diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py index ddd9cb78e1..93c8458be6 100644 --- a/volatility3/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -52,6 +52,12 @@ def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface] requirements.PluginRequirement( name="pslist", plugin=pslist.PsList, version=(2, 0, 0) ), + requirements.ListRequirement( + name="types", + element_type=str, + description="Types of handles to include (all other handle types are excluded)", + optional=True, + ), ] def _decode_pointer(self, value, magic): @@ -349,6 +355,8 @@ def _generator(self, procs): symbol_table=kernel.symbol_table_name, ) + object_types = [s.lower() for s in self.config.get("types", [])] + cookie = self.find_cookie( context=self.context, layer_name=kernel.layer_name, @@ -372,6 +380,9 @@ def _generator(self, procs): obj_type = entry.get_object_type(type_map, cookie) if obj_type is None: continue + elif object_types and obj_type.lower() not in object_types: + continue + if obj_type == "File": item = entry.Body.cast("_FILE_OBJECT") obj_name = item.file_name_with_device()