From dc31ae1ddadf6d4dcbcf4bfd34bc0354cc16febe Mon Sep 17 00:00:00 2001 From: Paul Kermann Date: Tue, 13 Sep 2022 15:21:24 +0300 Subject: [PATCH] Added new containing address flag to vadinfo plugin --- volatility3/framework/plugins/windows/vadinfo.py | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/volatility3/framework/plugins/windows/vadinfo.py b/volatility3/framework/plugins/windows/vadinfo.py index e357b150a..3c51263b7 100644 --- a/volatility3/framework/plugins/windows/vadinfo.py +++ b/volatility3/framework/plugins/windows/vadinfo.py @@ -52,6 +52,10 @@ class VadInfo(interfaces.plugins.PluginInterface): "(all other address ranges are excluded). This must be " \ "a base address, not an address within the desired range.", optional = True), + requirements.IntRequirement(name='containing-address', + description="Process virtual memory address to include" \ + "This is a containing address in the VAD.", + optional=True), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, @@ -179,6 +183,13 @@ class VadInfo(interfaces.plugins.PluginInterface): filter_func = filter_function + if self.config.get('containing-address', None) is not None: + + def containing_filter_function(x: interfaces.objects.ObjectInterface) -> bool: + return not (x.get_start() <= self.config['containing-address'] <= x.get_end()) + + filter_func = containing_filter_function + for proc in procs: process_name = utility.array_to_string(proc.ImageFileName)