mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-08 02:37:39 +02:00
Convert merged changes from helper_ properties to get_ methods.
This commit is contained in:
@@ -1,14 +1,14 @@
|
||||
import collections.abc
|
||||
import typing
|
||||
import logging
|
||||
import datetime
|
||||
import logging
|
||||
import typing
|
||||
|
||||
from volatility.framework import constants, objects, interfaces
|
||||
from volatility.framework import exceptions
|
||||
from volatility.framework import constants, exceptions, interfaces, objects
|
||||
from volatility.framework.symbols import generic
|
||||
|
||||
vollog = logging.getLogger(__name__)
|
||||
|
||||
|
||||
# Keep these in a basic module, to prevent import cycles when symbol providers require them
|
||||
|
||||
class _EX_FAST_REF(objects.Struct):
|
||||
@@ -173,24 +173,23 @@ class _EPROCESS(generic.GenericIntelProcess):
|
||||
"{}{}_LDR_DATA_TABLE_ENTRY".format(sym_table, constants.BANG), "InLoadOrderLinks"):
|
||||
yield entry
|
||||
|
||||
@property
|
||||
def helper_handle_count(self):
|
||||
def get_handle_count(self):
|
||||
try:
|
||||
if hasattr(self, "ObjectTable"):
|
||||
if hasattr(self.ObjectTable, "HandleCount"):
|
||||
return self.ObjectTable.HandleCount
|
||||
|
||||
except exceptions.PagedInvalidAddressException:
|
||||
vollog.log(constants.LOGLEVEL_VVV, "Cannot access _EPROCESS.ObjectTable.HandleCount at {0:#x}".format(self.vol.offset))
|
||||
vollog.log(constants.LOGLEVEL_VVV,
|
||||
"Cannot access _EPROCESS.ObjectTable.HandleCount at {0:#x}".format(self.vol.offset))
|
||||
|
||||
return -1 # TODO: followup after decision around returning None
|
||||
return -1 # TODO: followup after decision around returning None
|
||||
|
||||
@property
|
||||
def helper_session_id(self):
|
||||
def get_session_id(self):
|
||||
try:
|
||||
if hasattr(self, "Session"):
|
||||
if self.Session == 0:
|
||||
return -1 # TODO: followup after decision around returning None
|
||||
return -1 # TODO: followup after decision around returning None
|
||||
|
||||
layer_name = self.vol.layer_name
|
||||
symbol_table_name = self.get_symbol_table().name
|
||||
@@ -202,28 +201,26 @@ class _EPROCESS(generic.GenericIntelProcess):
|
||||
return session.SessionId
|
||||
|
||||
except exceptions.PagedInvalidAddressException:
|
||||
vollog.log(constants.LOGLEVEL_VVV, "Cannot access _EPROCESS.Session.SessionId at {0:#x}".format(self.vol.offset))
|
||||
vollog.log(constants.LOGLEVEL_VVV,
|
||||
"Cannot access _EPROCESS.Session.SessionId at {0:#x}".format(self.vol.offset))
|
||||
|
||||
return -1 # TODO: followup after decision around returning None
|
||||
return -1 # TODO: followup after decision around returning None
|
||||
|
||||
@property
|
||||
def helper_create_time(self):
|
||||
def get_create_time(self):
|
||||
unix_time = self.CreateTime.QuadPart // 10000000
|
||||
if unix_time == 0:
|
||||
return "" # TODO: followup after decision around returning None
|
||||
return "" # TODO: followup after decision around returning None
|
||||
unix_time = unix_time - 11644473600
|
||||
return str(datetime.datetime.utcfromtimestamp(unix_time))
|
||||
|
||||
@property
|
||||
def helper_exit_time(self):
|
||||
def get_exit_time(self):
|
||||
unix_time = self.ExitTime.QuadPart // 10000000
|
||||
if unix_time == 0:
|
||||
return "" # TODO: followup after decision around returning None
|
||||
return "" # TODO: followup after decision around returning None
|
||||
unix_time = unix_time - 11644473600
|
||||
return str(datetime.datetime.utcfromtimestamp(unix_time))
|
||||
|
||||
@property
|
||||
def helper_wow_64_process(self):
|
||||
def get_wow_64_process(self):
|
||||
if hasattr(self, "Wow64Process"):
|
||||
return self.Wow64Process
|
||||
|
||||
@@ -232,15 +229,15 @@ class _EPROCESS(generic.GenericIntelProcess):
|
||||
|
||||
raise AttributeError("Unable to find Wow64Process")
|
||||
|
||||
@property
|
||||
def helper_is_wow64(self):
|
||||
def get_is_wow64(self):
|
||||
try:
|
||||
value = self.helper_wow_64_process
|
||||
value = self.get_wow_64_process()
|
||||
except AttributeError:
|
||||
return False
|
||||
|
||||
|
||||
return value != 0 and value != None
|
||||
|
||||
|
||||
class _LIST_ENTRY(objects.Struct, collections.abc.Iterable):
|
||||
def to_list(self,
|
||||
symbol_type: str,
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
import volatility.framework.interfaces.plugins as plugins
|
||||
from volatility.framework import renderers
|
||||
from volatility.framework.renderers import format_hints
|
||||
from volatility.framework.configuration import requirements
|
||||
from volatility.framework.renderers import format_hints
|
||||
|
||||
|
||||
class PsList(plugins.PluginInterface):
|
||||
@@ -33,7 +33,7 @@ class PsList(plugins.PluginInterface):
|
||||
else:
|
||||
layer_name = self.config['primary']
|
||||
memory = self.context.memory[layer_name]
|
||||
(_, offset, _, _) = list(memory.mapping(offset=proc.vol.offset, length=0))[0]
|
||||
(_, offset, _, _) = list(memory.mapping(offset = proc.vol.offset, length = 0))[0]
|
||||
|
||||
yield (0, (proc.UniqueProcessId,
|
||||
proc.InheritedFromUniqueProcessId,
|
||||
@@ -42,11 +42,11 @@ class PsList(plugins.PluginInterface):
|
||||
errors = 'replace'),
|
||||
format_hints.Hex(offset),
|
||||
proc.ActiveThreads,
|
||||
proc.helper_handle_count,
|
||||
proc.helper_session_id,
|
||||
proc.helper_is_wow64,
|
||||
proc.helper_create_time,
|
||||
proc.helper_exit_time))
|
||||
proc.get_handle_count(),
|
||||
proc.get_session_id(),
|
||||
proc.get_is_wow64(),
|
||||
proc.get_create_time(),
|
||||
proc.get_exit_time()))
|
||||
|
||||
def list_processes(self):
|
||||
"""Lists all the processes in the primary layer that are in the pid config option"""
|
||||
|
||||
Reference in New Issue
Block a user