From 2748ce32d8c52f86f0067094eca23bc49aaa7af8 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 9 Apr 2020 02:09:30 +0100 Subject: [PATCH] Initial attempts at cloning a symbol table --- volatility/framework/automagic/linux.py | 5 ++-- volatility/framework/automagic/mac.py | 5 ++-- .../framework/plugins/linux/check_afinfo.py | 2 +- .../framework/plugins/linux/check_syscall.py | 5 ++-- volatility/framework/plugins/linux/lsmod.py | 7 +++--- volatility/framework/plugins/linux/lsof.py | 5 ++-- volatility/framework/plugins/linux/pslist.py | 4 ++-- .../framework/plugins/mac/check_syscall.py | 11 +++++---- .../framework/plugins/mac/check_sysctl.py | 13 +++++----- .../framework/plugins/mac/check_trap_table.py | 11 +++++---- volatility/framework/plugins/mac/ifconfig.py | 8 +++---- volatility/framework/plugins/mac/lsmod.py | 4 ++-- volatility/framework/plugins/mac/netstat.py | 2 +- volatility/framework/plugins/mac/pslist.py | 4 ++-- volatility/framework/plugins/mac/tasks.py | 4 ++-- volatility/framework/plugins/mac/timers.py | 15 ++++++------ .../framework/plugins/mac/trustedbsd.py | 5 ++-- volatility/framework/symbols/__init__.py | 24 ++++++++++--------- 18 files changed, 69 insertions(+), 65 deletions(-) diff --git a/volatility/framework/automagic/linux.py b/volatility/framework/automagic/linux.py index 8c67b875f..0bbb72542 100644 --- a/volatility/framework/automagic/linux.py +++ b/volatility/framework/automagic/linux.py @@ -256,9 +256,8 @@ class LinuxUtilities(object): context: interfaces.context.ContextInterface, symbol_table: str, layer_name: str, - aslr_shift = 0): + aslr_shift = 0) -> str: - sym_table = context.symbol_space[symbol_table] sym_layer = context.layers[layer_name] if aslr_shift == 0: @@ -267,7 +266,7 @@ class LinuxUtilities(object): aslr_layer = sym_layer.config['memory_layer'] _, aslr_shift = cls.find_aslr(context, symbol_table, aslr_layer) - symbols.mask_symbol_table(sym_table, sym_layer.address_mask, aslr_shift) + return symbols.mask_symbol_table(context, symbol_table, sym_layer.address_mask, aslr_shift) @classmethod def find_aslr(cls, diff --git a/volatility/framework/automagic/mac.py b/volatility/framework/automagic/mac.py index 50f76a9ca..c27173a1e 100644 --- a/volatility/framework/automagic/mac.py +++ b/volatility/framework/automagic/mac.py @@ -180,9 +180,8 @@ class MacUtilities(object): context: interfaces.context.ContextInterface, symbol_table: str, layer_name: str, - aslr_shift = 0): + aslr_shift = 0) -> str: - sym_table = context.symbol_space[symbol_table] sym_layer = context.layers[layer_name] if aslr_shift == 0: @@ -191,7 +190,7 @@ class MacUtilities(object): aslr_layer = sym_layer.config['memory_layer'] aslr_shift = cls.find_aslr(context, symbol_table, aslr_layer) - symbols.mask_symbol_table(sym_table, sym_layer.address_mask, aslr_shift) + return symbols.mask_symbol_table(context, symbol_table, sym_layer.address_mask, aslr_shift) @classmethod def _scan_generator(cls, context, layer_name, progress_callback): diff --git a/volatility/framework/plugins/linux/check_afinfo.py b/volatility/framework/plugins/linux/check_afinfo.py index 2de641fcf..ba987cb7c 100644 --- a/volatility/framework/plugins/linux/check_afinfo.py +++ b/volatility/framework/plugins/linux/check_afinfo.py @@ -64,7 +64,7 @@ class Check_afinfo(plugins.PluginInterface): def _generator(self): linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary']) - vmlinux = contexts.Module(self.context, self.config['vmlinux'], self.config['primary'], 0) + vmlinux = contexts.Module(self.context, masked_vmlinux_symbols, self.config['primary'], 0) op_members = vmlinux.get_type('file_operations').members seq_members = vmlinux.get_type('seq_operations').members diff --git a/volatility/framework/plugins/linux/check_syscall.py b/volatility/framework/plugins/linux/check_syscall.py index 452019905..4bf7d690b 100644 --- a/volatility/framework/plugins/linux/check_syscall.py +++ b/volatility/framework/plugins/linux/check_syscall.py @@ -122,9 +122,10 @@ class Check_syscall(plugins.PluginInterface): # TODO - add finding and parsing unistd.h once cached file enumeration is added def _generator(self): - linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary']) + masked_symbol_table = linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], + self.config['primary']) - vmlinux = contexts.Module(self.context, self.config['vmlinux'], self.config['primary'], 0) + vmlinux = contexts.Module(self.context, masked_symbol_table, self.config['primary'], 0) ptr_sz = vmlinux.get_type("pointer").size if ptr_sz == 4: diff --git a/volatility/framework/plugins/linux/lsmod.py b/volatility/framework/plugins/linux/lsmod.py index 45a1b4c25..ee2787428 100644 --- a/volatility/framework/plugins/linux/lsmod.py +++ b/volatility/framework/plugins/linux/lsmod.py @@ -5,8 +5,7 @@ found in Linux's /proc file system.""" import logging - -from typing import List, Generator, Iterable +from typing import List, Iterable from volatility.framework import contexts from volatility.framework import exceptions, renderers, constants, interfaces @@ -46,9 +45,9 @@ class Lsmod(plugins.PluginInterface): This function will throw a SymbolError exception if kernel module support is not enabled. """ - linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name) + masked_vmlinux_symbols = linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name) - vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0) + vmlinux = contexts.Module(context, masked_vmlinux_symbols, layer_name, 0) modules = vmlinux.object_from_symbol(symbol_name = "modules").cast("list_head") diff --git a/volatility/framework/plugins/linux/lsof.py b/volatility/framework/plugins/linux/lsof.py index 57b0565d6..a1a97c6ef 100644 --- a/volatility/framework/plugins/linux/lsof.py +++ b/volatility/framework/plugins/linux/lsof.py @@ -45,7 +45,8 @@ class Lsof(plugins.PluginInterface): yield (0, (pid, name, fd_num, full_path)) def run(self): - linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary']) + masked_vmlinux_symbols = linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], + self.config['primary']) filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) @@ -53,5 +54,5 @@ class Lsof(plugins.PluginInterface): self._generator( pslist.PsList.list_tasks(self.context, self.config['primary'], - self.config['vmlinux'], + masked_vmlinux_symbols, filter_func = filter_func))) diff --git a/volatility/framework/plugins/linux/pslist.py b/volatility/framework/plugins/linux/pslist.py index dd486f166..60b7e093c 100644 --- a/volatility/framework/plugins/linux/pslist.py +++ b/volatility/framework/plugins/linux/pslist.py @@ -75,9 +75,9 @@ class PsList(interfaces.plugins.PluginInterface): Yields: Process objects """ - linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name) + masked_vmlinux_symbols = linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name) - vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0) + vmlinux = contexts.Module(context, masked_vmlinux_symbols, layer_name, 0) init_task = vmlinux.object_from_symbol(symbol_name = "init_task") diff --git a/volatility/framework/plugins/mac/check_syscall.py b/volatility/framework/plugins/mac/check_syscall.py index 091e8cd20..4e491f60f 100644 --- a/volatility/framework/plugins/mac/check_syscall.py +++ b/volatility/framework/plugins/mac/check_syscall.py @@ -2,10 +2,10 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from typing import List, Iterator, Any +from typing import List from volatility.framework import exceptions, interfaces -from volatility.framework import renderers, constants, contexts +from volatility.framework import renderers, contexts from volatility.framework.automagic import mac from volatility.framework.configuration import requirements from volatility.framework.interfaces import plugins @@ -29,11 +29,12 @@ class Check_syscall(plugins.PluginInterface): ] def _generator(self): - mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary']) + masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], + self.config['primary']) - kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0) + kernel = contexts.Module(self._context, masked_darwin_symbols, self.config['primary'], 0) - mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin']) + mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], masked_darwin_symbols) handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods) diff --git a/volatility/framework/plugins/mac/check_sysctl.py b/volatility/framework/plugins/mac/check_sysctl.py index 3f7ec1e2b..453357578 100644 --- a/volatility/framework/plugins/mac/check_sysctl.py +++ b/volatility/framework/plugins/mac/check_sysctl.py @@ -2,16 +2,16 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from typing import List, Iterator, Any +from typing import List import volatility from volatility.framework import exceptions, interfaces -from volatility.framework import renderers, constants, contexts +from volatility.framework import renderers, contexts from volatility.framework.automagic import mac from volatility.framework.configuration import requirements from volatility.framework.interfaces import plugins -from volatility.framework.renderers import format_hints from volatility.framework.objects import utility +from volatility.framework.renderers import format_hints from volatility.plugins.mac import lsmod vollog = logging.getLogger(__name__) @@ -112,11 +112,12 @@ class Check_sysctl(plugins.PluginInterface): break def _generator(self): - mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary']) + masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], + self.config['primary']) - kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0) + kernel = contexts.Module(self._context, masked_darwin_symbols, self.config['primary'], 0) - mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin']) + mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], masked_darwin_symbols) handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods) diff --git a/volatility/framework/plugins/mac/check_trap_table.py