mirror of
https://github.com/volatilityfoundation/volatility
synced 2026-06-08 18:04:46 +00:00
iMHLv2
68 lines
2.7 KiB
Python
68 lines
2.7 KiB
Python
# Volatility
|
|
#
|
|
# Authors:
|
|
# Mike Auty <mike.auty@gmail.com>
|
|
#
|
|
# This file is part of Volatility.
|
|
#
|
|
# Volatility is free software; you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation; either version 2 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# Volatility is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
|
#
|
|
|
|
import volatility.timefmt as timefmt
|
|
import volatility.obj as obj
|
|
import volatility.utils as utils
|
|
import volatility.commands as commands
|
|
|
|
#pylint: disable-msg=C0111
|
|
|
|
class DateTime(commands.Command):
|
|
"""A simple example plugin that gets the date/time information from a Windows image"""
|
|
def calculate(self):
|
|
"""Calculate and carry out any processing that may take time upon the image"""
|
|
# Load the address space
|
|
addr_space = utils.load_as(self._config)
|
|
|
|
# Call a subfunction so that it can be used by other plugins
|
|
return self.get_image_time(addr_space)
|
|
|
|
def get_image_time(self, addr_space):
|
|
"""Extracts the time and date from the KUSER_SHARED_DATA area"""
|
|
# Get the Image Datetime
|
|
result = {}
|
|
|
|
# Create a VOLATILITY_MAGIC object to look up the location of certain constants
|
|
# Get the KUSER_SHARED_DATA location
|
|
KUSER_SHARED_DATA = obj.VolMagic(addr_space).KUSER_SHARED_DATA.v()
|
|
# Create the _KUSER_SHARED_DATA object at the appropriate offset
|
|
k = obj.Object("_KUSER_SHARED_DATA",
|
|
offset = KUSER_SHARED_DATA,
|
|
vm = addr_space)
|
|
|
|
# Start reading members from it
|
|
result['ImageDatetime'] = k.SystemTime
|
|
result['ImageTz'] = timefmt.OffsetTzInfo(-k.TimeZoneBias.as_windows_timestamp() / 10000000)
|
|
|
|
# Return any results we got
|
|
return result
|
|
|
|
def render_text(self, outfd, data):
|
|
"""Renders the calculated data as text to outfd"""
|
|
# Convert the result into a datetime object for display in local and non local format
|
|
dt = data['ImageDatetime'].as_datetime()
|
|
|
|
# Display the datetime in UTC as taken from the image
|
|
outfd.write("Image date and time : {0}\n".format(data['ImageDatetime']))
|
|
# Display the datetime taking into account the timezone of the image itself
|
|
outfd.write("Image local date and time : {0}\n".format(timefmt.display_datetime(dt, data['ImageTz'])))
|