From f97bc920bbfdbded80e9140b09640298a8249481 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 18:09:26 +0300 Subject: [PATCH] Plugins: changed class name due to incorrect resolution --- .../plugins/windows/malware/unhooked_system_calls.py | 6 +++--- .../framework/plugins/windows/unhooked_system_calls.py | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/plugins/windows/malware/unhooked_system_calls.py b/volatility3/framework/plugins/windows/malware/unhooked_system_calls.py index 5723ce0fd..71dc20021 100644 --- a/volatility3/framework/plugins/windows/malware/unhooked_system_calls.py +++ b/volatility3/framework/plugins/windows/malware/unhooked_system_calls.py @@ -18,7 +18,7 @@ from volatility3.plugins.windows import pslist, pe_symbols vollog = logging.getLogger(__name__) -class unhooked_system_calls(interfaces.plugins.PluginInterface): +class UnhookedSystemCalls(interfaces.plugins.PluginInterface): """Detects hooked ntdll.dll stub functions in Windows processes.""" _required_framework_version = (2, 4, 0) @@ -114,7 +114,7 @@ class unhooked_system_calls(interfaces.plugins.PluginInterface): in different processes. This very effectively detects code injection. """ - code_bytes: unhooked_system_calls._code_bytes_type = {} + code_bytes: UnhookedSystemCalls._code_bytes_type = {} procs = pslist.PsList.list_processes(self.context, kernel_module_name) @@ -154,7 +154,7 @@ class unhooked_system_calls(interfaces.plugins.PluginInterface): context=self.context, config_path=self.config_path, kernel_module_name=self.config["kernel"], - symbols=unhooked_system_calls.system_calls, + symbols=UnhookedSystemCalls.system_calls, ) # code_bytes[dll_name][func_name][func_bytes] diff --git a/volatility3/framework/plugins/windows/unhooked_system_calls.py b/volatility3/framework/plugins/windows/unhooked_system_calls.py index 0c42415b6..e6fb2fb6c 100644 --- a/volatility3/framework/plugins/windows/unhooked_system_calls.py +++ b/volatility3/framework/plugins/windows/unhooked_system_calls.py @@ -8,10 +8,10 @@ from volatility3.plugins.windows.malware import unhooked_system_calls vollog = logging.getLogger(__name__) -class unhooked_system_calls( +class UnhookedSystemCalls( interfaces.plugins.PluginInterface, deprecation.PluginRenameClass, - replacement_class=unhooked_system_calls.unhooked_system_calls, + replacement_class=unhooked_system_calls.UnhookedSystemCalls, removal_date="2026-06-07", ): """Detects hooked ntdll.dll stub functions in Windows processes (deprecated)."""