py @@ -29,7 +29,7 @@ class VadWalk(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.PluginRequirement( name="vadinfo", plugin=vadinfo.VadInfo, version=(2, 0, 0) @@ -67,7 +67,6 @@ class VadWalk(interfaces.plugins.PluginInterface): ) def run(self) -> renderers.TreeGrid: - kernel = self.context.modules[self.config["kernel"]] filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) return renderers.TreeGrid( @@ -84,9 +83,8 @@ class VadWalk(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py index 0749ea547..2dd2dec26 100644 --- a/volatility3/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -30,7 +30,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="yarascanner", component=yarascan.YaraScanner, version=(2, 0, 0) @@ -53,8 +53,6 @@ class VadYaraScan(interfaces.plugins.PluginInterface): return yarascan_requirements + vadyarascan_requirements def _generator(self): - kernel = self.context.modules[self.config["kernel"]] - rules = yarascan.YaraScan.process_yara_options(dict(self.config)) filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) @@ -62,9 +60,8 @@ class VadYaraScan(interfaces.plugins.PluginInterface): sanity_check = 1024 * 1024 * 1024 # 1 GB for task in pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ): layer_name = task.add_process_layer() diff --git a/volatility3/framework/plugins/windows/verinfo.py b/volatility3/framework/plugins/windows/verinfo.py index 26bc5e63c..63a0d9ece 100644 --- a/volatility3/framework/plugins/windows/verinfo.py +++ b/volatility3/framework/plugins/windows/verinfo.py @@ -43,7 +43,7 @@ class VerInfo(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.PluginRequirement( name="modules", plugin=modules.Modules, version=(3, 0, 0) @@ -253,11 +253,7 @@ class VerInfo(interfaces.plugins.PluginInterface): ) def run(self): - kernel = self.context.modules[self.config["kernel"]] - - procs = pslist.PsList.list_processes( - self.context, kernel.layer_name, kernel.symbol_table_name - ) + procs = pslist.PsList.list_processes(self.context, self.config["kernel"]) mods = modules.Modules.list_modules(self.context, self.config["kernel"])