mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-09 11:17:38 +02:00
Add in minor changes and remove the duplicate plugins for mac.
This commit is contained in:
Mike Auty
@@ -29,10 +29,10 @@ class Psaux(plugins.PluginInterface):
|
||||
|
||||
argsstart = task.user_stack - task.p_argslen
|
||||
|
||||
if (not proc_layer.is_valid(argsstart) or not task.p_argslen or not task.p_argc):
|
||||
if not proc_layer.is_valid(argsstart) or task.p_argslen == 0 or task.p_argc == 0:
|
||||
continue
|
||||
|
||||
# Add one because the first two are usually duplicates
|
||||
# Add one because the first two are usually duplicates
|
||||
argc = task.p_argc + 1
|
||||
|
||||
# smear protection
|
||||
@@ -50,13 +50,13 @@ class Psaux(plugins.PluginInterface):
|
||||
break
|
||||
|
||||
idx = arg.find(b'\x00')
|
||||
if idx > -1:
|
||||
if idx != -1:
|
||||
arg = arg[:idx]
|
||||
|
||||
argsstart += len(str(arg)) + 1
|
||||
|
||||
# deal with the stupid alignment (leading nulls) and arg duplication
|
||||
if not args:
|
||||
if len(args) == 0:
|
||||
while argsstart < task.user_stack:
|
||||
try:
|
||||
check = proc_layer.read(argsstart, 1)
|
||||
@@ -74,17 +74,17 @@ class Psaux(plugins.PluginInterface):
|
||||
elif arg != args[0]:
|
||||
args.append(arg)
|
||||
|
||||
argc -= 1
|
||||
argc = argc - 1
|
||||
|
||||
args_str = " ".join([s.decode("utf-8") for s in args])
|
||||
|
||||
yield (0, (task.p_pid, task_name, task.p_argc, args_str))
|
||||
|
||||
def run(self) -> renderers.TreeGrid:
|
||||
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
|
||||
filt = pslist.PsList.create_filter([self.config.get('pid', None)])
|
||||
|
||||
plugin = pslist.PsList.list_tasks
|
||||
|
||||
return renderers.TreeGrid(
|
||||
[("PID", int), ("Process", str), ("Argc", int), ("Arguments", str)],
|
||||
self._generator(plugin(self.context, self.config['primary'], self.config['darwin'], filter = filter)))
|
||||
self._generator(plugin(self.context, self.config['primary'], self.config['darwin'], filter = filt)))
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
import logging
|
||||
from typing import Callable, Generator, List
|
||||
from typing import Callable, Iterable, List
|
||||
|
||||
import volatility.framework.interfaces.plugins as interfaces_plugins
|
||||
from volatility.framework import renderers, interfaces
|
||||
@@ -23,13 +23,21 @@ class PsList(interfaces_plugins.PluginInterface):
|
||||
|
||||
@classmethod
|
||||
def create_filter(cls, pid_list: List[int] = None) -> Callable[[int], bool]:
|
||||
filter = lambda _: False
|
||||
|
||||
def nullfilter():
|
||||
return False
|
||||
|
||||
filt = nullfilter
|
||||
# FIXME: mypy #4973 or #2608
|
||||
pid_list = pid_list or []
|
||||
filter_list = [x for x in pid_list if x is not None]
|
||||
if filter_list:
|
||||
filter = lambda x: x not in filter_list
|
||||
return filter
|
||||
|
||||
def list_filter(x):
|
||||
return x not in filter_list
|
||||
|
||||
filt = list_filter
|
||||
return filt
|
||||
|
||||
def _generator(self):
|
||||
for task in self.list_tasks(
|
||||
@@ -47,8 +55,8 @@ class PsList(interfaces_plugins.PluginInterface):
|
||||
context: interfaces.context.ContextInterface,
|
||||
layer_name: str,
|
||||
mac_symbols: str,
|
||||
filter: Callable[[int], bool] = lambda _: False) \
|
||||
-> Generator[interfaces.objects.ObjectInterface, None, None]:
|
||||
filter: Callable[[int], bool] = lambda _: False) -> \
|
||||
Iterable[interfaces.objects.ObjectInterface]:
|
||||
"""Lists all the tasks in the primary layer"""
|
||||
|
||||
aslr_shift = mac.MacUtilities.find_aslr(context, mac_symbols, layer_name)
|
||||
@@ -56,7 +64,7 @@ class PsList(interfaces_plugins.PluginInterface):
|
||||
proc = darwin.object(symbol_name = "allproc").lh_first
|
||||
|
||||
seen = {}
|
||||
while proc != None and proc.vol.offset != 0:
|
||||
while proc is not None and proc.vol.offset != 0:
|
||||
if proc.vol.offset in seen:
|
||||
vollog.log(logging.INFO, "Recursive process list detected (a result of non-atomic acquisition).")
