From d2daa1256403d68f5355859ba5d5923fe9a79676 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 3 Jan 2020 22:12:04 +0000 Subject: [PATCH] Malfind: Rename the layer_name parameter to be more descripttive --- volatility/framework/plugins/windows/malfind.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/volatility/framework/plugins/windows/malfind.py b/volatility/framework/plugins/windows/malfind.py index 360342648..b3fcd44ee 100644 --- a/volatility/framework/plugins/windows/malfind.py +++ b/volatility/framework/plugins/windows/malfind.py @@ -62,7 +62,7 @@ class Malfind(interfaces.plugins.PluginInterface): return True @classmethod - def list_injections(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str, + def list_injections(cls, context: interfaces.context.ContextInterface, kernel_layer_name: str, symbol_table: str, proc: interfaces.objects.ObjectInterface ) -> Iterable[Tuple[interfaces.objects.ObjectInterface, bytes]]: """Generate memory regions for a process that may contain injected @@ -70,6 +70,7 @@ class Malfind(interfaces.plugins.PluginInterface): Args: context: The context to retrieve required elements (layers, symbol tables) from + kernel_layer_name: The name of the kernel layer from which to read the VAD protections symbol_table: The name of the table containing the kernel symbols proc: an _EPROCESS instance @@ -89,7 +90,7 @@ class Malfind(interfaces.plugins.PluginInterface): for vad in proc.get_vad_root().traverse(): protection_string = vad.get_protection( - vadinfo.VadInfo.protect_values(context, layer_name, symbol_table), vadinfo.winnt_protections) + vadinfo.VadInfo.protect_values(context, kernel_layer_name, symbol_table), vadinfo.winnt_protections) write_exec = "EXECUTE" in protection_string and "WRITE" in protection_string # the write/exec check applies to everything