From ce63ee2e834080c7d30aea5903cd153db713378d Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 30 Aug 2018 12:02:04 +0100 Subject: [PATCH] Conver the verinfo plugin to using the classmethod moddump. --- volatility/plugins/windows/moddump.py | 8 +++----- volatility/plugins/windows/verinfo.py | 14 +++++++------- 2 files changed, 10 insertions(+), 12 deletions(-) diff --git a/volatility/plugins/windows/moddump.py b/volatility/plugins/windows/moddump.py index 78f92afd9..ae180edb8 100644 --- a/volatility/plugins/windows/moddump.py +++ b/volatility/plugins/windows/moddump.py @@ -31,7 +31,7 @@ class ModDump(interfaces_plugins.PluginInterface): context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str, - pids: typing.List[int] = None) -> typing.List[str]: + pids: typing.List[int] = None) -> typing.Generator[str, None, None]: """Build a cache of possible virtual layers, in priority starting with the primary/kernel layer. Then keep one layer per session by cycling through the process list. @@ -43,7 +43,7 @@ class ModDump(interfaces_plugins.PluginInterface): # the primary layer should be first layers = [layer_name] - seen_ids = [] + seen_ids = [] # type: typing.List[interfaces.objects.ObjectInterface] filter_func = pslist.PsList.create_filter(pids or []) for proc in pslist.PsList.list_processes(context = context, @@ -69,9 +69,7 @@ class ModDump(interfaces_plugins.PluginInterface): # save the layer if we haven't seen the session yet seen_ids.append(session_space.SessionId) - layers.append(proc_layer_name) - - return layers + yield proc_layer_name @classmethod def find_session_layer(cls, diff --git a/volatility/plugins/windows/verinfo.py b/volatility/plugins/windows/verinfo.py index 7bc43aef3..8daea60b8 100644 --- a/volatility/plugins/windows/verinfo.py +++ b/volatility/plugins/windows/verinfo.py @@ -89,7 +89,7 @@ class VerInfo(interfaces_plugins.PluginInterface): def _generator(self, procs: typing.Generator[interfaces.objects.ObjectInterface, None, None], mods: typing.Generator[interfaces.context.ModuleInterface, None, None], - moddump_plugin: moddump.ModDump): + session_layers: typing.Generator[str, None, None]): """Generates a list of PE file version info for processes, dlls, and modules. Args: @@ -103,16 +103,13 @@ class VerInfo(interfaces_plugins.PluginInterface): "windows", "pe") - # populate the session layers for kernel modules - session_layers = moddump_plugin.get_session_layers() - for mod in mods: try: BaseDllName = mod.BaseDllName.get_string() except exceptions.InvalidAddressException: BaseDllName = renderers.UnreadableValue() - session_layer_name = moddump_plugin.find_session_layer(session_layers, mod.DllBase) + session_layer_name = moddump.ModDump.find_session_layer(self.context, session_layers, mod.DllBase) if session_layer_name is None: file_version = renderers.UnreadableValue() product_version = renderers.UnreadableValue() @@ -183,7 +180,10 @@ class VerInfo(interfaces_plugins.PluginInterface): self.config["primary"], self.config["nt_symbols"]) - moddump_plugin = moddump.ModDump(self.context, self.config_path) + # populate the session layers for kernel modules + session_layers = moddump.ModDump.get_session_layers(self.context, + self.config['primary'], + self.config['nt_symbols']) return renderers.TreeGrid([("PID", int), ("Process", str), @@ -191,4 +191,4 @@ class VerInfo(interfaces_plugins.PluginInterface): ("Name", str), ("File", str), ("Product", str)], - self._generator(procs, mods, moddump_plugin)) + self._generator(procs, mods, session_layers))