Windows Consoles: Update hivelist dep and change method signature

This updates the windows.consoles.Consoles plugin to use the updated
hivelist method signature, changing one of its own method signatures as
required and doing a major version bump of its own.

Plugins that depend on consoles also have their method calls changed,
and their dependency versions bumped.

Co-authored-by: Andrew Case <andrew@dfir.org>
This commit is contained in:
David McDonald
2025-03-05 17:59:38 -06:00
co-authored by Andrew Case
parent d0f70f67b8
commit f06c87cb39
2 changed files with 11 additions and 13 deletions
@@ -39,7 +39,7 @@ class CmdScan(interfaces.plugins.PluginInterface):
name="pslist", component=pslist.PsList, version=(2, 0, 0)
),
requirements.PluginRequirement(
name="consoles", plugin=consoles.Consoles, version=(1, 0, 0)
name="consoles", plugin=consoles.Consoles, version=(2, 0, 0)
),
requirements.BooleanRequirement(
name="no_registry",
@@ -288,8 +288,7 @@ class CmdScan(interfaces.plugins.PluginInterface):
max_history, _ = consoles.Consoles.get_console_settings_from_registry(
self.context,
self.config_path,
kernel.layer_name,
kernel.symbol_table_name,
self.config["kernel"],
max_history,
[],
)
@@ -29,7 +29,9 @@ class Consoles(interfaces.plugins.PluginInterface):
"""Looks for Windows console buffers"""
_required_framework_version = (2, 4, 0)
_version = (1, 0, 0)
# 2.0.0 - change the signature of `get_console_settings_from_registry`
_version = (2, 0, 0)
@classmethod
def get_requirements(cls):
@@ -47,7 +49,7 @@ class Consoles(interfaces.plugins.PluginInterface):
name="verinfo", component=verinfo.VerInfo, version=(1, 0, 0)
),
requirements.PluginRequirement(
name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0)
name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0)
),
requirements.BooleanRequirement(
name="no_registry",
@@ -795,8 +797,7 @@ class Consoles(interfaces.plugins.PluginInterface):
cls,
context: interfaces.context.ContextInterface,
config_path: str,
kernel_layer_name: str,
kernel_symbol_table_name: str,
kernel_module_name: str,
max_history: Set[int],
max_buffers: Set[int],
) -> Tuple[Set[int], Set[int]]:
@@ -823,10 +824,9 @@ class Consoles(interfaces.plugins.PluginInterface):
)
for hive in hivelist.HiveList.list_hives(
context=context,
base_config_path=config_path,
layer_name=kernel_layer_name,
symbol_table=kernel_symbol_table_name,
context,
config_path,
kernel_module_name,
hive_offsets=None,
):
try:
@@ -861,8 +861,7 @@ class Consoles(interfaces.plugins.PluginInterface):
max_history, max_buffers = self.get_console_settings_from_registry(
self.context,
self.config_path,
kernel.layer_name,
kernel.symbol_table_name,
self.config["kernel"],
max_history,
max_buffers,
)