WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-30 19:59:46 +02:00
Code Issues Packages Projects Releases Wiki Activity

Plugins: changed class name due to incorrect resolution

Browse Source
This commit is contained in:
SolitudePy
2025-06-07 18:09:26 +03:00
parent 66473ac644
commit f97bc920bb
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/malware/unhooked_system_calls.py
+3 -3
View File
@@ -18,7 +18,7 @@ from volatility3.plugins.windows import pslist, pe_symbols
vollog = logging.getLogger(__name__)
class unhooked_system_calls(interfaces.plugins.PluginInterface):
class UnhookedSystemCalls(interfaces.plugins.PluginInterface):
"""Detects hooked ntdll.dll stub functions in Windows processes."""
_required_framework_version = (2, 4, 0)
@@ -114,7 +114,7 @@ class unhooked_system_calls(interfaces.plugins.PluginInterface):
in different processes.
This very effectively detects code injection.
"""
code_bytes: unhooked_system_calls._code_bytes_type = {}
code_bytes: UnhookedSystemCalls._code_bytes_type = {}
procs = pslist.PsList.list_processes(self.context, kernel_module_name)
@@ -154,7 +154,7 @@ class unhooked_system_calls(interfaces.plugins.PluginInterface):
context=self.context,
config_path=self.config_path,
kernel_module_name=self.config["kernel"],
symbols=unhooked_system_calls.system_calls,
symbols=UnhookedSystemCalls.system_calls,
)
# code_bytes[dll_name][func_name][func_bytes]
volatility3/framework/plugins/windows/unhooked_system_calls.py
+2 -2
View File
@@ -8,10 +8,10 @@ from volatility3.plugins.windows.malware import unhooked_system_calls
vollog = logging.getLogger(__name__)
class unhooked_system_calls(
class UnhookedSystemCalls(
interfaces.plugins.PluginInterface,
deprecation.PluginRenameClass,
replacement_class=unhooked_system_calls.unhooked_system_calls,
replacement_class=unhooked_system_calls.UnhookedSystemCalls,
removal_date="2026-06-07",
):
"""Detects hooked ntdll.dll stub functions in Windows processes (deprecated)."""