Python源码示例：volatility.plugins.filescan.PoolScanDriver()
示例1
def __init__(self, config, *args, **kwargs):
common.AbstractScanCommand.__init__(self, config, *args, **kwargs)
self.scanners = [
filescan.PoolScanFile,
filescan.PoolScanDriver,
filescan.PoolScanSymlink,
filescan.PoolScanMutant,
filescan.PoolScanProcess,
modscan.PoolScanModule,
modscan.PoolScanThread,
atoms.PoolScanAtom,
windowstations.PoolScanWind,
]
示例2
def __init__(self, config, *args, **kwargs):
common.AbstractScanCommand.__init__(self, config, *args, **kwargs)
self.scanners = [
filescan.PoolScanFile,
filescan.PoolScanDriver,
filescan.PoolScanSymlink,
filescan.PoolScanMutant,
filescan.PoolScanProcess,
modscan.PoolScanModule,
modscan.PoolScanThread,
atoms.PoolScanAtom,
windowstations.PoolScanWind,
]
示例3
def __init__(self, config, *args, **kwargs):
common.AbstractScanCommand.__init__(self, config, *args, **kwargs)
self.scanners = [
filescan.PoolScanFile,
filescan.PoolScanDriver,
filescan.PoolScanSymlink,
filescan.PoolScanMutant,
filescan.PoolScanProcess,
modscan.PoolScanModule,
modscan.PoolScanThread,
atoms.PoolScanAtom,
windowstations.PoolScanWind,
]
示例4
def __init__(self, config, *args, **kwargs):
common.AbstractScanCommand.__init__(self, config, *args, **kwargs)
self.scanners = [
filescan.PoolScanFile,
filescan.PoolScanDriver,
filescan.PoolScanSymlink,
filescan.PoolScanMutant,
filescan.PoolScanProcess,
modscan.PoolScanModule,
modscan.PoolScanThread,
atoms.PoolScanAtom,
windowstations.PoolScanWind,
]
示例5
def __init__(self, config, *args, **kwargs):
common.AbstractScanCommand.__init__(self, config, *args, **kwargs)
self.scanners = [
filescan.PoolScanFile,
filescan.PoolScanDriver,
filescan.PoolScanSymlink,
filescan.PoolScanMutant,
filescan.PoolScanProcess,
modscan.PoolScanModule,
modscan.PoolScanThread,
atoms.PoolScanAtom,
windowstations.PoolScanWind,
]
示例6
def find_i8042prt(addrspace):
# Do a pool scan
for drv in poolscan.MultiScanInterface(addr_space=addrspace,
scanners=[filescan.PoolScanDriver],
scan_virtual=True).scan():
if 'i8042prt' in drv.DriverName.v():
return drv
return None
# A KeyboardClass device must be attached to the unnamed device that is the main i8042prt keyboard device
