Initial attempts at cloning a symbol table

volatility/framework/automagic/linux.py

@@ -256,9 +256,8 @@ class LinuxUtilities(object):
                                context: interfaces.context.ContextInterface,
                                symbol_table: str,
                                layer_name: str,
-                               aslr_shift = 0):
+                               aslr_shift = 0) -> str:
 
-        sym_table = context.symbol_space[symbol_table]
         sym_layer = context.layers[layer_name]
 
         if aslr_shift == 0:
@@ -267,7 +266,7 @@ class LinuxUtilities(object):
             aslr_layer = sym_layer.config['memory_layer']
             _, aslr_shift = cls.find_aslr(context, symbol_table, aslr_layer)
 
-        symbols.mask_symbol_table(sym_table, sym_layer.address_mask, aslr_shift)
+        return symbols.mask_symbol_table(context, symbol_table, sym_layer.address_mask, aslr_shift)
 
     @classmethod
     def find_aslr(cls,

volatility/framework/automagic/mac.py

@@ -180,9 +180,8 @@ class MacUtilities(object):
                                context: interfaces.context.ContextInterface,
                                symbol_table: str,
                                layer_name: str,
-                               aslr_shift = 0):
+                               aslr_shift = 0) -> str:
 
-        sym_table = context.symbol_space[symbol_table]
         sym_layer = context.layers[layer_name]
 
         if aslr_shift == 0:
@@ -191,7 +190,7 @@ class MacUtilities(object):
             aslr_layer = sym_layer.config['memory_layer']
             aslr_shift = cls.find_aslr(context, symbol_table, aslr_layer)
 
-        symbols.mask_symbol_table(sym_table, sym_layer.address_mask, aslr_shift)
+        return symbols.mask_symbol_table(context, symbol_table, sym_layer.address_mask, aslr_shift)
 
     @classmethod
     def _scan_generator(cls, context, layer_name, progress_callback):

volatility/framework/plugins/linux/check_afinfo.py

@@ -64,7 +64,7 @@ class Check_afinfo(plugins.PluginInterface):
     def _generator(self):
         linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary'])
 
-        vmlinux = contexts.Module(self.context, self.config['vmlinux'], self.config['primary'], 0)
+        vmlinux = contexts.Module(self.context, masked_vmlinux_symbols, self.config['primary'], 0)
 
         op_members = vmlinux.get_type('file_operations').members
         seq_members = vmlinux.get_type('seq_operations').members

volatility/framework/plugins/linux/check_syscall.py

@@ -122,9 +122,10 @@ class Check_syscall(plugins.PluginInterface):
 
     # TODO - add finding and parsing unistd.h once cached file enumeration is added
     def _generator(self):
-        linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary'])
+        masked_symbol_table = linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'],
+                                                                          self.config['primary'])
 
-        vmlinux = contexts.Module(self.context, self.config['vmlinux'], self.config['primary'], 0)
+        vmlinux = contexts.Module(self.context, masked_symbol_table, self.config['primary'], 0)
 
         ptr_sz = vmlinux.get_type("pointer").size
         if ptr_sz == 4:

volatility/framework/plugins/linux/lsmod.py

@@ -5,8 +5,7 @@
 found in Linux's /proc file system."""
 
 import logging
-
-from typing import List, Generator, Iterable
+from typing import List, Iterable
 
 from volatility.framework import contexts
 from volatility.framework import exceptions, renderers, constants, interfaces
@@ -46,9 +45,9 @@ class Lsmod(plugins.PluginInterface):
 
         This function will throw a SymbolError exception if kernel module support is not enabled.
         """
-        linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name)
+        masked_vmlinux_symbols = linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name)
 
-        vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0)
+        vmlinux = contexts.Module(context, masked_vmlinux_symbols, layer_name, 0)
 
         modules = vmlinux.object_from_symbol(symbol_name = "modules").cast("list_head")
 

volatility/framework/plugins/linux/lsof.py

@@ -45,7 +45,8 @@ class Lsof(plugins.PluginInterface):
                 yield (0, (pid, name, fd_num, full_path))
 
     def run(self):
-        linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary'])
+        masked_vmlinux_symbols = linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'],
+                                                                             self.config['primary'])
 
         filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
 
@@ -53,5 +54,5 @@ class Lsof(plugins.PluginInterface):
                                   self._generator(
                                       pslist.PsList.list_tasks(self.context,
                                                                self.config['primary'],
-                                                               self.config['vmlinux'],
+                                                               masked_vmlinux_symbols,
                                                                filter_func = filter_func)))

volatility/framework/plugins/linux/pslist.py

@@ -75,9 +75,9 @@ class PsList(interfaces.plugins.PluginInterface):
         Yields:
             Process objects
         """
-        linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name)
+        masked_vmlinux_symbols = linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name)
 
