mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-12 20:57:39 +02:00
Refactor SymbolRequirement to SymbolTableRequirement for clarity.
This commit is contained in:
@@ -43,7 +43,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
|
||||
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols")
|
||||
]
|
||||
|
||||
def _generator(self, tasks):
|
||||
|
||||
@@ -41,7 +41,7 @@ class Check_afinfo(plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
|
||||
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols")
|
||||
]
|
||||
|
||||
# returns whether the symbol is found within the kernel (system.map) or not
|
||||
@@ -80,11 +80,8 @@ class Check_afinfo(plugins.PluginInterface):
|
||||
def _generator(self):
|
||||
linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary'])
|
||||
|
||||
vmlinux = contexts.Module(self.context,
|
||||
self.config['vmlinux'],
|
||||
self.config['primary'],
|
||||
0,
|
||||
absolute_symbol_addresses = True)
|
||||
vmlinux = contexts.Module(
|
||||
self.context, self.config['vmlinux'], self.config['primary'], 0, absolute_symbol_addresses = True)
|
||||
|
||||
op_members = vmlinux.get_type('file_operations').members
|
||||
seq_members = vmlinux.get_type('seq_operations').members
|
||||
|
||||
@@ -48,7 +48,7 @@ class Check_syscall(plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
|
||||
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols")
|
||||
]
|
||||
|
||||
def _get_table_size_next_symbol(self, table_addr, ptr_sz, vmlinux):
|
||||
@@ -145,11 +145,8 @@ class Check_syscall(plugins.PluginInterface):
|
||||
def _generator(self):
|
||||
linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary'])
|
||||
|
||||
vmlinux = contexts.Module(self.context,
|
||||
self.config['vmlinux'],
|
||||
self.config['primary'],
|
||||
0,
|
||||
absolute_symbol_addresses = True)
|
||||
vmlinux = contexts.Module(
|
||||
self.context, self.config['vmlinux'], self.config['primary'], 0, absolute_symbol_addresses = True)
|
||||
|
||||
ptr_sz = vmlinux.get_type("pointer").size
|
||||
if ptr_sz == 4:
|
||||
|
||||
@@ -39,7 +39,7 @@ class Elfs(plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
|
||||
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols")
|
||||
]
|
||||
|
||||
def _generator(self, tasks):
|
||||
|
||||
@@ -40,7 +40,7 @@ class Lsmod(plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
|
||||
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols")
|
||||
]
|
||||
|
||||
@classmethod
|
||||
@@ -48,12 +48,8 @@ class Lsmod(plugins.PluginInterface):
|
||||
"""Lists all the modules in the primary layer"""
|
||||
linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name)
|
||||
|
||||
vmlinux = contexts.Module(context,
|
||||
vmlinux_symbols,
|
||||
layer_name,
|
||||
0,
|
||||
absolute_symbol_addresses = True)
|
||||
|
||||
vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0, absolute_symbol_addresses = True)
|
||||
|
||||
modules = vmlinux.object(symbol_name = "modules").cast("list_head")
|
||||
|
||||
table_name = modules.vol.type_name.split(constants.BANG)[0]
|
||||
|
||||
@@ -41,7 +41,7 @@ class Lsof(plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
|
||||
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols")
|
||||
]
|
||||
|
||||
def _generator(self, tasks):
|
||||
|
||||
@@ -38,7 +38,7 @@ class Malfind(interfaces_plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
|
||||
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols")
|
||||
]
|
||||
|
||||
def _list_injections(self, task):
|
||||
|
||||
@@ -38,7 +38,7 @@ class Maps(plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
|
||||
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols")
|
||||
]
|
||||
|
||||
def _generator(self, tasks):
|
||||
|
||||
@@ -35,7 +35,7 @@ class PsList(interfaces_plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
|
||||
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols")
|
||||
]
|
||||
|
||||
@classmethod
|
||||
@@ -74,12 +74,8 @@ class PsList(interfaces_plugins.PluginInterface):
|
||||
"""Lists all the tasks in the primary layer"""
|
||||
linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name)
|
||||
|
||||
vmlinux = contexts.Module(context,
|
||||
vmlinux_symbols,
|
||||
layer_name,
|
||||
0,
|
||||
absolute_symbol_addresses = True)
|
||||
|
||||
vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0, absolute_symbol_addresses = True)
|
||||
|
||||
init_task = vmlinux.object(symbol_name = "init_task")
|
||||
|
||||
for task in init_task.tasks:
|
||||
|
||||
@@ -43,7 +43,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols")
|
||||
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols")
|
||||
]
|
||||
|
||||
def _generator(self, tasks):
|
||||
|
||||
@@ -10,6 +10,7 @@ from volatility.framework.renderers import format_hints
|
||||
|
||||
vollog = logging.getLogger(__name__)
|
||||
|
||||
|
||||
class Check_syscall(plugins.PluginInterface):
|
||||
"""Check system call table for hooks"""
|
||||
|
||||
@@ -18,16 +19,14 @@ class Check_syscall(plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols")]
|
||||
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols")
|
||||
]
|
||||
|
||||
def _generator(self):
|
||||
mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
|
||||
|
||||
kernel = contexts.Module(self._context,
|
||||
self.config['darwin'],
|
||||
self.config['primary'],
|
||||
0,
|
||||
absolute_symbol_addresses = True)
|
||||
kernel = contexts.Module(
|
||||
self._context, self.config['darwin'], self.config['primary'], 0, absolute_symbol_addresses = True)
|
||||
|
||||
nsysent = kernel.object(symbol_name = "nsysent")
|
||||
table = kernel.object(symbol_name = "sysent")
|
||||
|
||||
@@ -37,7 +37,7 @@ class Lsmod(plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "darwin", description = "Linux kernel symbols")
|
||||
requirements.SymbolTableRequirement(name = "darwin", description = "Linux kernel symbols")
|
||||
]
|
||||
|
||||
@classmethod
|
||||
@@ -45,11 +45,7 @@ class Lsmod(plugins.PluginInterface):
|
||||
"""Lists all the modules in the primary layer"""
|
||||
mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name)
|
||||
|
||||
kernel = contexts.Module(context,
|
||||
darwin_symbols,
|
||||
layer_name,
|
||||
0,
|
||||
absolute_symbol_addresses = True)
|
||||
kernel = contexts.Module(context, darwin_symbols, layer_name, 0, absolute_symbol_addresses = True)
|
||||
|
||||
kmod_ptr = kernel.object(symbol_name = "kmod")
|
||||
|
||||
|
||||
@@ -36,7 +36,7 @@ class Malfind(interfaces_plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "darwin", description = "Linux kernel symbols")
|
||||
requirements.SymbolTableRequirement(name = "darwin", description = "Linux kernel symbols")
|
||||
]
|
||||
|
||||
def _list_injections(self, task):
|
||||
|
||||
@@ -35,7 +35,7 @@ class Psaux(plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols")
|
||||
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols")
|
||||
]
|
||||
|
||||
def _generator(self, tasks: Iterator[Any]) -> Generator[Tuple[int, Tuple[int, str, int, str]], None, None]:
|
||||
|
||||
@@ -38,7 +38,7 @@ class PsList(interfaces_plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols")
|
||||
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols")
|
||||
]
|
||||
|
||||
@classmethod
|
||||
@@ -80,12 +80,8 @@ class PsList(interfaces_plugins.PluginInterface):
|
||||
"""Lists all the tasks in the primary layer"""
|
||||
|
||||
mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name)
|
||||
|
||||
kernel = contexts.Module(context,
|
||||
darwin_symbols,
|
||||
layer_name,
|
||||
0,
|
||||
absolute_symbol_addresses = True)
|
||||
|
||||
kernel = contexts.Module(context, darwin_symbols, layer_name, 0, absolute_symbol_addresses = True)
|
||||
|
||||
proc = kernel.object(symbol_name = "allproc").lh_first
|
||||
|
||||
|
||||
@@ -39,7 +39,7 @@ class PsTree(plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols")
|
||||
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols")
|
||||
]
|
||||
|
||||
def _find_level(self, pid):
|
||||
|
||||
@@ -41,17 +41,14 @@ class Check_syscall(plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols")
|
||||
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols")
|
||||
]
|
||||
|
||||
def _generator(self, mods: Iterator[Any]):
|
||||
mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
|
||||
|
||||
kernel = contexts.Module(self._context,
|
||||
self.config['darwin'],
|
||||
self.config['primary'],
|
||||
0,
|
||||
absolute_symbol_addresses = True)
|
||||
kernel = contexts.Module(
|
||||
self._context, self.config['darwin'], self.config['primary'], 0, absolute_symbol_addresses = True)
|
||||
|
||||
policy_list = kernel.object(symbol_name = "_mac_policy_list").cast("mac_policy_list")
|
||||
|
||||
|
||||
@@ -36,7 +36,7 @@ class CmdLine(interfaces_plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
]
|
||||
|
||||
def _generator(self, procs):
|
||||
|
||||
@@ -44,7 +44,7 @@ class DllDump(interfaces_plugins.PluginInterface):
|
||||
return [requirements.TranslationLayerRequirement(name = 'primary',
|
||||
description = 'Memory layer for the kernel',
|
||||
architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
