diff --git a/volatility/framework/plugins/windows/netscan.py b/volatility/framework/plugins/windows/netscan.py index 522351e70..3546e233d 100644 --- a/volatility/framework/plugins/windows/netscan.py +++ b/volatility/framework/plugins/windows/netscan.py @@ -245,6 +245,8 @@ class NetScan(interfaces.plugins.PluginInterface): self.config["nt_symbols"], self.config_path) + tcp_states = self.context.symbol_space.get_enumeration(netscan_symbol_table + constants.BANG + "TCPStateEnum") + for netw_obj in self.scan(self.context, self.config['primary'], self.config['nt_symbols'], netscan_symbol_table): @@ -277,9 +279,9 @@ class NetScan(interfaces.plugins.PluginInterface): else: proto = "TCPv?" - if netw_obj.State in network.TCP_STATE_ENUM: - state = network.TCP_STATE_ENUM[netw_obj.State] - else: + try: + state = tcp_states.lookup(netw_obj.State) + except ValueError: state = renderers.UnreadableValue() yield (0, (format_hints.Hex(netw_obj.vol.offset), proto, diff --git a/volatility/framework/symbols/windows/extensions/network.py b/volatility/framework/symbols/windows/extensions/network.py index efc12eb08..196cb1583 100644 --- a/volatility/framework/symbols/windows/extensions/network.py +++ b/volatility/framework/symbols/windows/extensions/network.py @@ -78,22 +78,6 @@ AF_INET6 = 0x17 inaddr_any = inet_ntop(socket.AF_INET, [0] * 4) inaddr6_any = inet_ntop(socket.AF_INET6, [0] * 16) -# copied to here as symbol space does not appear to support custom Enums -TCP_STATE_ENUM = { - 0: 'CLOSED', - 1: 'LISTENING', - 2: 'SYN_SENT', - 3: 'SYN_RCVD', - 4: 'ESTABLISHED', - 5: 'FIN_WAIT1', - 6: 'FIN_WAIT2', - 7: 'CLOSE_WAIT', - 8: 'CLOSING', - 9: 'LAST_ACK', - 12: 'TIME_WAIT', - 13: 'DELETE_TCB' -} - class _TCP_LISTENER(objects.StructType): """Class for objects found in TcpL pools. @@ -247,7 +231,7 @@ class _TCP_ENDPOINT(_TCP_LISTENER): def is_valid(self): - if self.State not in TCP_STATE_ENUM: + if self.State not in self.State.choices.values(): vollog.debug("invalid due to invalid tcp state {}".format(self.State)) return False