Initial attempts at cloning a symbol table

volatility/framework/plugins/linux/check_afinfo.py

@@ -64,7 +64,7 @@ class Check_afinfo(plugins.PluginInterface):
     def _generator(self):
         linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary'])
 
-        vmlinux = contexts.Module(self.context, self.config['vmlinux'], self.config['primary'], 0)
+        vmlinux = contexts.Module(self.context, masked_vmlinux_symbols, self.config['primary'], 0)
 
         op_members = vmlinux.get_type('file_operations').members
         seq_members = vmlinux.get_type('seq_operations').members

volatility/framework/plugins/linux/check_syscall.py

@@ -122,9 +122,10 @@ class Check_syscall(plugins.PluginInterface):
 
     # TODO - add finding and parsing unistd.h once cached file enumeration is added
     def _generator(self):
-        linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary'])
+        masked_symbol_table = linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'],
+                                                                          self.config['primary'])
 
-        vmlinux = contexts.Module(self.context, self.config['vmlinux'], self.config['primary'], 0)
+        vmlinux = contexts.Module(self.context, masked_symbol_table, self.config['primary'], 0)
 
         ptr_sz = vmlinux.get_type("pointer").size
         if ptr_sz == 4:

volatility/framework/plugins/linux/lsmod.py

@@ -5,8 +5,7 @@
 found in Linux's /proc file system."""
 
 import logging
-
-from typing import List, Generator, Iterable
+from typing import List, Iterable
 
 from volatility.framework import contexts
 from volatility.framework import exceptions, renderers, constants, interfaces
@@ -46,9 +45,9 @@ class Lsmod(plugins.PluginInterface):
 
         This function will throw a SymbolError exception if kernel module support is not enabled.
         """
-        linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name)
+        masked_vmlinux_symbols = linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name)
 
-        vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0)
+        vmlinux = contexts.Module(context, masked_vmlinux_symbols, layer_name, 0)
 
         modules = vmlinux.object_from_symbol(symbol_name = "modules").cast("list_head")
 

volatility/framework/plugins/linux/lsof.py

@@ -45,7 +45,8 @@ class Lsof(plugins.PluginInterface):
                 yield (0, (pid, name, fd_num, full_path))
 
     def run(self):
-        linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary'])
+        masked_vmlinux_symbols = linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'],
+                                                                             self.config['primary'])
 
         filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
 
@@ -53,5 +54,5 @@ class Lsof(plugins.PluginInterface):
                                   self._generator(
                                       pslist.PsList.list_tasks(self.context,
                                                                self.config['primary'],
-                                                               self.config['vmlinux'],
+                                                               masked_vmlinux_symbols,
                                                                filter_func = filter_func)))

volatility/framework/plugins/linux/pslist.py

@@ -75,9 +75,9 @@ class PsList(interfaces.plugins.PluginInterface):
         Yields:
             Process objects
         """
-        linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name)
+        masked_vmlinux_symbols = linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name)
 
-        vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0)
+        vmlinux = contexts.Module(context, masked_vmlinux_symbols, layer_name, 0)
 
         init_task = vmlinux.object_from_symbol(symbol_name = "init_task")
 

volatility/framework/plugins/mac/check_syscall.py

@@ -2,10 +2,10 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 import logging
-from typing import List, Iterator, Any
+from typing import List
 
 from volatility.framework import exceptions, interfaces
-from volatility.framework import renderers, constants, contexts
+from volatility.framework import renderers, contexts
 from volatility.framework.automagic import mac
 from volatility.framework.configuration import requirements
 from volatility.framework.interfaces import plugins
@@ -29,11 +29,12 @@ class Check_syscall(plugins.PluginInterface):
         ]
 
     def _generator(self):
-        mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
+        masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'],
+                                                                        self.config['primary'])
 
-        kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
+        kernel = contexts.Module(self._context, masked_darwin_symbols, self.config['primary'], 0)
 
-        mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin'])
+        mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], masked_darwin_symbols)
 
         handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
 

volatility/framework/plugins/mac/check_sysctl.py

@@ -2,16 +2,16 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 import logging
-from typing import List, Iterator, Any
+from typing import List
 
 import volatility
 from volatility.framework import exceptions, interfaces
-from volatility.framework import renderers, constants, contexts
+from volatility.framework import renderers, contexts
 from volatility.framework.automagic import mac
 from volatility.framework.configuration import requirements
 from volatility.framework.interfaces import plugins
-from volatility.framework.renderers import format_hints
 from volatility.framework.objects import utility
+from volatility.framework.renderers import format_hints
 from volatility.plugins.mac import lsmod
 
 vollog = logging.getLogger(__name__)
@@ -112,11 +112,12 @@ class Check_sysctl(plugins.PluginInterface):
                 break
 
     def _generator(self):
-        mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
+        masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'],
+                                                                        self.config['primary'])
 
-        kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
+        kernel = contexts.Module(self._context, masked_darwin_symbols, self.config['primary'], 0)
 
-        mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin'])
+        mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], masked_darwin_symbols)
 
         handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
 

volatility/framework/plugins/mac/check_trap_table.py

@@ -3,10 +3,10 @@
 #
 
 import logging
-from typing import List, Iterator, Any
+from typing import List
 
 from volatility.framework import exceptions, interfaces
-from volatility.framework import renderers, constants, contexts
+from volatility.framework import renderers, contexts
 from volatility.framework.automagic import mac
 from volatility.framework.configuration import requirements
 from volatility.framework.interfaces import plugins
@@ -30,11 +30,12 @@ class Check_trap_table(plugins.PluginInterface):
         ]
 
     def _generator(self):
-        mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
+        masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'],
+                                                                        self.config['primary'])
 
-        kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
+        kernel = contexts.Module(self._context, masked_darwin_symbols, self.config['primary'], 0)
 
-        mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin'])
+        mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], masked_darwin_symbols)
 
         handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
 

volatility/framework/plugins/mac/ifconfig.py

@@ -2,12 +2,11 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 
-from volatility.framework import exceptions, renderers, interfaces, contexts
+from volatility.framework import exceptions, renderers, contexts
 from volatility.framework.automagic import mac
 from volatility.framework.configuration import requirements
 from volatility.framework.interfaces import plugins
 from volatility.framework.objects import utility
-from volatility.framework.renderers import format_hints
 
 
 class Ifconfig(plugins.PluginInterface):
@@ -23,9 +22,10 @@ class Ifconfig(plugins.PluginInterface):
         ]
 
     def _generator(self):
-        mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
+        masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'],
+                                                                        self.config['primary'])
 
-        kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
+        kernel = contexts.Module(self._context, masked_darwin_symbols, self.config['primary'], 0)
 
         try:
             list_head = kernel.object_from_symbol(symbol_name = "ifnet_head")

volatility/framework/plugins/mac/lsmod.py

@@ -37,9 +37,9 @@ class Lsmod(plugins.PluginInterface):
         Returns:
             A list of modules from the `layer_name` layer
         """
-        mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name)
+        masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name)
 
-        kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
+        kernel = contexts.Module(context, masked_darwin_symbols, layer_name, 0)
 
         kmod_ptr = kernel.object_from_symbol(symbol_name = "kmod")
 

volatility/framework/plugins/mac/netstat.py

@@ -99,7 +99,7 @@ class Netstat(plugins.PluginInterface):
                                "{}/{:d}".format(task_name, pid)))
 
     def run(self):
-        # mac.MacUtilities.aslr_mask_symbol_table(self.config, self.context)
+        # masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(self.config, self.context)
 
         return renderers.TreeGrid([("Offset", format_hints.Hex), ("Proto", str), ("Local IP", str), ("Local Port", int),
                                    ("Remote IP", str), ("Remote Port", int), ("State", str), ("Process", str)],

volatility/framework/plugins/mac/pslist.py

@@ -71,9 +71,9 @@ class PsList(interfaces.plugins.PluginInterface):
             The list of process objects from the processes linked list after filtering
         """
 
-        mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name)
+        masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name)
 
-        kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
+        kernel = contexts.Module(context, masked_darwin_symbols, layer_name, 0)
 
         kernel_as = context.layers[layer_name]
 

volatility/framework/plugins/mac/tasks.py

@@ -34,9 +34,9 @@ class Tasks(pslist.PsList):
             The list of task objects from the `layer_name` layer's `tasks` list after filtering
         """
 
-        mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name)
+        masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name)
 
-        kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
+        kernel = contexts.Module(context, masked_darwin_symbols, layer_name, 0)
 
         kernel_as = context.layers[layer_name]
 

volatility/framework/plugins/mac/timers.py

@@ -2,16 +2,14 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 import logging
-from typing import List, Iterator, Any
+from typing import List
 
-import volatility
 from volatility.framework import exceptions, interfaces
-from volatility.framework import renderers, constants, contexts
+from volatility.framework import renderers, contexts
 from volatility.framework.automagic import mac
 from volatility.framework.configuration import requirements
 from volatility.framework.interfaces import plugins
 from volatility.framework.renderers import format_hints
-from volatility.framework.objects import utility
 from volatility.plugins.mac import lsmod
 
 vollog = logging.getLogger(__name__)
@@ -31,11 +29,12 @@ class Timers(plugins.PluginInterface):
         ]
 
     def _generator(self):
-        mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
+        masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'],
+                                                                        self.config['primary'])
 
-        kernel = contexts.Module(self.context, self.config['darwin'], self.config['primary'], 0)
+        kernel = contexts.Module(self.context, masked_darwin_symbols, self.config['primary'], 0)
 
-        mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin'])
+        mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], masked_darwin_symbols)
 
         handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
 
@@ -72,7 +71,7 @@ class Timers(plugins.PluginInterface):
                 module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, handler)
 
                 yield (0, (format_hints.Hex(handler), format_hints.Hex(timer.param0), format_hints.Hex(timer.param1), \
-                            timer.deadline, entry_time, module_name, symbol_name))
+                           timer.deadline, entry_time, module_name, symbol_name))
 
     def run(self):
         return renderers.TreeGrid([("Function", format_hints.Hex), ("Param 0", format_hints.Hex),

volatility/framework/plugins/mac/trustedbsd.py

@@ -31,9 +31,10 @@ class trustedbsd(plugins.PluginInterface):
         ]
 
     def _generator(self, mods: Iterator[Any]):
-        mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
+        masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'],
+                                                                        self.config['primary'])
 
-        kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
+        kernel = contexts.Module(self._context, masked_darwin_symbols, self.config['primary'], 0)
 
         handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)