Skip to content

Commit efdbc27

Browse files
committed
Windows: Scheduled tasks - removes special time type
Removes the TaskSchedulerTime dataclass and discards the is_localized value parsed with the timestamp.
1 parent 0413cc5 commit efdbc27

File tree

1 file changed

+7
-17
lines changed

1 file changed

+7
-17
lines changed

volatility3/framework/plugins/windows/scheduled_tasks.py

Lines changed: 7 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -137,16 +137,6 @@ class SidType(enum.Enum):
137137
LogonSession = 11
138138

139139

140-
@dataclasses.dataclass
141-
class TaskSchedulerTime:
142-
"""
143-
A class containing datetime information about when a task will run
144-
"""
145-
146-
is_localized: bool
147-
filetime: Optional[datetime.datetime]
148-
149-
150140
@dataclasses.dataclass
151141
class TaskSchedulerTimePeriod:
152142
"""
@@ -196,13 +186,13 @@ class TaskSchedulerTimePeriod:
196186

197187
class _ScheduledTasksReader(io.BytesIO):
198188

199-
def read_task_scheduler_time(self) -> Optional[Tuple[bool, datetime.datetime]]:
200-
is_localized = bool(self.read_aligned_u1())
189+
def read_task_scheduler_time(self) -> Optional[datetime.datetime]:
190+
_ = bool(self.read_aligned_u1()) # is_localized
201191
filetime = self.decode_filetime()
202192
if filetime is None:
203193
return None
204194

205-
return is_localized, filetime
195+
return filetime
206196

207197
def read_bool(self, aligned=False) -> Optional[bool]:
208198
try:
@@ -584,8 +574,8 @@ def decode(cls, reader: _ScheduledTasksReader) -> Optional["_JobSchedule"]:
584574
reader.seek(4, io.SEEK_CUR) # pad
585575

586576
return cls(
587-
start_boundary[1] if start_boundary is not None else None,
588-
end_boundary[1] if end_boundary is not None else None,
577+
start_boundary,
578+
end_boundary,
589579
repetition_interval_secs,
590580
repetition_duration_secs,
591581
execution_time_limit_secs,
@@ -833,8 +823,8 @@ def _decode_generic_trigger(
833823
reader.seek((8 - (reader.tell() - cur)) % 8, io.SEEK_CUR) # pad to block
834824

835825
return cls(
836-
start_boundary[1] if start_boundary is not None else None,
837-
end_boundary[1] if end_boundary is not None else None,
826+
start_boundary,
827+
end_boundary,
838828
repetition_interval_secs,
839829
trigger_enabled,
840830
trigger_type,

0 commit comments

Comments
 (0)