WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-13 13:17:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

adds netstat symbols to Win8x64 ISF files

Browse Source
This commit is contained in:
Jan
2021-12-06 17:14:40 +01:00
parent 96820e2804
commit fffb375909
2 changed files with 377 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/symbols/windows/netscan/netscan-win8-x64.json
+188 -1
View File
@@ -237,6 +237,16 @@
"kind": "base",
"name": "unsigned be short"
}
},
"Next": {
"offset": 136,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_UDP_ENDPOINT"
}
}
}
},
"kind": "struct",
@@ -256,7 +266,7 @@
}
},
"CreateTime": {
"offset": 32,
"offset": 224,
"type": {
"kind": "union",
"name": "_LARGE_INTEGER"
@@ -290,6 +300,16 @@
"kind": "base",
"name": "unsigned be short"
}
},
"Next": {
"offset": 112,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_TCP_LISTENER"
}
}
}
},
"kind": "struct",
@@ -503,6 +523,173 @@
},
"kind": "union",
"size": 8
},
"_INET_COMPARTMENT_SET": {
"fields": {
"InetCompartment": {
"offset": 328,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INET_COMPARTMENT"
}
}
}
},
"kind": "struct",
"size": 384
},
"_INET_COMPARTMENT": {
"fields": {
"ProtocolCompartment": {
"offset": 32,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_PROTOCOL_COMPARTMENT"
}
}
}
},
"kind": "struct",
"size": 48
},
"_PROTOCOL_COMPARTMENT": {
"fields": {
"PortPool": {
"offset": 0,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INET_PORT_POOL"
}
}
}
},
"kind": "struct",
"size": 16
},
"_PORT_ASSIGNMENT_ENTRY": {
"fields": {
"Entry": {
"offset": 8,
"type": {
"kind": "pointer",
"subtype": {
"kind": "base",
"name": "void"
}
}
}
},
"kind": "struct",
"size": 16
},
"_PORT_ASSIGNMENT_LIST": {
"fields": {
"Assignments": {
"offset": 0,
"type": {
"count": 256,
"kind": "array",
"subtype": {
"kind": "struct",
"name": "_PORT_ASSIGNMENT_ENTRY"
}
}
}
},
"kind": "struct",
"size": 4096
},
"_PORT_ASSIGNMENT": {
"fields": {
"InPaBigPoolBase": {
"offset": 32,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_PORT_ASSIGNMENT_LIST"
}
}
}
},
"kind": "struct",
"size": 40
},
"_INET_PORT_POOL": {
"fields": {
"PortAssignments": {
"offset": 176,
"type": {
"count": 256,
"kind": "array",
"subtype": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_PORT_ASSIGNMENT"
}
}
}
},
"PortBitMap": {
"offset": 160,
"type": {
"kind": "struct",
"name": "nt_symbols!_RTL_BITMAP"
}
}
},
"kind": "struct",
"size": 11200
},
"_PARTITION": {
"fields": {
"Endpoints" : {
"offset": 8,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_RTL_DYNAMIC_HASH_TABLE"
}
}
},
"UnknownHashTable" : {
"offset": 16,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_RTL_DYNAMIC_HASH_TABLE"
}
}
}
},
"kind": "struct",
"size": 128
},
"_PARTITION_TABLE": {
"fields": {
"Partitions": {
"offset": 0,
"type": {
"count": 1,
"kind": "array",
"subtype": {
"kind": "struct",
"name": "_PARTITION"
}
}
}
},
"kind": "struct",
"size": 128
}
},
"enums": {
volatility3/framework/symbols/windows/netscan/netscan-win81-x64.json
+189 -2
View File
@@ -232,11 +232,21 @@
}
},
"Port": {
"offset": 128,
"offset": 120,
"type": {
"kind": "base",
"name": "unsigned be short"
}
},
"Next": {
"offset": 112,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_UDP_ENDPOINT"
}
}
}
},
"kind": "struct",
@@ -256,7 +266,7 @@
}
},
"CreateTime": {
"offset": 32,
"offset": 224,
"type": {
"kind": "union",
"name": "_LARGE_INTEGER"
@@ -290,6 +300,16 @@
"kind": "base",
"name": "unsigned be short"
}
},
"Next": {
"offset": 112,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_TCP_LISTENER"
}
}
}
},
"kind": "struct",
@@ -503,6 +523,173 @@
},
"kind": "union",
"size": 8
},
"_INET_COMPARTMENT_SET": {
"fields": {
"InetCompartment": {
"offset": 328,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INET_COMPARTMENT"
}
}
}
},
"kind": "struct",
"size": 384
},
"_INET_COMPARTMENT": {
"fields": {
"ProtocolCompartment": {
"offset": 32,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_PROTOCOL_COMPARTMENT"
}
}
}
},
"kind": "struct",
"size": 48
},
"_PROTOCOL_COMPARTMENT": {
"fields": {
"PortPool": {
"offset": 0,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INET_PORT_POOL"
}
}
}
},
"kind": "struct",
"size": 16
},
"_PORT_ASSIGNMENT_ENTRY": {
"fields": {
"Entry": {
"offset": 8,
"type": {
"kind": "pointer",
"subtype": {
"kind": "base",
"name": "void"
}
}
}
},
"kind": "struct",
"size": 24
},
"_PORT_ASSIGNMENT_LIST": {
"fields": {
"Assignments": {
"offset": 0,
"type": {
"count": 256,
"kind": "array",
"subtype": {
"kind": "struct",
"name": "_PORT_ASSIGNMENT_ENTRY"
}
}
}
},
"kind": "struct",
"size": 6144
},
"_PORT_ASSIGNMENT": {
"fields": {
"InPaBigPoolBase": {
"offset": 32,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_PORT_ASSIGNMENT_LIST"
}
}
}
},
"kind": "struct",
"size": 40
},
"_INET_PORT_POOL": {
"fields": {
"PortAssignments": {
"offset": 176,
"type": {
"count": 256,
"kind": "array",
"subtype": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_PORT_ASSIGNMENT"
}
}
}
},
"PortBitMap": {
"offset": 160,
"type": {
"kind": "struct",
"name": "nt_symbols!_RTL_BITMAP"
}
}
},
"kind": "struct",
"size": 11200
},
"_PARTITION": {
"fields": {
"Endpoints" : {
"offset": 8,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_RTL_DYNAMIC_HASH_TABLE"
}
}
},
"UnknownHashTable" : {
"offset": 16,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_RTL_DYNAMIC_HASH_TABLE"
}
}
}
},
"kind": "struct",
"size": 128
},
"_PARTITION_TABLE": {
"fields": {
"Partitions": {
"offset": 0,
"type": {
"count": 1,
"kind": "array",
"subtype": {
"kind": "struct",
"name": "_PARTITION"
}
}
}
},
"kind": "struct",
"size": 128
}
},
"enums": {