|
||||
break
|
||||
|
||||
@@ -224,7 +224,7 @@ class vm_map_entry(generic.GenericIntelProcess):
|
||||
vnode_object = self.get_object().get_map_object()
|
||||
|
||||
found_end = False
|
||||
|
||||
|
||||
while not found_end:
|
||||
try:
|
||||
tmp_vnode_object = vnode_object.shadow.dereference()
|
||||
|
||||
@@ -1,92 +0,0 @@
|
||||
"""A module containing a collection of plugins that produce data
|
||||
typically found in Linux's /proc file system.
|
||||
"""
|
||||
|
||||
from volatility.framework import exceptions, renderers
|
||||
from volatility.framework.interfaces import plugins
|
||||
from volatility.framework.configuration import requirements
|
||||
from volatility.framework.objects import utility
|
||||
from volatility.plugins.mac import pslist
|
||||
|
||||
|
||||
class Psaux(plugins.PluginInterface):
|
||||
"""Recovers program command line arguments"""
|
||||
|
||||
@classmethod
|
||||
def get_requirements(cls):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "darwin", description = "Mac Kernel")
|
||||
]
|
||||
|
||||
def _generator(self, tasks):
|
||||
for task in tasks:
|
||||
task_name = utility.array_to_string(task.p_comm)
|
||||
|
||||
proc_layer_name = task.add_process_layer()
|
||||
if proc_layer_name is None:
|
||||
print("no proc layer")
|
||||
continue
|
||||
|
||||
proc_layer = self.context.memory[proc_layer_name]
|
||||
|
||||
argsstart = task.user_stack - task.p_argslen
|
||||
|
||||
if not proc_layer.is_valid(argsstart) or task.p_argslen == 0 or task.p_argc == 0:
|
||||
continue
|
||||
|
||||
# Add one because the first two are usually duplicates
|
||||
argc = task.p_argc + 1
|
||||
|
||||
# smear protection
|
||||
if argc > 1024:
|
||||
continue
|
||||
|
||||
args = []
|
||||
|
||||
while argc > 0:
|
||||
try:
|
||||
arg = proc_layer.read(argsstart, 256)
|
||||
except exceptions.PagedInvalidAddressException:
|
||||
break
|
||||
|
||||
idx = arg.find(b'\x00')
|
||||
if idx != -1:
|
||||
arg = arg[:idx]
|
||||
|
||||
argsstart += len(str(arg)) + 1
|
||||
|
||||
# deal with the stupid alignment (leading nulls) and arg duplication
|
||||
if len(args) == 0:
|
||||
while argsstart < task.user_stack:
|
||||
try:
|
||||
check = proc_layer.read(argsstart, 1)
|
||||
except exceptions.PagedInvalidAddressException:
|
||||
break
|
||||
|
||||
if check != b"\x00":
|
||||
break
|
||||
|
||||
argsstart = argsstart + 1
|
||||
|
||||
args.append(arg)
|
||||
|
||||
# also check for initial duplicates since OS X is painful
|
||||
elif arg != args[0]:
|
||||
args.append(arg)
|
||||
|
||||
argc = argc - 1
|
||||
|
||||
args_str = " ".join([s.decode("utf-8") for s in args])
|
||||
|
||||
yield (0, (task.p_pid, task_name, task.p_argc, args_str))
|
||||
|
||||
def run(self):
|
||||
filt = pslist.PsList.create_filter([self.config.get('pid', None)])
|
||||
|
||||
plugin = pslist.PsList.list_tasks
|
||||
|
||||
return renderers.TreeGrid(
|
||||
[("PID", int), ("Process", str), ("Argc", int), ("Arguments", str)],
|
||||
self._generator(plugin(self.context, self.config['primary'], self.config['darwin'], filter = filt)))
|
||||
@@ -1,79 +0,0 @@
|
||||
import logging
|
||||
from typing import Callable, Iterable, List
|
||||
|
||||
import volatility.framework.interfaces.plugins as interfaces_plugins
|
||||
from volatility.framework import renderers, interfaces
|
||||
from volatility.framework.automagic import mac
|
||||
from volatility.framework.configuration import requirements
|
||||
from volatility.framework.objects import utility
|
||||
|
||||
vollog = logging.getLogger(__name__)
|
||||
|
||||
|
||||
class PsList(interfaces_plugins.PluginInterface):
|
||||
"""Lists the processes present in a particular mac memory image"""
|
||||
|
||||
@classmethod
|
||||
def get_requirements(cls):
|
||||
return [
|
||||
requirements.TranslationLayerRequirement(
|
||||
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
|
||||
requirements.SymbolRequirement(name = "darwin", description = "Mac Kernel")
|
||||
]
|
||||
|
||||
@classmethod
|
||||
def create_filter(cls, pid_list: List[int] = None) -> Callable[[int], bool]:
|
||||
|
||||
def nullfilter():
|
||||
return False
|
||||
|
||||
filt = nullfilter
|
||||
# FIXME: mypy #4973 or #2608
|
||||
pid_list = pid_list or []
|
||||
filter_list = [x for x in pid_list if x is not None]
|
||||
if filter_list:
|
||||
|
||||
def list_filter(x):
|
||||
return x not in filter_list
|
||||
|
||||
filt = list_filter
|
||||
return filt
|
||||
|
||||
def _generator(self):
|
||||
for task in self.list_tasks(
|
||||
self.context,
|
||||
self.config['primary'],
|
||||
self.config['darwin'],
|
||||
filter = self.create_filter([self.config.get('pid', None)])):
|
||||
pid = task.p_pid
|
||||
ppid = task.p_ppid
|
||||
name = utility.array_to_string(task.p_comm)
|
||||
yield (0, (pid, ppid, name))
|
||||
|
||||
@classmethod
|
||||
def list_tasks(cls,
|
||||
context: interfaces.context.ContextInterface,
|
||||
layer_name: str,
|
||||
mac_symbols: str,
|
||||
filter: Callable[[int], bool] = lambda _: False) -> \
|
||||
Iterable[interfaces.objects.ObjectInterface]:
|
||||
"""Lists all the tasks in the primary layer"""
|
||||
|
||||
aslr_shift = mac.MacUtilities.find_aslr(context, mac_symbols, layer_name)
|
||||
darwin = context.module(mac_symbols, layer_name, aslr_shift)
|
||||
proc = darwin.object(symbol_name = "allproc").lh_first
|
||||
|
||||
seen = {}
|
||||
while proc is not None and proc.vol.offset != 0:
|
||||
if proc.vol.offset in seen:
|
||||
vollog.log(logging.INFO, "Recursive process list detected (a result of non-atomic acquisition).")
|
||||
break
|
||||
else:
|
||||
seen[proc.vol.offset] = 1
|
||||
|
||||
yield proc
|
||||
|
||||
proc = proc.p_list.le_next.dereference()
|
||||
|
||||
def run(self):
|
||||
return renderers.TreeGrid([("PID", int), ("PPID", int), ("COMM", str)], self._generator())
|
||||
Reference in New Issue
Block a user