diff --git a/volatility3/framework/plugins/windows/amcache.py b/volatility3/framework/plugins/windows/amcache.py index 46a742233..2ce1ead02 100644 --- a/volatility3/framework/plugins/windows/amcache.py +++ b/volatility3/framework/plugins/windows/amcache.py @@ -218,7 +218,9 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Extract information on executed applications from the AmCache.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + + # 2.0.0 - changed the signature of get_amcache_hive + _version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -230,7 +232,7 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0) + name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) ), ] @@ -252,17 +254,14 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): cls, context: interfaces.context.ContextInterface, config_path: str, - kernel: interfaces.context.ModuleInterface, + kernel_module_name: str, ) -> Optional[registry.RegistryHive]: """Retrieves the `Amcache.hve` registry hive from the kernel module, if it can be located.""" return next( hivelist.HiveList.list_hives( - context=context, - base_config_path=interfaces.configuration.path_join( - config_path, "hivelist" - ), - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + context, + interfaces.configuration.path_join(config_path, "hivelist"), + kernel_module_name, filter_string="amcache", ), None, @@ -523,8 +522,6 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ) def _generator(self) -> Iterator[Tuple[int, _AmcacheEntry]]: - kernel = self.context.modules[self.config["kernel"]] - def indented( entry_gen: Iterable[_AmcacheEntry], indent: int = 0 ) -> Iterator[Tuple[int, _AmcacheEntry]]: @@ -533,7 +530,9 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # Building the dictionary ahead of time is much better for performance # vs looking up each service's DLL individually. - amcache = self.get_amcache_hive(self.context, self.config_path, kernel) + amcache = self.get_amcache_hive( + self.context, self.config_path, self.config["kernel"] + ) if amcache is None: return