admin/volatilityfoundation-volatility
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility synced 2026-06-08 18:04:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

some object classes in svcscan.py have both a valid() and is_valid() check (the second is inherited from obj.Object). this is unnecessary as the code currently in valid() can be moved to is_valid() and we don't have to define an extra method.

Browse Source
This commit is contained in:
iMHLv2
2012-04-11 13:49:36 +00:00
parent a25aa7be57
commit 60404a00a2
1 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/plugins/malware/svcscan.py
+8 -6
View File
@@ -193,9 +193,9 @@ class _SERVICE_RECORD_LEGACY(obj.CType):
return obj.NoneObject("Cannot get process ID")
def valid(self):
def is_valid(self):
"Check some fields for validity"
return self.Order > 0 and self.Order < 0xFFFF
return obj.CType.is_valid(self) and self.Order > 0 and self.Order < 0xFFFF
class _SERVICE_RECORD_RECENT(_SERVICE_RECORD_LEGACY):
"Service records for 2008, Vista, 7 x86 and x64"
@@ -212,9 +212,11 @@ class _SERVICE_RECORD_RECENT(_SERVICE_RECORD_LEGACY):
class _SERVICE_HEADER(obj.CType):
"Service headers for 2008, Vista, 7 x86 and x64"
def valid(self):
def is_valid(self):
"Check some fields for validity"
return self.ServiceRecord.is_valid() and self.ServiceRecord.Order < 0xFFFF
return (obj.CType.is_valid(self) and
self.ServiceRecord.is_valid() and
self.ServiceRecord.Order < 0xFFFF)
#--------------------------------------------------------------------------------
# profile modifications
@@ -331,14 +333,14 @@ class SvcScan(commands.Command):
vm = process_space
)
# Apply our sanity checks
if rec.valid():
if rec.is_valid():
yield rec
else:
# Windows Vista, 2008, and 7
svc_hdr = obj.Object('_SERVICE_HEADER', offset = address,
vm = process_space)
# Apply our sanity checks
if svc_hdr.valid():
if svc_hdr.is_valid():
# Since we walk the s-list backwards, if we've seen
# an object, then we've also seen all objects that
# exist before it, thus we can break at that time.