-        vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0)
+        vmlinux = contexts.Module(context, masked_vmlinux_symbols, layer_name, 0)
 
         init_task = vmlinux.object_from_symbol(symbol_name = "init_task")
 

volatility/framework/plugins/mac/check_syscall.py

@@ -2,10 +2,10 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 import logging
-from typing import List, Iterator, Any
+from typing import List
 
 from volatility.framework import exceptions, interfaces
-from volatility.framework import renderers, constants, contexts
+from volatility.framework import renderers, contexts
 from volatility.framework.automagic import mac
 from volatility.framework.configuration import requirements
 from volatility.framework.interfaces import plugins
@@ -29,11 +29,12 @@ class Check_syscall(plugins.PluginInterface):
         ]
 
     def _generator(self):
-        mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
+        masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'],
+                                                                        self.config['primary'])
 
-        kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
+        kernel = contexts.Module(self._context, masked_darwin_symbols, self.config['primary'], 0)
 
-        mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin'])
+        mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], masked_darwin_symbols)
 
         handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
 

volatility/framework/plugins/mac/check_sysctl.py

@@ -2,16 +2,16 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 import logging
-from typing import List, Iterator, Any
+from typing import List
 
 import volatility
 from volatility.framework import exceptions, interfaces
-from volatility.framework import renderers, constants, contexts
+from volatility.framework import renderers, contexts
 from volatility.framework.automagic import mac
 from volatility.framework.configuration import requirements
 from volatility.framework.interfaces import plugins
-from volatility.framework.renderers import format_hints
 from volatility.framework.objects import utility
+from volatility.framework.renderers import format_hints
 from volatility.plugins.mac import lsmod
 
 vollog = logging.getLogger(__name__)
@@ -112,11 +112,12 @@ class Check_sysctl(plugins.PluginInterface):
                 break
 
     def _generator(self):
-        mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
+        masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'],
+                                                                        self.config['primary'])
 
-        kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
+        kernel = contexts.Module(self._context, masked_darwin_symbols, self.config['primary'], 0)
 
-        mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin'])
+        mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], masked_darwin_symbols)
 
         handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
 

volatility/framework/plugins/mac/check_trap_table.py

@@ -3,10 +3,10 @@
 #
 
 import logging
-from typing import List, Iterator, Any
+from typing import List
 
 from volatility.framework import exceptions, interfaces
-from volatility.framework import renderers, constants, contexts
+from volatility.framework import renderers, contexts
 from volatility.framework.automagic import mac
 from volatility.framework.configuration import requirements
 from volatility.framework.interfaces import plugins
@@ -30,11 +30,12 @@ class Check_trap_table(plugins.PluginInterface):
         ]
 
     def _generator(self):
-        mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
+        masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'],
+                                                                        self.config['primary'])
 
-        kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
+        kernel = contexts.Module(self._context, masked_darwin_symbols, self.config['primary'], 0)
 
-        mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin'])
+        mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], masked_darwin_symbols)
 
         handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
 

volatility/framework/plugins/mac/ifconfig.py

@@ -2,12 +2,11 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 
-from volatility.framework import exceptions, renderers, interfaces, contexts
+from volatility.framework import exceptions, renderers, contexts
 from volatility.framework.automagic import mac
 from volatility.framework.configuration import requirements
 from volatility.framework.interfaces import plugins
 from volatility.framework.objects import utility
-from volatility.framework.renderers import format_hints
 
 
 class Ifconfig(plugins.PluginInterface):
@@ -23,9 +22,10 @@ class Ifconfig(plugins.PluginInterface):
         ]
 
     def _generator(self):
-        mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
+        masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'],
+                                                                        self.config['primary'])
 
-        kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
+        kernel = contexts.Module(self._context, masked_darwin_symbols, self.config['primary'], 0)
 
         try:
             list_head = kernel.object_from_symbol(symbol_name = "ifnet_head")

volatility/framework/plugins/mac/lsmod.py

@@ -37,9 +37,9 @@ class Lsmod(plugins.PluginInterface):
         Returns:
             A list of modules from the `layer_name` layer
         """
-        mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name)
+        masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name)
 
-        kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
+        kernel = contexts.Module(context, masked_darwin_symbols, layer_name, 0)
 
         kmod_ptr = kernel.object_from_symbol(symbol_name = "kmod")
 

volatility/framework/plugins/mac/netstat.py

@@ -99,7 +99,7 @@ class Netstat(plugins.PluginInterface):
                                "{}/{:d}".format(task_name, pid)))
 
     def run(self):
-        # mac.MacUtilities.aslr_mask_symbol_table(self.config, self.context)
+        # masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(self.config, self.context)
 
         return renderers.TreeGrid([("Offset", format_hints.Hex), ("Proto", str), ("Local IP", str), ("Local Port", int),
                                    ("Remote IP", str), ("Remote Port", int), ("State", str), ("Process", str)],

volatility/framework/plugins/mac/pslist.py

@@ -71,9 +71,9 @@ class PsList(interfaces.plugins.PluginInterface):
             The list of process objects from the processes linked list after filtering
         """
 