# TODO: Convert this to a ListRequirement so that people can filter on sets of ranges
|
||||
requirements.IntRequirement(name = 'address',
|
||||
description = "Process virtual memory address to include " \
|
||||
|
||||
@@ -36,7 +36,7 @@ class DllList(interfaces_plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
]
|
||||
|
||||
def _generator(self, procs):
|
||||
|
||||
@@ -55,7 +55,7 @@ class Handles(interfaces_plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
]
|
||||
|
||||
def _decode_pointer(self, value, magic):
|
||||
|
||||
@@ -37,7 +37,7 @@ class Info(plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
]
|
||||
|
||||
def get_depends(self, layer_name: str, index: int = 0):
|
||||
|
||||
@@ -36,7 +36,7 @@ class Malfind(interfaces.plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
]
|
||||
|
||||
@classmethod
|
||||
|
||||
@@ -44,7 +44,7 @@ class ModDump(interfaces_plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
]
|
||||
|
||||
@classmethod
|
||||
|
||||
@@ -35,7 +35,7 @@ class Modules(interfaces.plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
]
|
||||
|
||||
def _generator(self):
|
||||
|
||||
@@ -79,7 +79,7 @@ class PoolScanner(plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
]
|
||||
|
||||
@staticmethod
|
||||
|
||||
@@ -43,7 +43,7 @@ class ProcDump(interfaces_plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
]
|
||||
|
||||
def _generator(self, procs):
|
||||
|
||||
@@ -38,7 +38,7 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
# TODO: Convert this to a ListRequirement so that people can filter on sets of pids
|
||||
requirements.IntRequirement(
|
||||
name = 'pid', description = "Process ID to include (all other processes are excluded)",
|
||||
|
||||
@@ -34,7 +34,7 @@ class HiveList(plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
requirements.StringRequirement(
|
||||
name = 'filter', description = "String to filter hive names returned", optional = True, default = None)
|
||||
]
|
||||
|
||||
@@ -39,7 +39,7 @@ class PrintKey(interfaces.plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
requirements.IntRequirement(name = 'offset', description = "Hive Offset", default = None, optional = True),
|
||||
requirements.StringRequirement(
|
||||
name = 'key', description = "Key to start from", default = None, optional = True),
|
||||
|
||||
@@ -52,7 +52,7 @@ class UserAssist(interfaces.plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
requirements.IntRequirement(name = 'offset', description = "Hive Offset", default = None, optional = True)
|
||||
]
|
||||
|
||||
|
||||
@@ -40,7 +40,7 @@ class SSDT(plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
|
||||
]
|
||||
|
||||
def _generator(self, mods: Iterator[Any]) -> Iterator[Tuple[int, Tuple[int, int, Any, Any]]]:
|
||||
|
||||
@@ -38,7 +38,7 @@ class Strings(interfaces.plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
requirements.URIRequirement(name = "strings_file", description = "Strings file")
|
||||
]
|
||||
# TODO: Make URLRequirement that can accept a file address which the framework can open
|
||||
|
||||
@@ -41,7 +41,7 @@ class VadDump(interfaces_plugins.PluginInterface):
|
||||
return [requirements.TranslationLayerRequirement(name = 'primary',
|
||||
description = 'Memory layer for the kernel',
|
||||
architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
# TODO: Convert this to a ListRequirement so that people can filter on sets of ranges
|
||||
requirements.IntRequirement(name = 'address',
|
||||
description = "Process virtual memory address to include " \
|
||||
|
||||
@@ -60,7 +60,7 @@ class VadInfo(interfaces.plugins.PluginInterface):
|
||||
return [requirements.TranslationLayerRequirement(name = 'primary',
|
||||
description = 'Memory layer for the kernel',
|
||||
architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
# TODO: Convert this to a ListRequirement so that people can filter on sets of ranges
|
||||
requirements.IntRequirement(name = 'address',
|
||||
description = "Process virtual memory address to include " \
|
||||
|
||||
@@ -43,7 +43,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = "Memory layer for the kernel", architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
requirements.BooleanRequirement(
|
||||
name = "wide", description = "Match wide (unicode) strings", default = False, optional = True),
|
||||
requirements.StringRequirement(
|
||||
|
||||
@@ -50,7 +50,7 @@ class VerInfo(interfaces_plugins.PluginInterface):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
|
||||
]
|
||||
|
||||
@classmethod
|
||||
|
||||
Reference in New Issue
Block a user