WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 03:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

layers: Fix up uses of is_valid.

Browse Source
This commit is contained in:
Mike Auty
2019-11-12 09:09:51 +00:00
committed by ikelos
parent 5b04492463
commit face38436e
11 changed files with 26 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/mac/bash.py
+6 -6
View File
@@ -90,18 +90,18 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
("Command", str)],
self._generator(
tasks.Tasks.list_tasks(self.context,
self.config['primary'],
self.config['darwin'],
filter_func = filter_func)))
self.config['primary'],
self.config['darwin'],
filter_func = filter_func)))
def generate_timeline(self):
filter_func = tasks.Tasks.create_pid_filter([self.config.get('pid', None)])
for row in self._generator(
tasks.Tasks.list_tasks(self.context,
self.config['primary'],
self.config['darwin'],
filter_func = filter_func)):
self.config['primary'],
self.config['darwin'],
filter_func = filter_func)):
_depth, row_data = row
description = "{} ({}): \"{}\"".format(row_data[0], row_data[1], row_data[3])
yield (description, timeliner.TimeLinerType.CREATED, row_data[2])
volatility/framework/plugins/mac/psaux.py
+3 -3
View File
@@ -91,6 +91,6 @@ class Psaux(plugins.PluginInterface):
return renderers.TreeGrid([("PID", int), ("Process", str), ("Argc", int), ("Arguments", str)],
self._generator(
tasks.Tasks.list_tasks(self.context,
self.config['primary'],
self.config['darwin'],
filter_func = filter_func)))
self.config['primary'],
self.config['darwin'],
filter_func = filter_func)))
volatility/framework/plugins/mac/pslist.py
+1 -1
View File
@@ -87,7 +87,7 @@ class PsList(interfaces.plugins.PluginInterface):
else:
seen[proc.vol.offset] = 1
if not filter_func(proc) and kernel_as.is_valid(proc.vol.offset):
if not filter_func(proc) and kernel_as.is_valid(proc.vol.offset, proc.vol.size):
yield proc
try:
volatility/framework/plugins/mac/tasks.py
+1 -1
View File
@@ -50,7 +50,7 @@ class Tasks(pslist.PsList):
proc = task.bsd_info.dereference().cast("proc")
if not context.layers[layer_name].is_valid(proc.vol.offset):
if not context.layers[layer_name].is_valid(proc.vol.offset, proc.vol.size):
break
if not filter_func(proc):
volatility/framework/plugins/windows/callbacks.py
+2 -6
View File
@@ -185,9 +185,7 @@ class Callbacks(interfaces.plugins.PluginInterface):
layer_name = layer_name)
for callback in callback_record.Entry:
try:
context.layers[layer_name].is_valid(callback.CallbackRoutine)
except exceptions.InvalidAddressException:
if not context.layers[layer_name].is_valid(callback.CallbackRoutine, 64):
continue
try:
@@ -228,9 +226,7 @@ class Callbacks(interfaces.plugins.PluginInterface):
for callback in callback_record.Entry:
try:
context.layers[layer_name].is_valid(callback.CallbackRoutine)
except exceptions.InvalidAddressException:
if not context.layers[layer_name].is_valid(callback.CallbackRoutine, 64):
continue
try:
volatility/framework/plugins/windows/handles.py
-1
View File
@@ -298,7 +298,6 @@ class Handles(interfaces.plugins.PluginInterface):
for entry in self.handles(object_table):
try:
self.context.layers[self.config["primary"]].is_valid(entry.vol.offset)
obj_type = entry.get_object_type(type_map, cookie)
if obj_type is None:
continue
volatility/framework/plugins/windows/malfind.py
+1 -1
View File
@@ -55,7 +55,7 @@ class Malfind(interfaces.plugins.PluginInterface):
while offset < vad_length:
next_addr = vad.get_start() + offset
if proc_layer.is_valid(next_addr) and proc_layer.read(next_addr, CHUNK_SIZE) != all_zero_page:
if proc_layer.is_valid(next_addr, CHUNK_SIZE) and proc_layer.read(next_addr, CHUNK_SIZE) != all_zero_page:
return False
offset += CHUNK_SIZE