python
python copied to clipboard
add "translate" function in vmi.py
An error occurred while running the psxview plugin:
# python vol.py -l vmi://winxpsp3x86 --profile=WinXPSP2x86 psxview
AttributeError: 'PyVmiAddressSpace' object has no attribute 'translate'
After checking the libvmi address plugin, there is no translate function in vmi.py file. So I tried to add these code at the bottom:
Def translate(self, addr):
Return self.vmi.translate_kv2p(addr)
And I also modified the code in [malware/psxview.py] (https://github.com/volatilityfoundation/volatility/pull/362/commits/ca42f0c465c9acd9cc0b70e468af23a869e547fa) then I got the results:
Offset(P) Name PID pslist psscan thrdproc pspcid csrss session deskthrd ExitTime
---------- -------------------- ------ ------ ------ -------- ------ ----- ------- -------- --------
0x065e3da0 HelpSvc.exe 1580 True True True True True True True
0x06589da0 lsass.exe 556 True True True True True True True
0x0658d988 svchost.exe 876 True True True True True True True
0x065c0da0 svchost.exe 924 True True True True True True True
0x0664c558 wpabaln.exe 1788 True True True True True True True
0x0660f390 msmsgs.exe 1472 True True True True True True True
0x06625c10 ctfmon.exe 1444 True True True True True True True
0x064c5020 spoolsv.exe 1252 True True True True True True True
0x06621768 services.exe 544 True True True True True True True
0x06626da0 (?
???w.exe 248 True True True True True True True
0x065fe3c0 wscntfy.exe 276 True True True True True True True
0x066e93d0 svchost.exe 712 True True True True True True True
0x066337e8 wmiprvse.exe 1032 True True True True True True True
0x06624180 svchost.exe 768 True True True True True True True
0x064e2da0 svchost.exe 828 True True True True True True True
0x064df9f8 alg.exe 976 True True True True True True True
0x066383c0 wuauclt.exe 1360 True True True True True True True
0x065b0898 winlogon.exe 500 True True True True True True True
0x064be958 explorer.exe 1300 True True True True True True True
0x066234d8 logon.scr 1228 True True True True True True True
0x06618928 taskmgr.exe 896 True True True True True True True
0x067b7a00 System 4 True True True True False False False
0x06577128 smss.exe 308 True True True True False False False
0x065b9020 csrss.exe 476 True True True True False True True
Is this a correct result, or is this "translate" function right?