Convert merged changes from helper_ properties to get_ methods.

This commit is contained in:
Mike Auty
2018-03-10 19:33:29 +00:00
parent ca7405413b
commit f8e87ede69
2 changed files with 29 additions and 32 deletions
@@ -1,14 +1,14 @@
import collections.abc
import typing
import logging
import datetime
import logging
import typing
from volatility.framework import constants, objects, interfaces
from volatility.framework import exceptions
from volatility.framework import constants, exceptions, interfaces, objects
from volatility.framework.symbols import generic
vollog = logging.getLogger(__name__)
# Keep these in a basic module, to prevent import cycles when symbol providers require them
class _EX_FAST_REF(objects.Struct):
@@ -173,24 +173,23 @@ class _EPROCESS(generic.GenericIntelProcess):
"{}{}_LDR_DATA_TABLE_ENTRY".format(sym_table, constants.BANG), "InLoadOrderLinks"):
yield entry
@property
def helper_handle_count(self):
def get_handle_count(self):
try:
if hasattr(self, "ObjectTable"):
if hasattr(self.ObjectTable, "HandleCount"):
return self.ObjectTable.HandleCount
except exceptions.PagedInvalidAddressException:
vollog.log(constants.LOGLEVEL_VVV, "Cannot access _EPROCESS.ObjectTable.HandleCount at {0:#x}".format(self.vol.offset))
vollog.log(constants.LOGLEVEL_VVV,
"Cannot access _EPROCESS.ObjectTable.HandleCount at {0:#x}".format(self.vol.offset))
return -1 # TODO: followup after decision around returning None
return -1 # TODO: followup after decision around returning None
@property
def helper_session_id(self):
def get_session_id(self):
try:
if hasattr(self, "Session"):
if self.Session == 0:
return -1 # TODO: followup after decision around returning None
return -1 # TODO: followup after decision around returning None
layer_name = self.vol.layer_name
symbol_table_name = self.get_symbol_table().name
@@ -202,28 +201,26 @@ class _EPROCESS(generic.GenericIntelProcess):
return session.SessionId
except exceptions.PagedInvalidAddressException:
vollog.log(constants.LOGLEVEL_VVV, "Cannot access _EPROCESS.Session.SessionId at {0:#x}".format(self.vol.offset))
vollog.log(constants.LOGLEVEL_VVV,
"Cannot access _EPROCESS.Session.SessionId at {0:#x}".format(self.vol.offset))
return -1 # TODO: followup after decision around returning None
return -1 # TODO: followup after decision around returning None
@property
def helper_create_time(self):
def get_create_time(self):
unix_time = self.CreateTime.QuadPart // 10000000
if unix_time == 0:
return "" # TODO: followup after decision around returning None
return "" # TODO: followup after decision around returning None
unix_time = unix_time - 11644473600
return str(datetime.datetime.utcfromtimestamp(unix_time))
@property
def helper_exit_time(self):
def get_exit_time(self):
unix_time = self.ExitTime.QuadPart // 10000000
if unix_time == 0:
return "" # TODO: followup after decision around returning None
return "" # TODO: followup after decision around returning None
unix_time = unix_time - 11644473600
return str(datetime.datetime.utcfromtimestamp(unix_time))
@property
def helper_wow_64_process(self):
def get_wow_64_process(self):
if hasattr(self, "Wow64Process"):
return self.Wow64Process
@@ -232,15 +229,15 @@ class _EPROCESS(generic.GenericIntelProcess):
raise AttributeError("Unable to find Wow64Process")
@property
def helper_is_wow64(self):
def get_is_wow64(self):
try:
value = self.helper_wow_64_process
value = self.get_wow_64_process()
except AttributeError:
return False
return value != 0 and value != None
class _LIST_ENTRY(objects.Struct, collections.abc.Iterable):
def to_list(self,
symbol_type: str,
+7 -7
View File
@@ -1,7 +1,7 @@
import volatility.framework.interfaces.plugins as plugins
from volatility.framework import renderers
from volatility.framework.renderers import format_hints
from volatility.framework.configuration import requirements
from volatility.framework.renderers import format_hints
class PsList(plugins.PluginInterface):
@@ -33,7 +33,7 @@ class PsList(plugins.PluginInterface):
else:
layer_name = self.config['primary']
memory = self.context.memory[layer_name]
(_, offset, _, _) = list(memory.mapping(offset=proc.vol.offset, length=0))[0]
(_, offset, _, _) = list(memory.mapping(offset = proc.vol.offset, length = 0))[0]
yield (0, (proc.UniqueProcessId,
proc.InheritedFromUniqueProcessId,
@@ -42,11 +42,11 @@ class PsList(plugins.PluginInterface):
errors = 'replace'),
format_hints.Hex(offset),
proc.ActiveThreads,
proc.helper_handle_count,
proc.helper_session_id,
proc.helper_is_wow64,
proc.helper_create_time,
proc.helper_exit_time))
proc.get_handle_count(),
proc.get_session_id(),
proc.get_is_wow64(),
proc.get_create_time(),
proc.get_exit_time()))
def list_processes(self):
"""Lists all the processes in the primary layer that are in the pid config option"""