-        mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name)
+        masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name)
 
-        kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
+        kernel = contexts.Module(context, masked_darwin_symbols, layer_name, 0)
 
         kernel_as = context.layers[layer_name]
 

volatility/framework/plugins/mac/tasks.py

@@ -34,9 +34,9 @@ class Tasks(pslist.PsList):
             The list of task objects from the `layer_name` layer's `tasks` list after filtering
         """
 
-        mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name)
+        masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name)
 
-        kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
+        kernel = contexts.Module(context, masked_darwin_symbols, layer_name, 0)
 
         kernel_as = context.layers[layer_name]
 

volatility/framework/plugins/mac/timers.py

@@ -2,16 +2,14 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 import logging
-from typing import List, Iterator, Any
+from typing import List
 
-import volatility
 from volatility.framework import exceptions, interfaces
-from volatility.framework import renderers, constants, contexts
+from volatility.framework import renderers, contexts
 from volatility.framework.automagic import mac
 from volatility.framework.configuration import requirements
 from volatility.framework.interfaces import plugins
 from volatility.framework.renderers import format_hints
-from volatility.framework.objects import utility
 from volatility.plugins.mac import lsmod
 
 vollog = logging.getLogger(__name__)
@@ -31,11 +29,12 @@ class Timers(plugins.PluginInterface):
         ]
 
     def _generator(self):
-        mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
+        masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'],
+                                                                        self.config['primary'])
 
-        kernel = contexts.Module(self.context, self.config['darwin'], self.config['primary'], 0)
+        kernel = contexts.Module(self.context, masked_darwin_symbols, self.config['primary'], 0)
 
-        mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin'])
+        mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], masked_darwin_symbols)
 
         handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
 
@@ -72,7 +71,7 @@ class Timers(plugins.PluginInterface):
                 module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, handler)
 
                 yield (0, (format_hints.Hex(handler), format_hints.Hex(timer.param0), format_hints.Hex(timer.param1), \
-                            timer.deadline, entry_time, module_name, symbol_name))
+                           timer.deadline, entry_time, module_name, symbol_name))
 
     def run(self):
         return renderers.TreeGrid([("Function", format_hints.Hex), ("Param 0", format_hints.Hex),

volatility/framework/plugins/mac/trustedbsd.py

@@ -31,9 +31,10 @@ class trustedbsd(plugins.PluginInterface):
         ]
 
     def _generator(self, mods: Iterator[Any]):
-        mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
+        masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'],
+                                                                        self.config['primary'])
 
-        kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
+        kernel = contexts.Module(self._context, masked_darwin_symbols, self.config['primary'], 0)
 
         handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
 

volatility/framework/symbols/__init__.py

@@ -4,6 +4,7 @@
 
 import collections
 import collections.abc
+import copy
 import enum
 import functools
 import logging
@@ -246,20 +247,22 @@ class SymbolSpace(interfaces.symbols.SymbolSpaceInterface):
         return self._membership(SymbolType.ENUM, name)
 
 
-def mask_symbol_table(symbol_table: interfaces.symbols.SymbolTableInterface,
+def mask_symbol_table(context: interfaces.context.ContextInterface,
+                      symbol_table_name: str,
                       address_mask: int = 0,
-                      table_aslr_shift: int = 0):
+                      table_aslr_shift: int = 0) -> str:
     """Alters a symbol table, such that all symbols returned have their address
     masked by the address mask."""
-    original_get_symbol = symbol_table.get_symbol
+    original_table = context.symbol_space[symbol_table_name]
+    new_table = copy.deepcopy(original_table)
+    new_table.name = context.symbol_space.free_table_name(original_table.name + '_masked'.format())
+    context.symbol_space.append(new_table)
+
     cached_symbols = {}  # type: Dict[interfaces.symbols.SymbolInterface, interfaces.symbols.SymbolInterface]
 
-    if hasattr(symbol_table, '_original_get_symbol'):
-        original_get_symbol = symbol_table._original_get_symbol
-
-    @functools.wraps(original_get_symbol)
+    @functools.wraps(original_table.get_symbol)
     def address_masked_get_symbol(*args, **kwargs):
-        symbol = original_get_symbol(*args, **kwargs)
+        symbol = original_table.get_symbol(*args, **kwargs)
         # This is speedy, but may not be very efficient from a memory perspective
         if symbol in cached_symbols:
             return cached_symbols[symbol]
@@ -270,10 +273,9 @@ def mask_symbol_table(symbol_table: interfaces.symbols.SymbolTableInterface,
         cached_symbols[symbol] = new_symbol
         return new_symbol
 
-    symbol_table._original_get_symbol = symbol_table.get_symbol
-    setattr(symbol_table, "get_symbol", address_masked_get_symbol)
+    setattr(new_table, "get_symbol", address_masked_get_symbol)
 
-    return symbol_table
+    return new_table.name
 
 
 def symbol_table_is_64bit(context: interfaces.context.ContextInterface, symbol_table_name: str) -> bool: