mirror of
https://github.com/Kowntaewook/MCPTrace.git
synced 2026-11-02 04:45:09 +01:00
kwonta3wook
031b8ab298
Add a Linux task/VMA adapter and POSIX path policy checks. Share scanning and output with Windows while preserving its existing VAD fields. Report skipped address spaces and scan coverage, and test both adapters across host platforms.
54 lines
1.6 KiB
Python
54 lines
1.6 KiB
Python
"""MCP artifacts in Windows process virtual memory (Volatility 3)."""
|
|
|
|
from volatility3.framework import interfaces
|
|
from volatility3.framework.configuration import requirements
|
|
from volatility3.framework.objects import utility
|
|
from volatility3.plugins.windows import pslist
|
|
|
|
from mcptrace.volatility import MCPTraceMixin
|
|
|
|
|
|
class MCPTrace(MCPTraceMixin, interfaces.plugins.PluginInterface):
|
|
"""Extract MCP/JSON-RPC candidates and policy findings from Windows VADs."""
|
|
|
|
_required_framework_version = (2, 28, 0)
|
|
_version = (0, 2, 0)
|
|
_target_os = "windows"
|
|
_region_kind = "vad"
|
|
|
|
@classmethod
|
|
def get_requirements(cls):
|
|
return [
|
|
requirements.ModuleRequirement(
|
|
name="kernel", description="Windows x64 kernel", architectures=["Intel64"]
|
|
),
|
|
requirements.VersionRequirement(
|
|
name="pslist", component=pslist.PsList, version=(3, 0, 0)
|
|
),
|
|
*cls.common_requirements(),
|
|
]
|
|
|
|
def _list_processes(self):
|
|
return pslist.PsList.list_processes(
|
|
context=self.context,
|
|
kernel_module_name=self.config["kernel"],
|
|
filter_func=pslist.PsList.create_pid_filter(self.config.get("pid")),
|
|
)
|
|
|
|
@staticmethod
|
|
def _pid(proc):
|
|
return int(proc.UniqueProcessId)
|
|
|
|
@staticmethod
|
|
def _process_name(proc):
|
|
return utility.array_to_string(proc.ImageFileName)
|
|
|
|
@staticmethod
|
|
def _process_layer_name(proc):
|
|
return proc.add_process_layer()
|
|
|
|
@staticmethod
|
|
def _regions(proc):
|
|
for vad in proc.get_vad_root().traverse():
|
|
yield int(vad.get_start()), int(vad.get_size())
|