mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-10 11:47:38 +02:00
Minor changes 2
This commit is contained in:
@@ -38,12 +38,12 @@ class Malfind(interfaces.plugins.PluginInterface):
|
||||
optional=True,
|
||||
),
|
||||
requirements.IntRequirement(
|
||||
name="dump_size",
|
||||
name="dump-size",
|
||||
description="Amount of bytes to dump for each dirty region/page found - Default 64 bytes",
|
||||
optional=True,
|
||||
),
|
||||
requirements.BooleanRequirement(
|
||||
name="dump_page",
|
||||
name="dump-page",
|
||||
description="Dump each dirty page and content - Default off",
|
||||
optional=True,
|
||||
),
|
||||
@@ -62,12 +62,12 @@ class Malfind(interfaces.plugins.PluginInterface):
|
||||
proc_layer = self.context.layers[proc_layer_name]
|
||||
|
||||
# Allowing a dump_size of 0 (no dump)
|
||||
dump_size = self.config.get("dump_size") if self.config.get("dump_size") is not None else 64
|
||||
dump_size = self.config.get("dump-size") if self.config.get("dump-size") is not None else 64
|
||||
|
||||
# Dumping page defaults to off, as in case a whole r-xp region is dirty
|
||||
# this would likely dump 1000's of pages which might not always be wise nor necessary
|
||||
|
||||
dump_page = self.config.get("dump_page") or False
|
||||
dump_page = self.config.get("dump-page") or False
|
||||
|
||||
for vma in task.mm.get_vma_iter():
|
||||
vma_name = vma.get_name(self.context, task)
|
||||
|
||||
@@ -1284,7 +1284,7 @@ class vm_area_struct(objects.StructType):
|
||||
for i in range(self.vm_start, self.vm_end, proclayer.page_size):
|
||||
try:
|
||||
if proclayer.is_dirty(i):
|
||||
vollog.warning(
|
||||
vollog.debug(
|
||||
f"Found malicious (dirty+exec) page at {hex(i)} !"
|
||||
)
|
||||
malicious_pages.append(i)
|
||||
@@ -2757,7 +2757,6 @@ class page(objects.StructType):
|
||||
for name, value in self.pageflags_enum.items():
|
||||
if self.flags & (1 << value) != 0:
|
||||
flags.append(name)
|
||||
print(name,value)
|
||||
|
||||
return flags
|
||||
|
||||
|
||||
Reference in New Issue
Block a user