b/volatility/framework/plugins/mac/check_trap_table.py index 2ea026716..af5fd5377 100644 --- a/volatility/framework/plugins/mac/check_trap_table.py +++ b/volatility/framework/plugins/mac/check_trap_table.py @@ -3,10 +3,10 @@ # import logging -from typing import List, Iterator, Any +from typing import List from volatility.framework import exceptions, interfaces -from volatility.framework import renderers, constants, contexts +from volatility.framework import renderers, contexts from volatility.framework.automagic import mac from volatility.framework.configuration import requirements from volatility.framework.interfaces import plugins @@ -30,11 +30,12 @@ class Check_trap_table(plugins.PluginInterface): ] def _generator(self): - mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary']) + masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], + self.config['primary']) - kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0) + kernel = contexts.Module(self._context, masked_darwin_symbols, self.config['primary'], 0) - mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin']) + mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], masked_darwin_symbols) handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods) diff --git a/volatility/framework/plugins/mac/ifconfig.py b/volatility/framework/plugins/mac/ifconfig.py index 03c58dcd9..f22c1fdce 100644 --- a/volatility/framework/plugins/mac/ifconfig.py +++ b/volatility/framework/plugins/mac/ifconfig.py @@ -2,12 +2,11 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import exceptions, renderers, interfaces, contexts +from volatility.framework import exceptions, renderers, contexts from volatility.framework.automagic import mac from volatility.framework.configuration import requirements from volatility.framework.interfaces import plugins from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints class Ifconfig(plugins.PluginInterface): @@ -23,9 +22,10 @@ class Ifconfig(plugins.PluginInterface): ] def _generator(self): - mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary']) + masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], + self.config['primary']) - kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0) + kernel = contexts.Module(self._context, masked_darwin_symbols, self.config['primary'], 0) try: list_head = kernel.object_from_symbol(symbol_name = "ifnet_head") diff --git a/volatility/framework/plugins/mac/lsmod.py b/volatility/framework/plugins/mac/lsmod.py index fe95a51dc..b4fa47e45 100644 --- a/volatility/framework/plugins/mac/lsmod.py +++ b/volatility/framework/plugins/mac/lsmod.py @@ -37,9 +37,9 @@ class Lsmod(plugins.PluginInterface): Returns: A list of modules from the `layer_name` layer """ - mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name) + masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name) - kernel = contexts.Module(context, darwin_symbols, layer_name, 0) + kernel = contexts.Module(context, masked_darwin_symbols, layer_name, 0) kmod_ptr = kernel.object_from_symbol(symbol_name = "kmod") diff --git a/volatility/framework/plugins/mac/netstat.py b/volatility/framework/plugins/mac/netstat.py index b6c1c5e37..966af8db4 100644 --- a/volatility/framework/plugins/mac/netstat.py +++ b/volatility/framework/plugins/mac/netstat.py @@ -99,7 +99,7 @@ class Netstat(plugins.PluginInterface): "{}/{:d}".format(task_name, pid))) def run(self): - # mac.MacUtilities.aslr_mask_symbol_table(self.config, self.context) + # masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(self.config, self.context) return renderers.TreeGrid([("Offset", format_hints.Hex), ("Proto", str), ("Local IP", str), ("Local Port", int), ("Remote IP", str), ("Remote Port", int), ("State", str), ("Process", str)], diff --git a/volatility/framework/plugins/mac/pslist.py b/volatility/framework/plugins/mac/pslist.py index a3e80801a..f5fe8bbcc 100644 --- a/volatility/framework/plugins/mac/pslist.py +++ b/volatility/framework/plugins/mac/pslist.py @@ -71,9 +71,9 @@ class PsList(interfaces.plugins.PluginInterface): The list of process objects from the processes linked list after filtering """ - mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name) + masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name) - kernel = contexts.Module(context, darwin_symbols, layer_name, 0) + kernel = contexts.Module(context, masked_darwin_symbols, layer_name, 0) kernel_as = context.layers[layer_name] diff --git a/volatility/framework/plugins/mac/tasks.py b/volatility/framework/plugins/mac/tasks.py index 9baf52b4e..3b96f98aa 100644 --- a/volatility/framework/plugins/mac/tasks.py +++ b/volatility/framework/plugins/mac/tasks.py @@ -34,9 +34,9 @@ class Tasks(pslist.PsList): The list of task objects from the `layer_name` layer's `tasks` list after filtering """ - mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name) + masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name) - kernel = contexts.Module(context, darwin_symbols, layer_name, 