WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-27 03:54:49 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add hex dump column if full data option

Browse Source
This commit is contained in:
Donghyun Kim
2022-03-18 01:07:59 +09:00
parent 02394f89a8
commit ed1a19d1ac
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/mbrscan.py
+5 -3
View File
@@ -28,7 +28,7 @@ class MBRScan(interfaces.plugins.PluginInterface):
requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel',
architectures = ["Intel32", "Intel64"]),
requirements.BooleanRequirement(name = 'full',
description ="It analyzes and provides all the information in the partition entry. (It returns a lot of information, so we recommend you render it in CSV.)",
description ="It analyzes and provides all the information in the partition entry and bootcode hexdump. (It returns a lot of information, so we recommend you render it in CSV.)",
default = False,
optional = True)
]
@@ -152,7 +152,8 @@ class MBRScan(interfaces.plugins.PluginInterface):
partition_table.FourthEntry.get_ending_chs(),
partition_table.FourthEntry.get_ending_sector(),
format_hints.Hex(partition_table.FourthEntry.get_size_in_sectors()),
interfaces.renderers.Disassembly(bootcode, 0, architecture)
interfaces.renderers.Disassembly(bootcode, 0, architecture),
format_hints.HexBytes(bootcode)
))
else:
vollog.log(constants.LOGLEVEL_VV, f"Not a valid MBR: Data all zeroed out : {format_hints.Hex(offset)}")
@@ -235,5 +236,6 @@ class MBRScan(interfaces.plugins.PluginInterface):
("PartDEndingCHS", int),
("PartDEndingSector", int),
("PartDSectorInSize", format_hints.Hex),
("Disasm", interfaces.renderers.Disassembly)
("Disasm", interfaces.renderers.Disassembly),
("Bootcode", format_hints.HexBytes)
], self._generator())