diff --git a/volatility/plugins/overlays/windows/vista_sp0_x86.py b/volatility/plugins/overlays/windows/vista_sp0_x86.py index f8b078d3..0477940b 100644 --- a/volatility/plugins/overlays/windows/vista_sp0_x86.py +++ b/volatility/plugins/overlays/windows/vista_sp0_x86.py @@ -44,8 +44,6 @@ vistasp0x86overlays = copy.deepcopy(win2k3_sp2_x86.win2k3sp2x86overlays) vistasp0x86overlays['VOLATILITY_MAGIC'][1]['DTBSignature'][1] = ['VolatilityMagic', dict(value = "\x03\x00\x20\x00")] vistasp0x86overlays['VOLATILITY_MAGIC'][1]['KPCR'][1] = ['VolatilityKPCR', dict(configname = 'KPCR')] vistasp0x86overlays['VOLATILITY_MAGIC'][1]['KDBGHeader'][1] = ['VolatilityMagic', dict(value = '\x00\x00\x00\x00\x00\x00\x00\x00KDBG\x28\x03')] -vistasp0x86overlays['VOLATILITY_MAGIC'][1]['HiveListOffset'][1] = ['VolatilityMagic', dict(value = 0x308)] -vistasp0x86overlays['VOLATILITY_MAGIC'][1]['HiveListPoolSize'][1] = ['VolatilityMagic', dict(value = 0x5d8)] vista_sp0_x86_vtypes.nt_types.update(crash_vtypes.crash_vtypes) vista_sp0_x86_vtypes.nt_types.update(hibernate_vtypes.hibernate_vtypes) diff --git a/volatility/plugins/overlays/windows/vista_sp2_x86.py b/volatility/plugins/overlays/windows/vista_sp2_x86.py index fd688802..06dee12a 100644 --- a/volatility/plugins/overlays/windows/vista_sp2_x86.py +++ b/volatility/plugins/overlays/windows/vista_sp2_x86.py @@ -41,8 +41,6 @@ import volatility.debug as debug #pylint: disable-msg=W0611 vistasp2x86overlays = copy.deepcopy(vista_sp1_x86.vistasp1x86overlays) -vistasp2x86overlays['VOLATILITY_MAGIC'][1]['HiveListPoolSize'][1] = ['VolatilityMagic', dict(value = 0x5e8)] - vista_sp2_x86_vtypes.nt_types.update(crash_vtypes.crash_vtypes) vista_sp2_x86_vtypes.nt_types.update(hibernate_vtypes.hibernate_vtypes) vista_sp2_x86_vtypes.nt_types.update(kdbg_vtypes.kdbg_vtypes) diff --git a/volatility/plugins/overlays/windows/win2k3_sp0_x86.py b/volatility/plugins/overlays/windows/win2k3_sp0_x86.py index ff2baeeb..9cba6d08 100644 --- a/volatility/plugins/overlays/windows/win2k3_sp0_x86.py +++ b/volatility/plugins/overlays/windows/win2k3_sp0_x86.py @@ -46,8 +46,6 @@ win2k3sp0x86overlays['_EPROCESS'][1]['VadRoot'][1] = ['_MM_AVL_TABLE'] win2k3sp0x86overlays['VOLATILITY_MAGIC'][1]['DTBSignature'][1] = ['VolatilityMagic', dict(value = "\x03\x00\x1B\x00")] win2k3sp0x86overlays['VOLATILITY_MAGIC'][1]['KPCR'][1] = ['VolatilityKPCR', dict(value = 0xffdff000, configname = 'KPCR')] win2k3sp0x86overlays['VOLATILITY_MAGIC'][1]['KDBGHeader'][1] = ['VolatilityMagic', dict(value = '\x00\x00\x00\x00\x00\x00\x00\x00KDBG\x18\x03')] -win2k3sp0x86overlays['VOLATILITY_MAGIC'][1]['HiveListOffset'][1] = ['VolatilityMagic', dict(value = 0x2e4)] -win2k3sp0x86overlays['VOLATILITY_MAGIC'][1]['HiveListPoolSize'][1] = ['VolatilityMagic', dict(value = 0x578)] win2k3_sp0_x86_vtypes.nt_types.update(crash_vtypes.crash_vtypes) win2k3_sp0_x86_vtypes.nt_types.update(hibernate_vtypes.hibernate_vtypes) diff --git a/volatility/plugins/overlays/windows/win2k3_sp1_x86.py b/volatility/plugins/overlays/windows/win2k3_sp1_x86.py index 1833a394..1cf737b7 100644 --- a/volatility/plugins/overlays/windows/win2k3_sp1_x86.py +++ b/volatility/plugins/overlays/windows/win2k3_sp1_x86.py @@ -41,7 +41,6 @@ import volatility.debug as debug #pylint: disable-msg=W0611 win2k3sp1x86overlays = copy.deepcopy(win2k3_sp0_x86.win2k3sp0x86overlays) win2k3sp1x86overlays['VOLATILITY_MAGIC'][1]['DTBSignature'][1] = ['VolatilityMagic', dict(value = "\x03\x00\x1e\x00")] -win2k3sp1x86overlays['VOLATILITY_MAGIC'][1]['HiveListPoolSize'][1] = ['VolatilityMagic', dict(value = 0x588)] win2k3sp1x86overlays['_ETHREAD'][1]['CreateTime'][1] = ['WinTimeStamp', {}] win2k3_sp1_x86_vtypes.nt_types.update(crash_vtypes.crash_vtypes) diff --git a/volatility/plugins/overlays/windows/win7_sp0_x86.py b/volatility/plugins/overlays/windows/win7_sp0_x86.py index bdc29c33..c9649153 100644 --- a/volatility/plugins/overlays/windows/win7_sp0_x86.py +++ b/volatility/plugins/overlays/windows/win7_sp0_x86.py @@ -42,8 +42,6 @@ win7sp0x86overlays = copy.deepcopy(vista_sp0_x86.vistasp0x86overlays) win7sp0x86overlays['VOLATILITY_MAGIC'][1]['DTBSignature'][1] = ['VolatilityMagic', dict(value = "\x03\x00\x26\x00")] win7sp0x86overlays['VOLATILITY_MAGIC'][1]['KPCR'][1] = ['VolatilityKPCR', dict(configname = 'KPCR')] win7sp0x86overlays['VOLATILITY_MAGIC'][1]['KDBGHeader'][1] = ['VolatilityMagic', dict(value = '\x00\x00\x00\x00\x00\x00\x00\x00KDBG\x40\x03')] -win7sp0x86overlays['VOLATILITY_MAGIC'][1]['HiveListOffset'][1] = ['VolatilityMagic', dict(value = 0x30c)] -win7sp0x86overlays['VOLATILITY_MAGIC'][1]['HiveListPoolSize'][1] = ['VolatilityMagic', dict(value = 0x638)] # Add a new member to the VOLATILIY_MAGIC type win7sp0x86overlays['VOLATILITY_MAGIC'][1]['ObjectPreamble'] = [ 0x0, ['VolatilityMagic', dict(value = '_OBJECT_HEADER_CREATOR_INFO')]] diff --git a/volatility/plugins/overlays/windows/windows.py b/volatility/plugins/overlays/windows/windows.py index 275cb655..ec1c97f4 100644 --- a/volatility/plugins/overlays/windows/windows.py +++ b/volatility/plugins/overlays/windows/windows.py @@ -655,7 +655,6 @@ class _MMSECTION_FLAGS(_MMVAD_FLAGS): AbstractWindowsX86.object_classes['_MMSECTION_FLAGS'] = _MMSECTION_FLAGS - ### DEPRECATED FEATURES ### # # These are due from removal after version 2.2, diff --git a/volatility/plugins/overlays/windows/xp_sp2_x86.py b/volatility/plugins/overlays/windows/xp_sp2_x86.py index 9a630b3a..b8c40aa9 100644 --- a/volatility/plugins/overlays/windows/xp_sp2_x86.py +++ b/volatility/plugins/overlays/windows/xp_sp2_x86.py @@ -56,8 +56,6 @@ xpsp2overlays = { 'KUSER_SHARED_DATA' : [ 0x0, ['VolatilityMagic', dict(value = 0xFFDF0000)]], 'KDBG' : [ 0x0, ['VolatilityKDBG', dict(configname = "KDBG")]], 'KDBGHeader' : [ 0x0, ['VolatilityMagic', dict(value = '\x00\x00\x00\x00\x00\x00\x00\x00KDBG\x90\x02')]], - 'HiveListOffset' : [ 0x0, ['VolatilityMagic', dict(value = 0x224)]], - 'HiveListPoolSize': [ 0x0, ['VolatilityMagic', dict(value = 0x4a8)]], 'IA32ValidAS': [ 0x0, ['VolatilityIA32ValidAS']], # Pool allocations are aligned to this many bytes. 'PoolAlignment': [0x0, ['VolatilityMagic', dict(value = 8)]], diff --git a/volatility/plugins/registry/hivelist.py b/volatility/plugins/registry/hivelist.py index 3ff60bb7..10b702c9 100644 --- a/volatility/plugins/registry/hivelist.py +++ b/volatility/plugins/registry/hivelist.py @@ -76,10 +76,9 @@ class HiveList(hs.HiveScan): ## the first hive in virtual address space. hmm I wish we ## could go from physical to virtual memory easier. for offset in hives: - hive = obj.Object("_CMHIVE", int(offset), flat) - o = obj.VolMagic(flat).HiveListOffset + hive = obj.Object("_CMHIVE", int(offset), flat, native_vm = addr_space) if hive.HiveList.Flink.v(): - start_hive_offset = hive.HiveList.Flink.v() - o.v() + start_hive_offset = hive.HiveList.Flink.v() - addr_space.profile.get_obj_offset('_CMHIVE', 'HiveList') ## Now instantiate the first hive in virtual address space as normal start_hive = obj.Object("_CMHIVE", start_hive_offset, addr_space) diff --git a/volatility/plugins/registry/hivescan.py b/volatility/plugins/registry/hivescan.py index c904bd4c..1fe9400e 100644 --- a/volatility/plugins/registry/hivescan.py +++ b/volatility/plugins/registry/hivescan.py @@ -80,9 +80,7 @@ class HiveScan(commands.command): def calculate(self): ## Just grab the AS and scan it using our scanner pspace = utils.load_as(self._config, astype = 'physical') - o = obj.VolMagic(pspace).HiveListPoolSize - - poolsize = o.v() + poolsize = pspace.profile.get_obj_size('_CMHIVE') return PoolScanHiveFast2(poolsize).scan(pspace)