0) + kernel = contexts.Module(context, masked_darwin_symbols, layer_name, 0) kernel_as = context.layers[layer_name] diff --git a/volatility/framework/plugins/mac/timers.py b/volatility/framework/plugins/mac/timers.py index 7705fd607..d5677e265 100644 --- a/volatility/framework/plugins/mac/timers.py +++ b/volatility/framework/plugins/mac/timers.py @@ -2,16 +2,14 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from typing import List, Iterator, Any +from typing import List -import volatility from volatility.framework import exceptions, interfaces -from volatility.framework import renderers, constants, contexts +from volatility.framework import renderers, contexts from volatility.framework.automagic import mac from volatility.framework.configuration import requirements from volatility.framework.interfaces import plugins from volatility.framework.renderers import format_hints -from volatility.framework.objects import utility from volatility.plugins.mac import lsmod vollog = logging.getLogger(__name__) @@ -31,11 +29,12 @@ class Timers(plugins.PluginInterface): ] def _generator(self): - mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary']) + masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], + self.config['primary']) - kernel = contexts.Module(self.context, self.config['darwin'], self.config['primary'], 0) + kernel = contexts.Module(self.context, masked_darwin_symbols, self.config['primary'], 0) - mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin']) + mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], masked_darwin_symbols) handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods) @@ -72,7 +71,7 @@ class Timers(plugins.PluginInterface): module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, handler) yield (0, (format_hints.Hex(handler), format_hints.Hex(timer.param0), format_hints.Hex(timer.param1), \ - timer.deadline, entry_time, module_name, symbol_name)) + timer.deadline, entry_time, module_name, symbol_name)) def run(self): return renderers.TreeGrid([("Function", format_hints.Hex), ("Param 0", format_hints.Hex), diff --git a/volatility/framework/plugins/mac/trustedbsd.py b/volatility/framework/plugins/mac/trustedbsd.py index aa6337943..31fa18ec3 100644 --- a/volatility/framework/plugins/mac/trustedbsd.py +++ b/volatility/framework/plugins/mac/trustedbsd.py @@ -31,9 +31,10 @@ class trustedbsd(plugins.PluginInterface): ] def _generator(self, mods: Iterator[Any]): - mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary']) + masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], + self.config['primary']) - kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0) + kernel = contexts.Module(self._context, masked_darwin_symbols, self.config['primary'], 0) handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods) diff --git a/volatility/framework/symbols/__init__.py b/volatility/framework/symbols/__init__.py index 782f79209..07f63ada9 100644 --- a/volatility/framework/symbols/__init__.py +++ b/volatility/framework/symbols/__init__.py @@ -4,6 +4,7 @@ import collections import collections.abc +import copy import enum import functools import logging @@ -246,20 +247,22 @@ class SymbolSpace(interfaces.symbols.SymbolSpaceInterface): return self._membership(SymbolType.ENUM, name) -def mask_symbol_table(symbol_table: interfaces.symbols.SymbolTableInterface, +def mask_symbol_table(context: interfaces.context.ContextInterface, + symbol_table_name: str, address_mask: int = 0, - table_aslr_shift: int = 0): + table_aslr_shift: int = 0) -> str: """Alters a symbol table, such that all symbols returned have their address masked by the address mask.""" - original_get_symbol = symbol_table.get_symbol + original_table = context.symbol_space[symbol_table_name] + new_table = copy.deepcopy(original_table) + new_table.name = context.symbol_space.free_table_name(original_table.name + '_masked'.format()) + context.symbol_space.append(new_table) + cached_symbols = {} # type: Dict[interfaces.symbols.SymbolInterface, interfaces.symbols.SymbolInterface] - if hasattr(symbol_table, '_original_get_symbol'): - original_get_symbol = symbol_table._original_get_symbol - - @functools.wraps(original_get_symbol) + @functools.wraps(original_table.get_symbol) def address_masked_get_symbol(*args, **kwargs): - symbol = original_get_symbol(*args, **kwargs) + symbol = original_table.get_symbol(*args, **kwargs) # This is speedy, but may not be very efficient from a memory perspective if symbol in cached_symbols: return cached_symbols[symbol] @@ -270,10 +273,9 @@ def mask_symbol_table(symbol_table: interfaces.symbols.SymbolTableInterface, cached_symbols[symbol] = new_symbol return new_symbol - symbol_table._original_get_symbol = symbol_table.get_symbol - setattr(symbol_table, "get_symbol", address_masked_get_symbol) + setattr(new_table, "get_symbol", address_masked_get_symbol) - return symbol_table + return new_table.name def symbol_table_is_64bit(context: interfaces.context.ContextInterface, symbol_table_name: str) -> bool: