WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-30 19:59:46 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #857 from volatilityfoundation/driverirp_hidden_module_support

Browse Source 
Report IRP entries that point inside a hidden module. This is a commo…
This commit is contained in:
ikelos
2024-03-04 14:58:45 +00:00
committed by GitHub
parent d4b92db446 0b33a79dc6
commit fbcaeccf7d
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/driverirp.py
+8
View File
@@ -81,7 +81,10 @@ class DriverIrp(interfaces.plugins.PluginInterface):
address
)
module_found = False
for module_name, symbol_generator in module_symbols:
module_found = True
symbols_found = False
for symbol in symbol_generator:
@@ -111,6 +114,11 @@ class DriverIrp(interfaces.plugins.PluginInterface):
),
)
if not module_found:
yield (0, (format_hints.Hex(driver.vol.offset), driver_name, MAJOR_FUNCTIONS[i],
format_hints.Hex(address), renderers.NotAvailableValue(), renderers.NotAvailableValue()))
def run(self):
return renderers.TreeGrid(
[