WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-30 11:49:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

Sessions Plugin use ModuleRequirement

Browse Source
This commit is contained in:
KevTheHermit
2022-01-18 19:34:06 +00:00
parent 0f23089cb4
commit be0dd49d31
1 changed files with 12 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/sessions.py
+12 -15
View File
@@ -21,10 +21,9 @@ class Sessions(interfaces.plugins.PluginInterface):
@classmethod
def get_requirements(cls):
return [
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.ModuleRequirement(name = 'kernel',
description = 'Windows kernel',
architectures = ["Intel32", "Intel64"]),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)),
requirements.ListRequirement(name = 'pid',
element_type = int,
@@ -32,12 +31,17 @@ class Sessions(interfaces.plugins.PluginInterface):
optional = True)
]
def _generator(self, procs):
def _generator(self):
kernel = self.context.modules[self.config['kernel']]
filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None))
# Collect all the values as we will want to group them later
sessions = {}
for proc in procs:
for proc in pslist.PsList.list_processes(self.context,
kernel.layer_name,
kernel.symbol_table_name,
filter_func = filter_func):
session_id = proc.get_session_id()
@@ -56,7 +60,7 @@ class Sessions(interfaces.plugins.PluginInterface):
if var.lower() == 'sessionname':
session_type = val
# Concat Domain and User
# Concat Domain and User
full_user = f'{user_domain}/{user_name}'
if full_user == '/':
full_user = renderers.NotAvailableValue()
@@ -85,12 +89,5 @@ class Sessions(interfaces.plugins.PluginInterface):
def run(self):
filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None))
return renderers.TreeGrid([("Session ID", int), ('Session Type', str), ("Process ID", int), ("Process", str),
("User Name", str), ("Create Time", datetime.datetime)],
self._generator(
pslist.PsList.list_processes(self.context,
self.config['primary'],
self.config['nt_symbols'],
filter_func = filter_func)))
("User Name", str), ("Create Time", datetime.datetime)], self._generator())