From f06c87cb39121122c6c7a0af7fa87f9cf812a943 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 15:36:05 -0600 Subject: [PATCH] Windows Consoles: Update hivelist dep and change method signature This updates the windows.consoles.Consoles plugin to use the updated hivelist method signature, changing one of its own method signatures as required and doing a major version bump of its own. Plugins that depend on consoles also have their method calls changed, and their dependency versions bumped. Co-authored-by: Andrew Case --- .../framework/plugins/windows/cmdscan.py | 5 ++--- .../framework/plugins/windows/consoles.py | 19 +++++++++---------- 2 files changed, 11 insertions(+), 13 deletions(-) diff --git a/volatility3/framework/plugins/windows/cmdscan.py b/volatility3/framework/plugins/windows/cmdscan.py index 0cd0addb2..051ca8db0 100644 --- a/volatility3/framework/plugins/windows/cmdscan.py +++ b/volatility3/framework/plugins/windows/cmdscan.py @@ -39,7 +39,7 @@ class CmdScan(interfaces.plugins.PluginInterface): name="pslist", component=pslist.PsList, version=(2, 0, 0) ), requirements.PluginRequirement( - name="consoles", plugin=consoles.Consoles, version=(1, 0, 0) + name="consoles", plugin=consoles.Consoles, version=(2, 0, 0) ), requirements.BooleanRequirement( name="no_registry", @@ -288,8 +288,7 @@ class CmdScan(interfaces.plugins.PluginInterface): max_history, _ = consoles.Consoles.get_console_settings_from_registry( self.context, self.config_path, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], max_history, [], ) diff --git a/volatility3/framework/plugins/windows/consoles.py b/volatility3/framework/plugins/windows/consoles.py index 63bb3e9b9..99eb81e5b 100644 --- a/volatility3/framework/plugins/windows/consoles.py +++ b/volatility3/framework/plugins/windows/consoles.py @@ -29,7 +29,9 @@ class Consoles(interfaces.plugins.PluginInterface): """Looks for Windows console buffers""" _required_framework_version = (2, 4, 0) - _version = (1, 0, 0) + + # 2.0.0 - change the signature of `get_console_settings_from_registry` + _version = (2, 0, 0) @classmethod def get_requirements(cls): @@ -47,7 +49,7 @@ class Consoles(interfaces.plugins.PluginInterface): name="verinfo", component=verinfo.VerInfo, version=(1, 0, 0) ), requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0) + name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) ), requirements.BooleanRequirement( name="no_registry", @@ -795,8 +797,7 @@ class Consoles(interfaces.plugins.PluginInterface): cls, context: interfaces.context.ContextInterface, config_path: str, - kernel_layer_name: str, - kernel_symbol_table_name: str, + kernel_module_name: str, max_history: Set[int], max_buffers: Set[int], ) -> Tuple[Set[int], Set[int]]: @@ -823,10 +824,9 @@ class Consoles(interfaces.plugins.PluginInterface): ) for hive in hivelist.HiveList.list_hives( - context=context, - base_config_path=config_path, - layer_name=kernel_layer_name, - symbol_table=kernel_symbol_table_name, + context, + config_path, + kernel_module_name, hive_offsets=None, ): try: @@ -861,8 +861,7 @@ class Consoles(interfaces.plugins.PluginInterface): max_history, max_buffers = self.get_console_settings_from_registry( self.context, self.config_path, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], max_history, max_buffers, )