diff --git a/volatility/plugins/overlays/windows/kdbg_vtypes.py b/volatility/plugins/overlays/windows/kdbg_vtypes.py index 82a92130..34ecc8d7 100644 --- a/volatility/plugins/overlays/windows/kdbg_vtypes.py +++ b/volatility/plugins/overlays/windows/kdbg_vtypes.py @@ -33,6 +33,25 @@ class _KDDEBUGGER_DATA64(obj.CType): csdresult = obj.Object("unsigned long", offset = self.CmNtCSDVersion, vm = self.obj_vm) return (csdresult >> 8) & 0xffffffff + def processes(self): + """Enumerate processes""" + list_head = self.PsActiveProcessHead.dereference_as("_LIST_ENTRY") + if not list_head: + raise AttributeError("Could not list tasks, please verify your --profile with kdbgscan") + + for l in list_head.list_of_type("_EPROCESS", "ActiveProcessLinks"): + yield l + + def modules(self): + """Enumerate modules""" + list_head = self.PsLoadedModuleList.dereference_as("_LIST_ENTRY") + if not list_head: + raise AttributeError("Could not list modules, please verify your --profile with kdbgscan") + + for l in list_head.dereference_as("_LIST_ENTRY").list_of_type( + "_LDR_DATA_TABLE_ENTRY", "InLoadOrderLinks"): + yield l + def dbgkd_version64(self): """Scan backwards from the base of KDBG to find the _DBGKD_GET_VERSION64. We have a winner when kernel diff --git a/volatility/win32/modules.py b/volatility/win32/modules.py index d13b4ad2..cc0e912e 100644 --- a/volatility/win32/modules.py +++ b/volatility/win32/modules.py @@ -27,14 +27,7 @@ import volatility.win32.tasks as tasks def lsmod(addr_space): - """ A Generator for modules (uses _KPCR symbols) """ - ## Locate the kpcr struct - either hard coded or specified by the command line + """ A Generator for modules """ - PsLoadedModuleList = tasks.get_kdbg(addr_space).PsLoadedModuleList - - if PsLoadedModuleList.is_valid(): - ## Try to iterate over the process list in PsActiveProcessHead - ## (its really a pointer to a _LIST_ENTRY) - for l in PsLoadedModuleList.dereference_as("_LIST_ENTRY").list_of_type( - "_LDR_DATA_TABLE_ENTRY", "InLoadOrderLinks"): - yield l + for m in tasks.get_kdbg(addr_space).modules(): + yield m diff --git a/volatility/win32/tasks.py b/volatility/win32/tasks.py index a6a71eaa..01a06f7f 100644 --- a/volatility/win32/tasks.py +++ b/volatility/win32/tasks.py @@ -30,13 +30,8 @@ import volatility.obj as obj import volatility.debug as debug #pylint: disable-msg=W0611 -import volatility.exceptions as exceptions from bisect import bisect_right -class TasksNotFound(exceptions.VolatilityException): - """Thrown when a tasklist cannot be determined""" - pass - def get_kdbg(addr_space): """A function designed to return the KDDEBUGGER structure from an address space""" @@ -70,18 +65,10 @@ def get_kdbg(addr_space): return obj.NoneObject("KDDEBUGGER structure not found using either KDBG signature or KPCR pointer") def pslist(addr_space): - """ A Generator for _EPROCESS objects (uses _KPCR symbols) """ + """ A Generator for _EPROCESS objects """ - PsActiveProcessHead = get_kdbg(addr_space).PsActiveProcessHead - - PsActiveList = PsActiveProcessHead.dereference_as("_LIST_ENTRY") - if PsActiveList: - # Try to iterate over the process list in PsActiveProcessHead - # (its really a pointer to a _LIST_ENTRY) - for l in PsActiveList.list_of_type("_EPROCESS", "ActiveProcessLinks"): - yield l - else: - raise TasksNotFound("Could not list tasks, please verify the --profile option and whether this image is valid") + for p in get_kdbg(addr_space).processes(): + yield p def find_space(addr_space, procs, mod_base): """Search for an address space (usually looking for a GUI process)"""