import volatility.cache as cache import volatility.debug as debug import volatility.poolscan as poolscan import socket import volatility.plugins.overlays.windows.tcpip_vtypes as tcpip_vtypes from volatility.renderers import TreeGrid from volatility.renderers.basic import Address # Python's socket.AF_INET6 is 0x1e but Microsoft defines it # as a constant value of 0x17 in their source code. Thus we # need Microsoft's since that's what is found in memory. AF_INET = 2 AF_INET6 = 0x17 # String representations of INADDR_ANY and INADDR6_ANY inaddr_any = utils.inet_ntop(socket.AF_INET, '\0' * 4) inaddr6_any = utils.inet_ntop(socket.AF_INET6, '\0' * 16) #-------------------------------------------------------------------------------- # pool scanners #-------------------------------------------------------------------------------- class PoolScanUdpEndpoint(poolscan.PoolScanner): """PoolScanner for Udp Endpoints""" def __init__(self, address_space): poolscan.PoolScanner.__init__(self, address_space) self.pooltag = "UdpA" self.struct_name = "_UDP_ENDPOINT"
def v(self): return utils.inet_ntop(socket.AF_INET6, obj.NativeType.v(self))
def v(self): return utils.inet_ntop(socket.AF_INET, struct.pack("<I", obj.NativeType.v(self)))