From 01043b9f3e5c3836b5ade29bd37f5c3237ae52a2 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 4 Nov 2017 15:47:52 +0000 Subject: [PATCH] Rework isf_filename to isf_url since we can load it from a remote location if required. --- volatility/framework/automagic/linux.py | 7 ++++--- volatility/framework/automagic/pdbscan.py | 11 ++++++----- volatility/framework/layers/registry.py | 2 +- volatility/framework/symbols/intermed.py | 10 +++++----- volatility/framework/symbols/linux/__init__.py | 9 +++------ volatility/framework/symbols/windows/__init__.py | 6 +++--- 6 files changed, 22 insertions(+), 23 deletions(-) diff --git a/volatility/framework/automagic/linux.py b/volatility/framework/automagic/linux.py index 5fda75a79..805826285 100644 --- a/volatility/framework/automagic/linux.py +++ b/volatility/framework/automagic/linux.py @@ -1,4 +1,5 @@ import logging +import pathlib from volatility.framework import interfaces, constants from volatility.framework.automagic import linux_symbol_cache @@ -55,13 +56,13 @@ class LinuxSymbolFinder(interfaces.automagic.AutomagicInterface): vollog.debug("Identified banner: {}".format(repr(banner))) symbol_files = self._linux_banners[banner] if symbol_files: - isf_path = symbol_files[0] + isf_path = pathlib.Path(symbol_files[0]).as_uri() vollog.debug("Using symbol library: {}".format(symbol_files[0])) clazz = "volatility.framework.symbols.linux.LinuxKernelIntermedSymbols" # Set the discovered options path_join = interfaces.configuration.path_join context.config[path_join(config_path, requirement.name, "class")] = clazz - context.config[path_join(config_path, requirement.name, "isf_filepath")] = isf_path + context.config[path_join(config_path, requirement.name, "isf_url")] = isf_path # Construct the appropriate symbol table requirement.construct(context, config_path) break @@ -97,7 +98,7 @@ class LintelStacker(interfaces.automagic.StackerLayerInterface): isf_path = symbol_files[0] table_name = context.symbol_space.free_table_name('LintelStacker') table = linux.LinuxKernelIntermedSymbols(context, 'temporary.' + table_name, name = table_name, - isf_filepath = isf_path) + isf_url = isf_path) context.symbol_space.append(table) kaslr_shift, _ = LinuxUtilities.find_aslr(context, table_name, layer_name, progress_callback = progress_callback) diff --git a/volatility/framework/automagic/pdbscan.py b/volatility/framework/automagic/pdbscan.py index f54c0bde0..2a358669b 100644 --- a/volatility/framework/automagic/pdbscan.py +++ b/volatility/framework/automagic/pdbscan.py @@ -169,6 +169,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): :param context: Context on which to operate :type context: ~volatility.framework.interfaces.context.ContextInterface """ + join = interfaces.configuration.path_join for config_path, sub_config_path, requirement in self._symbol_requirements: # TODO: Potentially think about multiple symbol requirements in both the same and different levels of the requirement tree # TODO: Consider whether a single found kernel can fulfill multiple requirements @@ -191,8 +192,8 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): vollog.debug("Using symbol library: {}".format(midfix)) clazz = "volatility.framework.symbols.windows.WindowsKernelIntermedSymbols" # Set the discovered options - context.config[interfaces.configuration.path_join(sub_config_path, "class")] = clazz - context.config[interfaces.configuration.path_join(sub_config_path, "isf_filepath")] = isf_path + context.config[join(sub_config_path, "class")] = clazz + context.config[join(sub_config_path, "isf_url")] = isf_path # Construct the appropriate symbol table requirement.construct(context, config_path) break @@ -239,9 +240,9 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): if virtual_layer_name and isinstance(context.memory[virtual_layer_name], layers.intel.Intel): # TODO: Verify this is a windows image vlayer = context.memory[virtual_layer_name] - physical_layer_name = context.config.get( - interfaces.configuration.path_join(vlayer.config_path, 'memory_layer'), None) - kvo_path = interfaces.configuration.path_join(virtual_config_path, 'kernel_virtual_offset') + join = interfaces.configuration.path_join + physical_layer_name = context.config.get(join(vlayer.config_path, 'memory_layer'), None) + kvo_path = join(virtual_config_path, 'kernel_virtual_offset') for kernel in kernels: # It seems the kernel is loaded at a fixed mapping (presumably because the memory manager hasn't started yet) if kernel['mz_offset'] is None: diff --git a/volatility/framework/layers/registry.py b/volatility/framework/layers/registry.py index fa72990bd..b54f36033 100644 --- a/volatility/framework/layers/registry.py +++ b/volatility/framework/layers/registry.py @@ -30,7 +30,7 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface): reg_path = "file://" + os_path.join(os_path.dirname(__file__), '..', 'symbols', 'windows', 'reg.json') table = intermed.IntermediateSymbolTable(context = context, config_path = config_path, - name = self._reg_table_name, isf_filepath = reg_path) + name = self._reg_table_name, isf_url = reg_path) context.symbol_space.append(table) self.hive = self.context.object(self._table_name + constants.BANG + "_CMHIVE", self._base_layer, diff --git a/volatility/framework/symbols/intermed.py b/volatility/framework/symbols/intermed.py index 9e4abf730..32247b622 100644 --- a/volatility/framework/symbols/intermed.py +++ b/volatility/framework/symbols/intermed.py @@ -48,7 +48,7 @@ def _construct_delegate_function(name, is_property = False): class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): - def __init__(self, context, config_path, name, isf_filepath, native_types = None, validate = True): + def __init__(self, context, config_path, name, isf_url, native_types = None, validate = True): """Instantiates an SymbolTable based on an IntermediateSymbolFormat JSON file. This is validated against the appropriate schema. The validation can be disabled by passing validate = False, but this should almost never be done. @@ -59,8 +59,8 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): :type config_path: :param name: :type name: - :param isf_filepath: - :type isf_filepath: + :param isf_url: + :type isf_url: :param native_types: :type native_types: :param validate: Determines whether the ISF file will be validated against the appropriate schema @@ -69,13 +69,13 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): # Check there are no obvious errors # Open the file and test the version self._versions = dict([(x.version, x) for x in class_subclasses(ISFormatTable)]) - fp = interfaces.layers.ResourceAccessor().open(isf_filepath) + fp = interfaces.layers.ResourceAccessor().open(isf_url) json_object = json.load(fp) fp.close() # Validation is expensive, but we cache to store the hashes of successfully validated json objects if validate and not schemas.validate(json_object): - raise exceptions.SymbolSpaceError("File does not pass version validation: {}".format(url.geturl())) + raise exceptions.SymbolSpaceError("File does not pass version validation: {}".format(isf_url)) metadata = json_object.get('metadata', None) diff --git a/volatility/framework/symbols/linux/__init__.py b/volatility/framework/symbols/linux/__init__.py index 6302a58f8..8219e35aa 100644 --- a/volatility/framework/symbols/linux/__init__.py +++ b/volatility/framework/symbols/linux/__init__.py @@ -1,6 +1,4 @@ -from volatility.framework import exceptions from volatility.framework.configuration import requirements -from volatility.framework.interfaces import symbols from volatility.framework.symbols import intermed from volatility.framework.symbols.linux import extensions @@ -8,8 +6,8 @@ from volatility.framework.symbols.linux import extensions class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): provides = {"type": "interface"} - def __init__(self, context, config_path, name, isf_filepath): - super().__init__(context = context, config_path = config_path, name = name, isf_filepath = isf_filepath) + def __init__(self, context, config_path, name, isf_url): + super().__init__(context = context, config_path = config_path, name = name, isf_url = isf_url) # Set-up Linux specific types self.set_type_class('file', extensions.struct_file) @@ -19,8 +17,7 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): self.set_type_class('task_struct', extensions.task_struct) self.set_type_class('vm_area_struct', extensions.vm_area_struct) - @classmethod def get_requirements(cls): - return [requirements.StringRequirement("isf_filepath", + return [requirements.StringRequirement("isf_url", description = "JSON file containing the symbols encoded in the Intermediate Symbol Format")] diff --git a/volatility/framework/symbols/windows/__init__.py b/volatility/framework/symbols/windows/__init__.py index 2a2411e1c..7bc0a1fdd 100644 --- a/volatility/framework/symbols/windows/__init__.py +++ b/volatility/framework/symbols/windows/__init__.py @@ -7,8 +7,8 @@ from volatility.framework.symbols.windows.extensions import registry class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable): provides = {"type": "interface"} - def __init__(self, context, config_path, name, isf_filepath): - super().__init__(context = context, config_path = config_path, name = name, isf_filepath = isf_filepath) + def __init__(self, context, config_path, name, isf_url): + super().__init__(context = context, config_path = config_path, name = name, isf_url = isf_url) # Set-up windows specific types self.set_type_class('_ETHREAD', extensions._ETHREAD) @@ -22,5 +22,5 @@ class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable): @classmethod def get_requirements(cls): - return [requirements.StringRequirement("isf_filepath", + return [requirements.StringRequirement("isf_url", description = "JSON file containing the symbols encoded in the Intermediate Symbol Format")]