WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-31 20:29:46 +02:00
Code Issues Packages Projects Releases Wiki Activity

Tidy up the requirements and fudge the code to use only the virtual address space for now.

Browse Source
This commit is contained in:
Mike Auty
2016-01-16 22:02:20 +00:00
parent 211bbbe5f6
commit f197b43346
1 changed files with 20 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/plugins/windows/pslist.py
+20 -18
View File
@@ -1,26 +1,24 @@
import volatility.framework.configuration.requirements
import volatility.framework.interfaces.plugins as plugins
from volatility.framework import configuration
from volatility.framework.configuration import requirements
class PsList(plugins.PluginInterface):
@classmethod
def get_schema(cls):
return [volatility.framework.configuration.requirements.TranslationLayerRequirement(name = 'primary',
description = 'Kernel Address Space',
constraints = {"type": "memory",
"architecture": ["ia32", "pae"]}),
volatility.framework.configuration.requirements.SymbolRequirement(name = "ntkrnlmp",
description = "Windows OS",
constraints = {"type": "symbols",
"os": "windows",
"architecture": ["ia32", "pae"]}),
volatility.framework.configuration.requirements.IntRequirement(name = 'pid',
description = "Process ID",
optional = True),
volatility.framework.configuration.requirements.IntRequirement(name = 'offset',
description = 'Address of any process',
default = 0x192ad18)]
return [requirements.TranslationLayerRequirement(name = 'primary',
description = 'Kernel Address Space',
constraints = {"type": "memory",
"architecture": ["ia32", "pae"]}),
requirements.SymbolRequirement(name = "ntkrnlmp",
description = "Windows OS",
constraints = {"type": "symbols",
"os": "windows",
"architecture": ["ia32", "pae"]}),
requirements.IntRequirement(name = 'pid',
description = "Process ID",
optional = True),
requirements.IntRequirement(name = 'offset',
description = 'Virtual address of any process')]
@staticmethod
def kernel_process_from_physical_process(ctx, physical_layer, kernel_layer, offset):
@@ -35,7 +33,11 @@ class PsList(plugins.PluginInterface):
return ethread.owning_process()
def run(self):
eproc = self.kernel_process_from_physical_process(self.context, 'physical', 'intel',
# Use the primary twice until we figure out how to specify base layers of a particular translation layer
eproc = self.kernel_process_from_physical_process(self.context,
self.config['primary'],
self.config['primary'],
self.config['offset'])
for proc in eproc.ActiveProcessLinks:
print(proc.UniqueProcessId)