Conver the verinfo plugin to using the classmethod moddump.

This commit is contained in:
Mike Auty
2018-08-30 12:03:17 +01:00
committed by ikelos
parent edac0bee6f
commit ce63ee2e83
2 changed files with 10 additions and 12 deletions
+3 -5
View File
@@ -31,7 +31,7 @@ class ModDump(interfaces_plugins.PluginInterface):
context: interfaces.context.ContextInterface,
layer_name: str,
symbol_table: str,
pids: typing.List[int] = None) -> typing.List[str]:
pids: typing.List[int] = None) -> typing.Generator[str, None, None]:
"""Build a cache of possible virtual layers, in priority starting with
the primary/kernel layer. Then keep one layer per session by cycling
through the process list.
@@ -43,7 +43,7 @@ class ModDump(interfaces_plugins.PluginInterface):
# the primary layer should be first
layers = [layer_name]
seen_ids = []
seen_ids = [] # type: typing.List[interfaces.objects.ObjectInterface]
filter_func = pslist.PsList.create_filter(pids or [])
for proc in pslist.PsList.list_processes(context = context,
@@ -69,9 +69,7 @@ class ModDump(interfaces_plugins.PluginInterface):
# save the layer if we haven't seen the session yet
seen_ids.append(session_space.SessionId)
layers.append(proc_layer_name)
return layers
yield proc_layer_name
@classmethod
def find_session_layer(cls,
+7 -7
View File
@@ -89,7 +89,7 @@ class VerInfo(interfaces_plugins.PluginInterface):
def _generator(self,
procs: typing.Generator[interfaces.objects.ObjectInterface, None, None],
mods: typing.Generator[interfaces.context.ModuleInterface, None, None],
moddump_plugin: moddump.ModDump):
session_layers: typing.Generator[str, None, None]):
"""Generates a list of PE file version info for processes, dlls, and modules.
Args:
@@ -103,16 +103,13 @@ class VerInfo(interfaces_plugins.PluginInterface):
"windows",
"pe")
# populate the session layers for kernel modules
session_layers = moddump_plugin.get_session_layers()
for mod in mods:
try:
BaseDllName = mod.BaseDllName.get_string()
except exceptions.InvalidAddressException:
BaseDllName = renderers.UnreadableValue()
session_layer_name = moddump_plugin.find_session_layer(session_layers, mod.DllBase)
session_layer_name = moddump.ModDump.find_session_layer(self.context, session_layers, mod.DllBase)
if session_layer_name is None:
file_version = renderers.UnreadableValue()
product_version = renderers.UnreadableValue()
@@ -183,7 +180,10 @@ class VerInfo(interfaces_plugins.PluginInterface):
self.config["primary"],
self.config["nt_symbols"])
moddump_plugin = moddump.ModDump(self.context, self.config_path)
# populate the session layers for kernel modules
session_layers = moddump.ModDump.get_session_layers(self.context,
self.config['primary'],
self.config['nt_symbols'])
return renderers.TreeGrid([("PID", int),
("Process", str),
@@ -191,4 +191,4 @@ class VerInfo(interfaces_plugins.PluginInterface):
("Name", str),
("File", str),
("Product", str)],
self._generator(procs, mods, moddump_plugin))
self._generator(procs, mods, session_layers))