From f1c5bbdfaf3417aa09fcdc0fd09a1bd8d233747e Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 29 Jul 2024 19:11:32 -0500 Subject: [PATCH] Address feedback --- .../framework/plugins/windows/pe_symbols.py | 23 +++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/volatility3/framework/plugins/windows/pe_symbols.py b/volatility3/framework/plugins/windows/pe_symbols.py index 7a3a46f85..cc193723d 100644 --- a/volatility3/framework/plugins/windows/pe_symbols.py +++ b/volatility3/framework/plugins/windows/pe_symbols.py @@ -112,6 +112,29 @@ class PESymbols(interfaces.plugins.PluginInterface): ): """ Attempts to resolve the symbols in `wanted_symbols` through export table analysis + wanted_symbols is a dictionary of lower case DLL names, whose values are a list of symbols + to resolve per-DLL. Example from apihooks: + + userland_apis = { + "wininet.dll": [ + "HttpSendRequestA", + "HttpSendRequestW", + "HttpSendRequestExA", + ... + ], + + "kernel32.dll": [ + "GetProcAddress", + "LoadLibrary", + "LoadLibraryA", + "LoadLibraryExA", + ... + ], + } + + found_symbols is populated with symbols as they are resolved. + It holds a dictionary of DLL names and its values are a list of + (function name, runtime address) of each symbol found """ pe_table_name = intermed.IntermediateSymbolTable.create( context, config_path, "windows", "pe", class_types=pe.class_types