Windows: Add filtering by type to handles.

This change adds the '--types' option to the windows.handles plugin,
whereby a user may specify one or more types of handles to filter the
output by.  Any handles not of the type(s) specified are not returned.
Specified types are treated as case-insensitive.

Because the object type index map is generated dynamically,
user-inputted types are not validated against the map of possible object
types.  For example, a user-inputted type of value "Foo" does not raise
an error and will return no results.

volatility3/framework/plugins/windows/handles.py

@@ -60,6 +60,12 @@ def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]
                 description="Process offset in the physical address space",
                 optional=True,
             ),
+            requirements.ListRequirement(
+                name="types",
+                element_type=str,
+                description="Types of handles to include (all other handle types are excluded)",
+                optional=True,
+            ),
         ]
 
     def _decode_pointer(self, value, magic):
@@ -357,6 +363,8 @@ def _generator(self, procs):
             symbol_table=kernel.symbol_table_name,
         )
 
+        object_types = [s.lower() for s in self.config.get("types", [])]
+
         cookie = self.find_cookie(
             context=self.context,
             layer_name=kernel.layer_name,
@@ -380,6 +388,9 @@ def _generator(self, procs):
                     obj_type = entry.get_object_type(type_map, cookie)
                     if obj_type is None:
                         continue
+                    elif object_types and obj_type.lower() not in object_types:
+                        continue
+
                     if obj_type == "File":
                         item = entry.Body.cast("_FILE_OBJECT")
                         obj_name = item.file_name_with_device()