volatility3.plugins.windows.modscan module
- class ModScan(context, config_path, progress_callback=None)[source]
Bases:
PluginInterface
Scans for modules present in a particular windows memory image.
- Parameters:
- build_configuration()
Constructs a HierarchicalDictionary of all the options required to build this component in the current context.
Ensures that if the class has been created, it can be recreated using the configuration built Inheriting classes must override this to ensure any dependent classes update their configurations too
- Return type:
- property config: HierarchicalDict
The Hierarchical configuration Dictionary for this Configurable object.
- property context: ContextInterface
The context object that this configurable belongs to/configuration is stored in.
- classmethod find_session_layer(context, session_layers, base_address)[source]
Given a base address and a list of layer names, find a layer that can access the specified address.
- Parameters:
context (
ContextInterface
) – The context to retrieve required elements (layers, symbol tables) fromlayer_name – The name of the layer on which to operate
symbol_table – The name of the table containing the kernel symbols
session_layers (
Iterable
[str
]) – A list of session layer namesbase_address (
int
) – The base address to identify the layers that can access it
- Returns:
Layer name or None if no layers that contain the base address can be found
- classmethod get_session_layers(context, layer_name, symbol_table, pids=None)[source]
Build a cache of possible virtual layers, in priority starting with the primary/kernel layer. Then keep one layer per session by cycling through the process list.
- Parameters:
context (
ContextInterface
) – The context to retrieve required elements (layers, symbol tables) fromlayer_name (
str
) – The name of the layer on which to operatesymbol_table (
str
) – The name of the table containing the kernel symbolspids (
List
[int
]) – A list of process identifiers to include exclusively or None for no filter
- Return type:
- Returns:
A list of session layer names
- classmethod make_subconfig(context, base_config_path, **kwargs)
Convenience function to allow constructing a new randomly generated sub-configuration path, containing each element from kwargs.
- Parameters:
context (
ContextInterface
) – The context in which to store the new configurationbase_config_path (
str
) – The base configuration path on which to build the new configurationkwargs – Keyword arguments that are used to populate the new configuration path
- Returns:
The newly generated full configuration path
- Return type:
- property open
Returns a context manager and thus can be called like open
- run()[source]
Executes the functionality of the code.
Note
This method expects self.validate to have been called to ensure all necessary options have been provided
- Returns:
A TreeGrid object that can then be passed to a Renderer.
- classmethod scan_modules(context, layer_name, symbol_table)[source]
Scans for modules using the poolscanner module and constraints.
- Parameters:
context (
ContextInterface
) – The context to retrieve required elements (layers, symbol tables) fromlayer_name (
str
) – The name of the layer on which to operatesymbol_table (
str
) – The name of the table containing the kernel symbols
- Return type:
- Returns:
A list of Driver objects as found from the layer_name layer based on Driver pool signatures
- classmethod unsatisfied(context, config_path)
Returns a list of the names of all unsatisfied requirements.
Since a satisfied set of requirements will return [], it can be used in tests as follows:
unmet = configurable.unsatisfied(context, config_path) if unmet: raise RuntimeError("Unsatisfied requirements: {}".format(unmet)
- Return type:
- version = (1, 0, 0)