WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-07 02:07:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Address feedback from ikelos

Browse Source
This commit is contained in:
atcuno
2024-07-18 16:16:04 -05:00
parent 36bd9584c3
commit bc63e24a8d
1 changed files with 18 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/pedump.py
+18 -26
View File
@@ -50,13 +50,13 @@ class PEDump(interfaces.plugins.PluginInterface):
),
]
def _write_pe(self, pe_table_name, layer_name, proc_offset, pid):
def _dump_pe(self, pe_table_name, layer_name, proc_offset, pid, base):
try:
file_handle = self.open(
"PE.{:#x}.{:d}.{:#x}.dmp".format(
proc_offset,
pid,
self.config["base"],
base,
)
)
@@ -77,23 +77,25 @@ class PEDump(interfaces.plugins.PluginInterface):
) as excp:
vollog.debug(f"Unable to dump dll at offset {self.config['base']}: {excp}")
return None
finally:
file_handle.close()
file_handle.close()
return file_handle.preferred_filename
def _dump_kernel(self, _, pe_table_name, session_layers):
def _dump_kernel(self, kernel, pe_table_name, base):
session_layers = modules.Modules.get_session_layers(
self.context, kernel.layer_name, kernel.symbol_table_name
)
session_layer_name = modules.Modules.find_session_layer(
self.context, session_layers, self.config["base"]
self.context, session_layers, base
)
if session_layer_name:
system_pid = 4
file_output = self._write_pe(
pe_table_name,
session_layer_name,
0,
system_pid,
file_output = self._dump_pe(
pe_table_name, session_layer_name, 0, system_pid, base
)
if file_output:
@@ -103,9 +105,8 @@ class PEDump(interfaces.plugins.PluginInterface):
"Unable to find a session layer with the provided base address mapped in the kernel."
)
def _dump_processes(self, kernel, pe_table_name, _):
def _dump_processes(self, kernel, pe_table_name, base):
filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None))
kernel = self.context.modules[self.config["kernel"]]
for proc in pslist.PsList.list_processes(
context=self.context,
@@ -121,11 +122,8 @@ class PEDump(interfaces.plugins.PluginInterface):
)
proc_layer_name = proc.add_process_layer()
file_output = self._write_pe(
pe_table_name,
proc_layer_name,
proc.vol.offset,
pid,
file_output = self._dump_pe(
pe_table_name, proc_layer_name, proc.vol.offset, pid, base
)
if file_output:
@@ -147,17 +145,11 @@ class PEDump(interfaces.plugins.PluginInterface):
return
if self.config["kernel_module"]:
session_layers = modules.Modules.get_session_layers(
self.context, kernel.layer_name, kernel.symbol_table_name
)
method = self._dump_kernel
pe_files = self._dump_kernel(kernel, pe_table_name, self.config["base"])
else:
session_layers = None
method = self._dump_processes
pe_files = self._dump_processes(kernel, pe_table_name, self.config["base"])
for pid, proc_name, file_output in method(
kernel, pe_table_name, session_layers
):
for pid, proc_name, file_output in pe_files:
yield (
0,
(