WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-07 18:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

improves decision making when to inspect driver pe header based on version_dict

Browse Source
This commit is contained in:
Jan
2021-12-06 17:18:39 +01:00
parent 6cd2d940f3
commit be4d014f1a
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/netscan.py
+5 -3
View File
@@ -198,10 +198,12 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
vollog.debug("Detected 18363 data structures: working with 18363 symbol table.")
vers_minor_version = 18363
# Win 8 SP 1 also may have different structures based on specific tcpip.sys version
# the following is IntelLayer specific and might need to be adapted to other architectures.
if (nt_major_version, nt_minor_version, vers_minor_version) == (6, 3, 9600):
# we need to define additional version numbers (which are then found via tcpip.sys's FileVersion header) in case there is
# ambiguity _within_ an OS version. If such a version number (last number of the tuple) is defined for the current OS
# we need to inspect tcpip.sys's headers to see if we can grab the precise version
if [ (a,b,c,d) for a, b, c, d in version_dict if (a,b,c) == (nt_major_version, nt_minor_version, vers_minor_version) and d != 0]:
vollog.debug("Requiring further version inspection due to OS version by checking tcpip.sys's FileVersion header")
# the following is IntelLayer specific and might need to be adapted to other architectures.
physical_layer_name = context.layers[layer_name].config.get('memory_layer', None)
if physical_layer_name:
ver = verinfo.VerInfo.find_version_info(context, physical_layer_name, "tcpip.sys")