WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-22 01:24:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

Malfind: Rename the layer_name parameter to be more descripttive

Browse Source
This commit is contained in:
Mike Auty
2020-01-03 22:12:04 +00:00
parent cd841616af
commit d2daa12564
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/malfind.py
+3 -2
View File
@@ -62,7 +62,7 @@ class Malfind(interfaces.plugins.PluginInterface):
return True
@classmethod
def list_injections(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str,
def list_injections(cls, context: interfaces.context.ContextInterface, kernel_layer_name: str, symbol_table: str,
proc: interfaces.objects.ObjectInterface
) -> Iterable[Tuple[interfaces.objects.ObjectInterface, bytes]]:
"""Generate memory regions for a process that may contain injected
@@ -70,6 +70,7 @@ class Malfind(interfaces.plugins.PluginInterface):
Args:
context: The context to retrieve required elements (layers, symbol tables) from
kernel_layer_name: The name of the kernel layer from which to read the VAD protections
symbol_table: The name of the table containing the kernel symbols
proc: an _EPROCESS instance
@@ -89,7 +90,7 @@ class Malfind(interfaces.plugins.PluginInterface):
for vad in proc.get_vad_root().traverse():
protection_string = vad.get_protection(
vadinfo.VadInfo.protect_values(context, layer_name, symbol_table), vadinfo.winnt_protections)
vadinfo.VadInfo.protect_values(context, kernel_layer_name, symbol_table), vadinfo.winnt_protections)
write_exec = "EXECUTE" in protection_string and "WRITE" in protection_string
# the write/exec check applies to everything