WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-29 19:29:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #448 from volatilityfoundation/issues/issue447-memmap-file-offset

Browse Source 
Windows: Memmap include file offset
This commit is contained in:
ikelos
2021-02-05 01:08:04 +00:00
committed by GitHub
parent 30fe201c4b 6947e8ead5
commit c51a9aced4
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/memmap.py
+4 -3
View File
@@ -50,11 +50,12 @@ class Memmap(interfaces.plugins.PluginInterface):
file_handle = self.open("pid.{}.dmp".format(pid))
with file_handle as file_data:
file_offset = 0
for mapval in proc_layer.mapping(0x0, proc_layer.maximum_address, ignore_errors = True):
offset, size, mapped_offset, mapped_size, maplayer = mapval
file_output = "Disabled"
file_offset += size
if self.config['dump']:
try:
data = proc_layer.read(offset, size, pad = True)
@@ -66,14 +67,14 @@ class Memmap(interfaces.plugins.PluginInterface):
proc_layer_name, offset, file_handle.preferred_filename))
yield (0, (format_hints.Hex(offset), format_hints.Hex(mapped_offset), format_hints.Hex(mapped_size),
format_hints.Hex(offset), file_output))
format_hints.Hex(file_offset), file_output))
offset += mapped_size
def run(self):
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("Virtual", format_hints.Hex), ("Physical", format_hints.Hex),
("Size", format_hints.Hex), ("Offset", format_hints.Hex), ("File output", str)],
("Size", format_hints.Hex), ("Offset in File", format_hints.Hex), ("File output", str)],
self._generator(
pslist.PsList.list_processes(context = self.context,
layer_name = self.config['primary'],