WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-23 01:54:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

Refactor SymbolRequirement to SymbolTableRequirement for clarity.

Browse Source
This commit is contained in:
Mike Auty
2019-02-06 21:26:32 +00:00
parent d23e6474ce
commit f898dca296
44 changed files with 67 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/cmdline.py
+1 -1
View File
@@ -36,7 +36,7 @@ class CmdLine(interfaces_plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
]
def _generator(self, procs):
volatility/framework/plugins/windows/dlldump.py
+1 -1
View File
@@ -44,7 +44,7 @@ class DllDump(interfaces_plugins.PluginInterface):
return [requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
# TODO: Convert this to a ListRequirement so that people can filter on sets of ranges
requirements.IntRequirement(name = 'address',
description = "Process virtual memory address to include " \
volatility/framework/plugins/windows/dlllist.py
+1 -1
View File
@@ -36,7 +36,7 @@ class DllList(interfaces_plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
]
def _generator(self, procs):
volatility/framework/plugins/windows/handles.py
+1 -1
View File
@@ -55,7 +55,7 @@ class Handles(interfaces_plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
]
def _decode_pointer(self, value, magic):
volatility/framework/plugins/windows/info.py
+1 -1
View File
@@ -37,7 +37,7 @@ class Info(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
]
def get_depends(self, layer_name: str, index: int = 0):
volatility/framework/plugins/windows/malfind.py
+1 -1
View File
@@ -36,7 +36,7 @@ class Malfind(interfaces.plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
]
@classmethod
volatility/framework/plugins/windows/moddump.py
+1 -1
View File
@@ -44,7 +44,7 @@ class ModDump(interfaces_plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
]
@classmethod
volatility/framework/plugins/windows/modules.py
+1 -1
View File
@@ -35,7 +35,7 @@ class Modules(interfaces.plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
]
def _generator(self):
volatility/framework/plugins/windows/poolscanner.py
+1 -1
View File
@@ -79,7 +79,7 @@ class PoolScanner(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
]
@staticmethod
volatility/framework/plugins/windows/procdump.py
+1 -1
View File
@@ -43,7 +43,7 @@ class ProcDump(interfaces_plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
]
def _generator(self, procs):
volatility/framework/plugins/windows/pslist.py
+1 -1
View File
@@ -38,7 +38,7 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
# TODO: Convert this to a ListRequirement so that people can filter on sets of pids
requirements.IntRequirement(
name = 'pid', description = "Process ID to include (all other processes are excluded)",
volatility/framework/plugins/windows/registry/hivelist.py
+1 -1
View File
@@ -34,7 +34,7 @@ class HiveList(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.StringRequirement(
name = 'filter', description = "String to filter hive names returned", optional = True, default = None)
]
volatility/framework/plugins/windows/registry/printkey.py
+1 -1
View File
@@ -39,7 +39,7 @@ class PrintKey(interfaces.plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.IntRequirement(name = 'offset', description = "Hive Offset", default = None, optional = True),
requirements.StringRequirement(
name = 'key', description = "Key to start from", default = None, optional = True),
volatility/framework/plugins/windows/registry/userassist.py
+1 -1
View File
@@ -52,7 +52,7 @@ class UserAssist(interfaces.plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.IntRequirement(name = 'offset', description = "Hive Offset", default = None, optional = True)
]
volatility/framework/plugins/windows/ssdt.py
+1 -1
View File
@@ -40,7 +40,7 @@ class SSDT(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
]
def _generator(self, mods: Iterator[Any]) -> Iterator[Tuple[int, Tuple[int, int, Any, Any]]]:
volatility/framework/plugins/windows/strings.py
+1 -1
View File
@@ -38,7 +38,7 @@ class Strings(interfaces.plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.URIRequirement(name = "strings_file", description = "Strings file")
]
# TODO: Make URLRequirement that can accept a file address which the framework can open
volatility/framework/plugins/windows/vaddump.py
+1 -1
View File
@@ -41,7 +41,7 @@ class VadDump(interfaces_plugins.PluginInterface):
return [requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
# TODO: Convert this to a ListRequirement so that people can filter on sets of ranges
requirements.IntRequirement(name = 'address',
description = "Process virtual memory address to include " \
volatility/framework/plugins/windows/vadinfo.py
+1 -1
View File
@@ -60,7 +60,7 @@ class VadInfo(interfaces.plugins.PluginInterface):
return [requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
# TODO: Convert this to a ListRequirement so that people can filter on sets of ranges
requirements.IntRequirement(name = 'address',
description = "Process virtual memory address to include " \
volatility/framework/plugins/windows/vadyarascan.py
+1 -1
View File
@@ -43,7 +43,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = "Memory layer for the kernel", architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.BooleanRequirement(
name = "wide", description = "Match wide (unicode) strings", default = False, optional = True),
requirements.StringRequirement(
volatility/framework/plugins/windows/verinfo.py
+1 -1
View File
@@ -50,7 +50,7 @@ class VerInfo(interfaces_plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
]
@classmethod