mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-07 18:27:39 +02:00
Conver the verinfo plugin to using the classmethod moddump.
This commit is contained in:
@@ -31,7 +31,7 @@ class ModDump(interfaces_plugins.PluginInterface):
|
||||
context: interfaces.context.ContextInterface,
|
||||
layer_name: str,
|
||||
symbol_table: str,
|
||||
pids: typing.List[int] = None) -> typing.List[str]:
|
||||
pids: typing.List[int] = None) -> typing.Generator[str, None, None]:
|
||||
"""Build a cache of possible virtual layers, in priority starting with
|
||||
the primary/kernel layer. Then keep one layer per session by cycling
|
||||
through the process list.
|
||||
@@ -43,7 +43,7 @@ class ModDump(interfaces_plugins.PluginInterface):
|
||||
# the primary layer should be first
|
||||
layers = [layer_name]
|
||||
|
||||
seen_ids = []
|
||||
seen_ids = [] # type: typing.List[interfaces.objects.ObjectInterface]
|
||||
filter_func = pslist.PsList.create_filter(pids or [])
|
||||
|
||||
for proc in pslist.PsList.list_processes(context = context,
|
||||
@@ -69,9 +69,7 @@ class ModDump(interfaces_plugins.PluginInterface):
|
||||
|
||||
# save the layer if we haven't seen the session yet
|
||||
seen_ids.append(session_space.SessionId)
|
||||
layers.append(proc_layer_name)
|
||||
|
||||
return layers
|
||||
yield proc_layer_name
|
||||
|
||||
@classmethod
|
||||
def find_session_layer(cls,
|
||||
|
||||
@@ -89,7 +89,7 @@ class VerInfo(interfaces_plugins.PluginInterface):
|
||||
def _generator(self,
|
||||
procs: typing.Generator[interfaces.objects.ObjectInterface, None, None],
|
||||
mods: typing.Generator[interfaces.context.ModuleInterface, None, None],
|
||||
moddump_plugin: moddump.ModDump):
|
||||
session_layers: typing.Generator[str, None, None]):
|
||||
"""Generates a list of PE file version info for processes, dlls, and modules.
|
||||
|
||||
Args:
|
||||
@@ -103,16 +103,13 @@ class VerInfo(interfaces_plugins.PluginInterface):
|
||||
"windows",
|
||||
"pe")
|
||||
|
||||
# populate the session layers for kernel modules
|
||||
session_layers = moddump_plugin.get_session_layers()
|
||||
|
||||
for mod in mods:
|
||||
try:
|
||||
BaseDllName = mod.BaseDllName.get_string()
|
||||
except exceptions.InvalidAddressException:
|
||||
BaseDllName = renderers.UnreadableValue()
|
||||
|
||||
session_layer_name = moddump_plugin.find_session_layer(session_layers, mod.DllBase)
|
||||
session_layer_name = moddump.ModDump.find_session_layer(self.context, session_layers, mod.DllBase)
|
||||
if session_layer_name is None:
|
||||
file_version = renderers.UnreadableValue()
|
||||
product_version = renderers.UnreadableValue()
|
||||
@@ -183,7 +180,10 @@ class VerInfo(interfaces_plugins.PluginInterface):
|
||||
self.config["primary"],
|
||||
self.config["nt_symbols"])
|
||||
|
||||
moddump_plugin = moddump.ModDump(self.context, self.config_path)
|
||||
# populate the session layers for kernel modules
|
||||
session_layers = moddump.ModDump.get_session_layers(self.context,
|
||||
self.config['primary'],
|
||||
self.config['nt_symbols'])
|
||||
|
||||
return renderers.TreeGrid([("PID", int),
|
||||
("Process", str),
|
||||
@@ -191,4 +191,4 @@ class VerInfo(interfaces_plugins.PluginInterface):
|
||||
("Name", str),
|
||||
("File", str),
|
||||
("Product", str)],
|
||||
self._generator(procs, mods, moddump_plugin))
|
||||
self._generator(procs, mods, session_layers))
|
||||
|
||||
Reference in New Issue
Block a user