From 60404a00a20457b7071f882a3cccb8944753e842 Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Wed, 11 Apr 2012 13:49:36 +0000 Subject: [PATCH] some object classes in svcscan.py have both a valid() and is_valid() check (the second is inherited from obj.Object). this is unnecessary as the code currently in valid() can be moved to is_valid() and we don't have to define an extra method. --- volatility/plugins/malware/svcscan.py | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/volatility/plugins/malware/svcscan.py b/volatility/plugins/malware/svcscan.py index 69e526ac..d9765b05 100644 --- a/volatility/plugins/malware/svcscan.py +++ b/volatility/plugins/malware/svcscan.py @@ -193,9 +193,9 @@ class _SERVICE_RECORD_LEGACY(obj.CType): return obj.NoneObject("Cannot get process ID") - def valid(self): + def is_valid(self): "Check some fields for validity" - return self.Order > 0 and self.Order < 0xFFFF + return obj.CType.is_valid(self) and self.Order > 0 and self.Order < 0xFFFF class _SERVICE_RECORD_RECENT(_SERVICE_RECORD_LEGACY): "Service records for 2008, Vista, 7 x86 and x64" @@ -212,9 +212,11 @@ class _SERVICE_RECORD_RECENT(_SERVICE_RECORD_LEGACY): class _SERVICE_HEADER(obj.CType): "Service headers for 2008, Vista, 7 x86 and x64" - def valid(self): + def is_valid(self): "Check some fields for validity" - return self.ServiceRecord.is_valid() and self.ServiceRecord.Order < 0xFFFF + return (obj.CType.is_valid(self) and + self.ServiceRecord.is_valid() and + self.ServiceRecord.Order < 0xFFFF) #-------------------------------------------------------------------------------- # profile modifications @@ -331,14 +333,14 @@ class SvcScan(commands.Command): vm = process_space ) # Apply our sanity checks - if rec.valid(): + if rec.is_valid(): yield rec else: # Windows Vista, 2008, and 7 svc_hdr = obj.Object('_SERVICE_HEADER', offset = address, vm = process_space) # Apply our sanity checks - if svc_hdr.valid(): + if svc_hdr.is_valid(): # Since we walk the s-list backwards, if we've seen # an object, then we've also seen all objects that # exist before it, thus we can break at that time.