Skip to content

Update __init__.py #2

New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update __init__.py #2

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 27 additions & 7 deletions volatility/framework/symbols/windows/extensions/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -676,7 +676,10 @@ def environment_variables(self):

try:
block = self.get_peb().ProcessParameters.Environment
block_size = self.get_peb().ProcessParameters.EnvironmentSize
try:
block_size = self.get_peb().ProcessParameters.EnvironmentSize
except AttributeError: # Windows XP
block_size = self.get_peb().ProcessParameters.Length
envars = context.layers[process_space].read(block, block_size).decode("utf-16-le", errors='replace').split('\x00')[:-1]
except exceptions.InvalidAddressException:
return renderers.UnreadableValue()
Expand Down Expand Up @@ -790,12 +793,29 @@ def get_sids(self) -> Iterable[str]:


def privileges(self):
"Return a list of privileges for the current token object."
for priv_index in range(64):
yield (priv_index,
bool(self.Privileges.Present & (2**priv_index)),
bool(self.Privileges.Enabled & (2**priv_index)),
bool(self.Privileges.EnabledByDefault & (2**priv_index)))
"""Return a list of privileges for the current token object."""

try:
for priv_index in range(64):
yield (priv_index,
bool(self.Privileges.Present & (2**priv_index)),
bool(self.Privileges.Enabled & (2**priv_index)),
bool(self.Privileges.EnabledByDefault & (2**priv_index)))
except AttributeError: # Windows XP
layer_name = self.vol.layer_name
kvo = self._context.layers[layer_name].config["kernel_virtual_offset"]
symbol_table = self.get_symbol_table_name()
ntkrnlmp = self._context.module(symbol_table,
layer_name = layer_name,
offset = kvo)
if self.PrivilegeCount < 1024:
# This is a pointer to an array of _LUID_AND_ATTRIBUTES
for luid in self.Privileges.dereference().cast("array", count=self.PrivilegeCount,
subtype=ntkrnlmp.get_type("_LUID_AND_ATTRIBUTES")):
# The Attributes member is a flag
enabled = luid.Attributes & 2 != 0
default = luid.Attributes & 1 != 0
yield luid.Luid.LowPart, True, enabled, default


class KTHREAD(objects.StructType):
Expand Down