Merge pull request #1779 from j-t-1/svcdiff

ikelos · web-flow · commit 63f7cbd44716 · 2025-04-17T21:10:31.000+01:00
Amend SvcDiff comments at top of file
diff --git a/volatility3/framework/plugins/windows/svcdiff.py b/volatility3/framework/plugins/windows/svcdiff.py
@@ -1,15 +1,13 @@
 # This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
-
-# This module attempts to locate skeleton-key like function hooks.
-# It does this by locating the CSystems array through a variety of methods,
-# and then validating the entry for RC4 HMAC (0x17 / 23)
+# This module compares services found through list walking versus scanning,
+# with the aim of finding hidden services.
 #
-# For a thorough walkthrough on how the R&D was performed to develop this plugin,
-# please see our blogpost here:
+# For background of hidden services and a real-world example of the use of this plugin,
+# please see our blogpost:
 #
-# https://volatility-labs.blogspot.com/2021/10/memory-forensics-r-illustrated.html
+# https://volatilityfoundation.org/memory-forensics-rd-illustrated-detecting-hidden-windows-services/
 
 import logging
 

Original file line number	Diff line number	Diff line change
`@@ -1,15 +1,13 @@`
`1`	`1`	`# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0`
`2`	`2`	`# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0`
`3`	`3`	`#`
`4`		`-`
`5`		`-# This module attempts to locate skeleton-key like function hooks.`
`6`		`-# It does this by locating the CSystems array through a variety of methods,`
`7`		`-# and then validating the entry for RC4 HMAC (0x17 / 23)`
	`4`	`+# This module compares services found through list walking versus scanning,`
	`5`	`+# with the aim of finding hidden services.`
`8`	`6`	`#`
`9`		`-# For a thorough walkthrough on how the R&D was performed to develop this plugin,`
`10`		`-# please see our blogpost here:`
	`7`	`+# For background of hidden services and a real-world example of the use of this plugin,`
	`8`	`+# please see our blogpost:`
`11`	`9`	`#`
`12`		`-# https://volatility-labs.blogspot.com/2021/10/memory-forensics-r-illustrated.html`
	`10`	`+# https://volatilityfoundation.org/memory-forensics-rd-illustrated-detecting-hidden-windows-services/`
`13`	`11`
`14`	`12`	`import logging`
`15`	`13`