This updates the plugins that depend on `Handles` with the correct
required version number, as well as calls to the new handles
classmethods where needed.
A lot of functionality in this plugin class was using instance methods
instead of classmethods; this refactors the plugin to use classmethods
instead of instance methods for consistency with the rest of the
framework, and bumps the plugin major version to 4.0.0.
When performing the attribute checks for ListFlags.BlobBuffer, a pointer
dereference occurs implicitly that can trigger an
`exceptions.InvalidAddressException`. This wraps the checks in a
try/except block, and sets the value of `_exec_flag` to
`renderers.UnreadableValue` if one occurs.
This check was both causing an `InvalidAddressException` due to the
member access, while at the same time not being a useful check, since it
prevents VADs from being mapped in children of the `System` process.
This was preventing enumeration of valid processes (confirmed by
disassembly of the start address/Win32 start address). Heuristic-based
filtering should probably be left to consumers of the APIs.
Fixes regression introduced in #1632
Symbolic links are allocated in the paged pools, not non-paged. This was
causing us to miss symlinks across both pre and post win8 samples.
Removes casts to `int` performed before checking set membership, since
the computed `__hash__` value will be the same for both the Python
primitive and the volatility `objects.Pointer`.
The traversal of `ActiveProcessLinks` from `PsActiveProcessHead` was
only being done in the forward direction; if for some reason
`PsActiveProcessHead` hasn't been updated to point at the 'current' list
head, entries in the backwards traversal direction will be missed.
Adds needed return statements in `exec_flag` method in order to avoid
`InvalidAddressException` when reading from invalid memory after an
`is_valid` check has already been performed.
This fixes a bug in the plugin logic that causes valid entries to be
excluded in the following scenario:
- An entry is discovered but deemed invalid due to unreadable
size/timestamps.
- The offset gets placed into the `seen` tracking set anyway
- Another entry (this time, with valid filesize/timestamps) with the
same physical offset is encountered, but is skipped because this
offset is already in the `seen` tracking set.
This updates the logic to only add the offset to the tracker if the
shimcache entry is valid.
I noticed that many plugins were creating duplicate per-process
translation layers - for instance, `windows.envars.Envars` was ending up
with > 30 process layers per process due to repeated calls to
`get_peb()`, which calls `add_process_space()` internally.
This adds `@functools.lru_cache` to the `get_peb()` and `get_peb32()`
methods on the `EPROCESS` extension, since these should only need to be
created once.
Also adds `@functools.lru_cache` to `add_process_space` to enable
reusing the same process address space, provided the same arguments are
passed to the `add_process_space()` method.
eve