WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-17 20:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Back out the symbol_table_name parameter, and provide full symbol names in the constraints.

Browse Source
This commit is contained in:
Mike Auty
2018-12-13 01:16:05 +00:00
committed by ikelos
parent eacc45dab6
commit fa033b8ab7
2 changed files with 11 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/symbols/windows/extensions/__init__.py
+5 -3
View File
@@ -23,8 +23,7 @@ class _POOL_HEADER(objects.Struct):
type_map: dict,
native_layer_name: typing.Optional[str] = None,
object_type: typing.Optional[str] = None,
cookie: typing.Optional[int] = None,
symbol_table_name: typing.Optional[str] = None) \
cookie: typing.Optional[int] = None) \
-> typing.Optional[interfaces.objects.ObjectInterface]:
"""Carve an object or data structure from a kernel pool allocation.
@@ -34,7 +33,10 @@ class _POOL_HEADER(objects.Struct):
:return:
"""
symbol_table_name = symbol_table_name or self.vol.type_name.split(constants.BANG)[0]
symbol_table_name = self.vol.type_name.split(constants.BANG)[0]
if constants.BANG in type_name:
symbol_table_name, type_name = type_name.split(constants.BANG)[0:2]
pool_header_size = self.vol.size
# if there is no object type, then just instantiate a structure
volatility/plugins/windows/poolscanner.py
+6 -7
View File
@@ -63,30 +63,30 @@ class PoolScanner(plugins.PluginInterface):
constraints = [
# atom tables
PoolConstraint(b'AtmT',
type_name = "_RTL_ATOM_TABLE",
type_name = self.config["nt_symbols"] + constants.BANG + "_RTL_ATOM_TABLE",
size = (200, None),
page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE),
# processes on windows before windows 8
PoolConstraint(b'Pro\xe3',
type_name = "_EPROCESS",
type_name = self.config["nt_symbols"] + constants.BANG + "_EPROCESS",
object_type = "Process",
size = (600, None),
page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE),
# processes on windows starting with windows 8
PoolConstraint(b'Proc',
type_name = "_EPROCESS",
type_name = self.config["nt_symbols"] + constants.BANG + "_EPROCESS",
object_type = "Process",
size = (600, None),
page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE),
# files on windows before windows 8
PoolConstraint(b'Fil\xe5',
type_name = "_FILE_OBJECT",
type_name = self.config["nt_symbols"] + constants.BANG + "_FILE_OBJECT",
object_type = "File",
size = (150, None),
page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE),
# files on windows starting with windows 8
PoolConstraint(b'File',
type_name = "_FILE_OBJECT",
type_name = self.config["nt_symbols"] + constants.BANG + "_FILE_OBJECT",
object_type = "File",
size = (150, None),
page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE),
@@ -122,8 +122,7 @@ class PoolScanner(plugins.PluginInterface):
type_map = type_map,
object_type = constraint.object_type,
native_layer_name = 'primary',
cookie = cookie,
symbol_table_name = self.config['nt_symbols'])
cookie = cookie)
if mem_object is None:
vollog.log(constants.LOGLEVEL_VVV, "Cannot create an instance of {}".format(constraint.type_name))