WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-17 20:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Tweak comments

Browse Source 
Also remove zeroes starting a slice.
This commit is contained in:
j-t-1
2025-05-29 06:47:03 +01:00
committed by GitHub
parent 40a3d23e2d
commit bb4cee7071
1 changed files with 11 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/malfind.py
+11 -11
View File
@@ -61,7 +61,7 @@ class Malfind(interfaces.plugins.PluginInterface):
vad: the MMVAD structure to test
Returns:
A boolean indicating whether a vad is empty or not
A boolean indicating whether a VAD is empty or not
"""
CHUNK_SIZE = 0x1000
@@ -112,13 +112,13 @@ class Malfind(interfaces.plugins.PluginInterface):
code.
Args:
context: The context to retrieve required elements (layers, symbol tables) from
context: The context to retrieve required elements (layers, symbol tables)
kernel_layer_name: The name of the kernel layer from which to read the VAD protections
symbol_table: The name of the table containing the kernel symbols
proc: an _EPROCESS instance
Returns:
An iterable of VAD instances and the first 64 bytes of data containing in that region
An iterable of VAD instances and the first 64 bytes of data contained in that region
"""
proc_id = "Unknown"
try:
@@ -144,7 +144,7 @@ class Malfind(interfaces.plugins.PluginInterface):
if not write_exec:
"""
# Inspect "PAGE_EXECUTE_READ" VAD pages to detect
# non writable memory regions having been injected
# non-writable memory regions having been injected
# using elevated WriteProcessMemory().
"""
if "EXECUTE" in protection_string:
@@ -152,7 +152,7 @@ class Malfind(interfaces.plugins.PluginInterface):
vad.get_start(), vad.get_end(), proc_layer.page_size
):
try:
# If we have a dirty page in a non writable "EXECUTE" region, it is suspicious.
# If we have a dirty page in a non-writable "EXECUTE" region, it is suspicious.
if proc_layer.is_dirty(page):
dirty_page = page
break
@@ -188,10 +188,10 @@ class Malfind(interfaces.plugins.PluginInterface):
yield (vad, data)
def _generator(self, procs):
# determine if we're on a 32 or 64 bit kernel
# Determine if we're on a 32 or 64 bit kernel
kernel = self.context.modules[self.config["kernel"]]
# set refined criteria to know when to add to "Notes" column
# Set refined criteria to know when to add to "Notes" column
refined_criteria = {
b"MZ": "MZ header",
b"\x55\x8b": "PE header",
@@ -204,7 +204,7 @@ class Malfind(interfaces.plugins.PluginInterface):
)
for proc in procs:
# by default, "Notes" column will be set to N/A
# By default, "Notes" column will be set to N/A
process_name = utility.array_to_string(proc.ImageFileName)
for vad, data_object in self.list_injection_sites(
@@ -215,10 +215,10 @@ class Malfind(interfaces.plugins.PluginInterface):
data = data_object.context.layers[data_object.layer_name].read(
data_object.offset, data_object.length, True
)
if data[0:2] in refined_criteria:
notes = refined_criteria[data[0:2]]
if data[:2] in refined_criteria:
notes = refined_criteria[data[:2]]
# if we're on a 64 bit kernel, we may still need 32 bit disasm due to wow64
# If we're on a 64 bit kernel, we may still need 32 bit disasm due to wow64
if is_32bit_arch or proc.get_is_wow64():
architecture = "intel"
else: