WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-13 05:07:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add: Peb.ProcessParameters.ImagePathName

Browse Source
This commit is contained in:
Donghyun Kim
2022-08-09 15:04:24 +09:00
parent 7bec33b07d
commit fa686a9fa6
1 changed files with 2 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/joblinks.py
+2 -13
View File
@@ -55,24 +55,13 @@ class JobLinks(interfaces.plugins.PluginInterface):
"(Original Process)"
))
vollog.log(LOGLEVEL_VVVV, proc.JobLinks)
vollog.log(LOGLEVEL_VVVV, hex(proc.JobLinks.Flink))
vollog.log(LOGLEVEL_VVVV, hex(proc.JobLinks.Blink))
vollog.log(LOGLEVEL_VVVV, job.JobLinks)
vollog.log(LOGLEVEL_VVVV, hex(job.JobLinks.Flink))
vollog.log(LOGLEVEL_VVVV, hex(job.JobLinks.Blink))
vollog.log(LOGLEVEL_VVVV, job.ProcessListHead)
vollog.log(LOGLEVEL_VVVV, hex(job.ProcessListHead.Flink))
vollog.log(LOGLEVEL_VVVV, hex(job.ProcessListHead.Blink))
vollog.log(LOGLEVEL_VVVV, "")
for entry in job.ProcessListHead.to_list(proc.vol.type_name, "JobLinks"):
yield (1, (
format_hints.Hex(offset), utility.array_to_string(entry.ImageFileName), entry.UniqueProcessId,
entry.InheritedFromUniqueProcessId, entry.get_session_id(), renderers.NotApplicableValue(), entry.get_is_wow64(),
renderers.NotApplicableValue(), renderers.NotApplicableValue(), renderers.NotApplicableValue(),
renderers.NotApplicableValue(),
"(Original Process)"
"Yes",
entry.get_peb().ProcessParameters.ImagePathName.get_string()
))
except (exceptions.InvalidAddressException):