WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 03:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #793 from digitalisx/update/devicetree

Browse Source 
Plugin: update wide exceptions and test of `DeviceTree` plugin.
This commit is contained in:
ikelos
2022-07-31 17:06:38 +01:00
committed by GitHub
parent d30b7f0b1d 65d825626e
commit bdb6f85b66
2 changed files with 16 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/test_volatility.py
+11
View File
@@ -199,6 +199,17 @@ def test_windows_callbacks(image, volatility, python):
assert out.count(b"KeBugCheckReasonCallbackListHead ") > 5
assert rc == 0
def test_windows_devicetree(image, volatility, python):
rc, out, err = runvol_plugin("windows.devicetree.DeviceTree", image, volatility, python)
assert out.find(b"DEV") != -1
assert out.find(b"DRV") != -1
assert out.find(b"ATT") != -1
assert out.find(b"FILE_DEVICE_CONTROLLER") != -1
assert out.find(b"FILE_DEVICE_DISK") != -1
assert out.find(b"FILE_DEVICE_DISK_FILE_SYSTEM") != -1
assert rc == 0
# LINUX
def test_linux_pslist(image, volatility, python):
volatility3/framework/plugins/windows/devicetree.py
+5 -5
View File
@@ -78,7 +78,7 @@ class DeviceTree(interfaces.plugins.PluginInterface):
"""Listing tree based on drivers and attached devices in a particular windows memory image."""
_required_framework_version = (2, 0, 3)
_version = (1, 0, 0)
_version = (1, 0, 1)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
@@ -96,7 +96,7 @@ class DeviceTree(interfaces.plugins.PluginInterface):
try:
try:
driver_name = driver.get_driver_name()
except (ValueError, exceptions.PagedInvalidAddressException):
except (ValueError, exceptions.InvalidAddressException):
vollog.log(constants.LOGLEVEL_VVVV,
f"Failed to get Driver name : {driver.vol.offset:x}")
driver_name = renderers.UnparsableValue()
@@ -114,7 +114,7 @@ class DeviceTree(interfaces.plugins.PluginInterface):
for device in driver.get_devices():
try:
device_name = device.get_device_name()
except (ValueError, exceptions.PagedInvalidAddressException):
except (ValueError, exceptions.InvalidAddressException):
vollog.log(constants.LOGLEVEL_VVVV,
f"Failed to get Device name : {device.vol.offset:x}")
device_name = renderers.UnparsableValue()
@@ -134,7 +134,7 @@ class DeviceTree(interfaces.plugins.PluginInterface):
for level, attached_device in enumerate(device.get_attached_devices(), start=2):
try:
device_name = attached_device.get_device_name()
except (ValueError, exceptions.PagedInvalidAddressException):
except (ValueError, exceptions.InvalidAddressException):
vollog.log(constants.LOGLEVEL_VVVV,
f"Failed to get Attached Device Name: {attached_device.vol.offset:x}")
device_name = renderers.UnparsableValue()
@@ -151,7 +151,7 @@ class DeviceTree(interfaces.plugins.PluginInterface):
attached_device_type
))
except(exceptions.PagedInvalidAddressException):
except(exceptions.InvalidAddressException):
vollog.log(constants.LOGLEVEL_VVVV,
f"Invalid address identified in drivers and devices: {driver.vol.offset:x}")
continue