ksanchezcld / volatility

Automatically exported from code.google.com/p/volatility
GNU General Public License v2.0
1 stars 0 forks source link

ability to add constants per profile #298

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
I've seen methods like profile.add_constants in scudette's tech preview branch, 
and just wanted to document an example of when it would be useful. 

In some cases, a single list of constants can be used for multiple OS (windows, 
linux, osx). For example, internet protocol numbers and tcp/ip ports.

In other cases, some constants only apply to windows, such as device codes [1]. 
I brought up the device codes specifically, because in windows 8, a few new 
codes have been added. We wouldn't want to maintain one master list of device 
codes, because while FILE_DEVICE_EHSTOR (0x00000046) is OK for windows 8, it'd 
be invalid for windows 7. 

[1]. 
http://code.google.com/p/volatility/source/browse/trunk/volatility/plugins/malwa
re/devicetree.py#62
[2]. http://redplait.blogspot.com/2012/03/new-devicetypes-in-wdk-8-consumer.html

Original issue reported on code.google.com by michael.hale@gmail.com on 10 Jul 2012 at 2:08

GoogleCodeExporter commented 9 years ago
The linux profiles (in the scudette branch) heavily rely on constants since 
they add the system map as profile constants. Because constants are handled by 
the profile object (i.e. its not just a dict) it is possible to return 
NoneObject() when a constant is missing so you can easily write cross profile 
code.

The VolatilityMagic idea was an early attempt to add constants to profiles, but 
its too complex and ... well magical (because it can also run code). There are 
lots of constants present currently in trunk in VolatilityMagic objects (e.g. 
dtb sigs/kdbg sigs etc).

Original comment by scude...@gmail.com on 10 Jul 2012 at 2:54

GoogleCodeExporter commented 9 years ago

Original comment by michael.hale@gmail.com on 1 Feb 2013 at 5:02

GoogleCodeExporter commented 9 years ago
Upon further investigation, there's nothing a constant can provide that 
volatility magic can't, so this isn't really a need for this. 

Original comment by michael.hale@gmail.com on 7 Mar 2014 at 4:41