From 2aa07596c27f5f546143c6e91200dab8e8f55445 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 28 Feb 2019 09:48:15 +0000 Subject: [PATCH] Fix up filtering in mac and remove the last of the filter shadowing. --- doc/source/simple-plugin.rst | 2 +- volatility/framework/plugins/linux/bash.py | 18 +++++++++-------- volatility/framework/plugins/linux/elfs.py | 14 +++++++------ volatility/framework/plugins/linux/lsof.py | 14 +++++++------ volatility/framework/plugins/linux/malfind.py | 15 ++++++++------ volatility/framework/plugins/linux/proc.py | 18 ++++++++++------- volatility/framework/plugins/linux/pslist.py | 7 ++++--- volatility/framework/plugins/mac/bash.py | 20 ++++++++++--------- volatility/framework/plugins/mac/malfind.py | 15 ++++++++------ volatility/framework/plugins/mac/netstat.py | 16 ++++++++------- volatility/framework/plugins/mac/psaux.py | 12 ++++++----- volatility/framework/plugins/mac/pslist.py | 7 ++++--- 12 files changed, 91 insertions(+), 67 deletions(-) diff --git a/doc/source/simple-plugin.rst b/doc/source/simple-plugin.rst index 14ac8930f..3f4322528 100644 --- a/doc/source/simple-plugin.rst +++ b/doc/source/simple-plugin.rst @@ -98,7 +98,7 @@ that will be output as part of the `TreeGrid`. def run(self): - filter = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) return renderers.TreeGrid([("PID", int), ("Process", str), diff --git a/volatility/framework/plugins/linux/bash.py b/volatility/framework/plugins/linux/bash.py index 183b66f7f..bf7e5a88b 100644 --- a/volatility/framework/plugins/linux/bash.py +++ b/volatility/framework/plugins/linux/bash.py @@ -100,19 +100,21 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): def run(self): filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) - plugin = pslist.PsList.list_tasks - - return renderers.TreeGrid( - [("PID", int), ("Process", str), ("CommandTime", datetime.datetime), ("Command", str)], - self._generator(plugin(self.context, self.config['primary'], self.config['vmlinux'], filter = filter_func))) + return renderers.TreeGrid([("PID", int), ("Process", str), ("CommandTime", datetime.datetime), + ("Command", str)], + self._generator( + pslist.PsList.list_tasks( + self.context, + self.config['primary'], + self.config['vmlinux'], + filter_func = filter_func))) def generate_timeline(self): filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) - plugin = pslist.PsList.list_tasks - for row in self._generator( - plugin(self.context, self.config['primary'], self.config['vmlinux'], filter = filter_func)): + pslist.PsList.list_tasks( + self.context, self.config['primary'], self.config['vmlinux'], filter_func = filter_func)): _depth, row_data = row description = "{} ({}): \"{}\"".format(row_data[0], row_data[1], row_data[3]) yield (description, timeliner.TimeLinerType.CREATED, row_data[2]) diff --git a/volatility/framework/plugins/linux/elfs.py b/volatility/framework/plugins/linux/elfs.py index a6f5fc0dc..35f34b9c1 100644 --- a/volatility/framework/plugins/linux/elfs.py +++ b/volatility/framework/plugins/linux/elfs.py @@ -64,9 +64,11 @@ class Elfs(plugins.PluginInterface): def run(self): filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) - plugin = pslist.PsList.list_tasks - - return renderers.TreeGrid( - [("PID", int), ("Process", str), ("Start", format_hints.Hex), ("End", format_hints.Hex), - ("File Path", str)], - self._generator(plugin(self.context, self.config['primary'], self.config['vmlinux'], filter = filter_func))) + return renderers.TreeGrid([("PID", int), ("Process", str), ("Start", format_hints.Hex), + ("End", format_hints.Hex), ("File Path", str)], + self._generator( + pslist.PsList.list_tasks( + self.context, + self.config['primary'], + self.config['vmlinux'], + filter_func = filter_func))) diff --git a/volatility/framework/plugins/linux/lsof.py b/volatility/framework/plugins/linux/lsof.py index bd1487bac..547995854 100644 --- a/volatility/framework/plugins/linux/lsof.py +++ b/volatility/framework/plugins/linux/lsof.py @@ -56,10 +56,12 @@ class Lsof(plugins.PluginInterface): def run(self): linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary']) - filter = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) - plugin = pslist.PsList.list_tasks - - return renderers.TreeGrid( - [("PID", int), ("Process", str), ("FD", int), ("Path", str)], - self._generator(plugin(self.context, self.config['primary'], self.config['vmlinux'], filter = filter))) + return renderers.TreeGrid([("PID", int), ("Process", str), ("FD", int), ("Path", str)], + self._generator( + pslist.PsList.list_tasks( + self.context, + self.config['primary'], + self.config['vmlinux'], + filter_func = filter_func))) diff --git a/volatility/framework/plugins/linux/malfind.py b/volatility/framework/plugins/linux/malfind.py index a77133dc1..f48d46ff3 100644 --- a/volatility/framework/plugins/linux/malfind.py +++ b/volatility/framework/plugins/linux/malfind.py @@ -81,9 +81,12 @@ class Malfind(interfaces_plugins.PluginInterface): def run(self): filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) - plugin = pslist.PsList.list_tasks - - return renderers.TreeGrid( - [("PID", int), ("Process", str), ("Start", format_hints.Hex), ("End", format_hints.Hex), - ("Protection", str), ("Hexdump", format_hints.HexBytes), ("Disasm", interfaces_renderers.Disassembly)], - self._generator(plugin(self.context, self.config['primary'], self.config['vmlinux'], filter = filter_func))) + return renderers.TreeGrid([("PID", int), ("Process", str), ("Start", format_hints.Hex), + ("End", format_hints.Hex), ("Protection", str), ("Hexdump", format_hints.HexBytes), + ("Disasm", interfaces_renderers.Disassembly)], + self._generator( + pslist.PsList.list_tasks( + self.context, + self.config['primary'], + self.config['vmlinux'], + filter_func = filter_func))) diff --git a/volatility/framework/plugins/linux/proc.py b/volatility/framework/plugins/linux/proc.py index 1a8f966e0..e640c7290 100644 --- a/volatility/framework/plugins/linux/proc.py +++ b/volatility/framework/plugins/linux/proc.py @@ -69,11 +69,15 @@ class Maps(plugins.PluginInterface): format_hints.Hex(page_offset), major, minor, inode, path)) def run(self): - filter = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) - plugin = pslist.PsList.list_tasks - - return renderers.TreeGrid( - [("PID", int), ("Process", str), ("Start", format_hints.Hex), ("End", format_hints.Hex), ("Flags", str), - ("PgOff", format_hints.Hex), ("Major", int), ("Minor", int), ("Inode", int), ("File Path", str)], - self._generator(plugin(self.context, self.config['primary'], self.config['vmlinux'], filter = filter))) + return renderers.TreeGrid([("PID", int), ("Process", str), + ("Start", format_hints.Hex), ("End", format_hints.Hex), ("Flags", str), + ("PgOff", format_hints.Hex), ("Major", int), ("Minor", int), ("Inode", int), + ("File Path", str)], + self._generator( + pslist.PsList.list_tasks( + self.context, + self.config['primary'], + self.config['vmlinux'], + filter_func = filter_func))) diff --git a/volatility/framework/plugins/linux/pslist.py b/volatility/framework/plugins/linux/pslist.py index cf4a12c85..154332de8 100644 --- a/volatility/framework/plugins/linux/pslist.py +++ b/volatility/framework/plugins/linux/pslist.py @@ -57,7 +57,7 @@ class PsList(interfaces_plugins.PluginInterface): self.context, self.config['primary'], self.config['vmlinux'], - filter = self.create_filter([self.config.get('pid', None)])): + filter_func = self.create_filter([self.config.get('pid', None)])): pid = task.pid ppid = 0 if task.parent: @@ -70,7 +70,8 @@ class PsList(interfaces_plugins.PluginInterface): context: interfaces.context.ContextInterface, layer_name: str, vmlinux_symbols: str, - filter: Callable[[int], bool] = lambda _: False) -> Iterable[interfaces.objects.ObjectInterface]: + filter_func: Callable[[int], bool] = lambda _: False + ) -> Iterable[interfaces.objects.ObjectInterface]: """Lists all the tasks in the primary layer""" linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name) @@ -79,7 +80,7 @@ class PsList(interfaces_plugins.PluginInterface): init_task = vmlinux.object(symbol_name = "init_task") for task in init_task.tasks: - if not filter(task): + if not filter_func(task): yield task def run(self): diff --git a/volatility/framework/plugins/mac/bash.py b/volatility/framework/plugins/mac/bash.py index c666ca79b..300ef2006 100644 --- a/volatility/framework/plugins/mac/bash.py +++ b/volatility/framework/plugins/mac/bash.py @@ -100,21 +100,23 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): yield (0, (int(task.p_pid), task_name, hist.get_time_object(), hist.get_command())) def run(self): - filter = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) - plugin = pslist.PsList.list_tasks - - return renderers.TreeGrid( - [("PID", int), ("Process", str), ("CommandTime", datetime.datetime), ("Command", str)], - self._generator(plugin(self.context, self.config['primary'], self.config['darwin'], filter = filter))) + return renderers.TreeGrid([("PID", int), ("Process", str), ("CommandTime", datetime.datetime), + ("Command", str)], + self._generator( + pslist.PsList.list_tasks( + self.context, + self.config['primary'], + self.config['darwin'], + filter_func = filter_func))) def generate_timeline(self): filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) - plugin = pslist.PsList.list_tasks - for row in self._generator( - plugin(self.context, self.config['primary'], self.config['darwin'], filter = filter_func)): + pslist.PsList.list_tasks( + self.context, self.config['primary'], self.config['darwin'], filter_func = filter_func)): _depth, row_data = row description = "{} ({}): \"{}\"".format(row_data[0], row_data[1], row_data[3]) yield (description, timeliner.TimeLinerType.CREATED, row_data[2]) diff --git a/volatility/framework/plugins/mac/malfind.py b/volatility/framework/plugins/mac/malfind.py index 2d3ad62eb..f08a0b02b 100644 --- a/volatility/framework/plugins/mac/malfind.py +++ b/volatility/framework/plugins/mac/malfind.py @@ -79,9 +79,12 @@ class Malfind(interfaces_plugins.PluginInterface): def run(self): filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) - plugin = pslist.PsList.list_tasks - - return renderers.TreeGrid( - [("PID", int), ("Process", str), ("Start", format_hints.Hex), ("End", format_hints.Hex), - ("Protection", str), ("Hexdump", format_hints.HexBytes), ("Disasm", interfaces_renderers.Disassembly)], - self._generator(plugin(self.context, self.config['primary'], self.config['darwin'], filter = filter_func))) + return renderers.TreeGrid([("PID", int), ("Process", str), ("Start", format_hints.Hex), + ("End", format_hints.Hex), ("Protection", str), ("Hexdump", format_hints.HexBytes), + ("Disasm", interfaces_renderers.Disassembly)], + self._generator( + pslist.PsList.list_tasks( + self.context, + self.config['primary'], + self.config['darwin'], + filter_func = filter_func))) diff --git a/volatility/framework/plugins/mac/netstat.py b/volatility/framework/plugins/mac/netstat.py index 3cb5ae689..fcc6bead2 100644 --- a/volatility/framework/plugins/mac/netstat.py +++ b/volatility/framework/plugins/mac/netstat.py @@ -68,11 +68,13 @@ class Netstat(plugins.PluginInterface): def run(self): # mac.MacUtilities.aslr_mask_symbol_table(self.config, self.context) - filter = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) - plugin = pslist.PsList.list_tasks - - return renderers.TreeGrid( - [("Offset", format_hints.Hex), ("Proto", str), ("Local IP", str), ("Local Port", int), ("Remote IP", str), - ("Remote Port", int), ("State", str), ("Process", str)], - self._generator(plugin(self.context, self.config['primary'], self.config['darwin'], filter = filter))) + return renderers.TreeGrid([("Offset", format_hints.Hex), ("Proto", str), ("Local IP", str), ("Local Port", int), + ("Remote IP", str), ("Remote Port", int), ("State", str), ("Process", str)], + self._generator( + pslist.PsList.list_tasks( + self.context, + self.config['primary'], + self.config['darwin'], + filter_func = filter_func))) diff --git a/volatility/framework/plugins/mac/psaux.py b/volatility/framework/plugins/mac/psaux.py index 6b242edd3..00a513e33 100644 --- a/volatility/framework/plugins/mac/psaux.py +++ b/volatility/framework/plugins/mac/psaux.py @@ -102,8 +102,10 @@ class Psaux(plugins.PluginInterface): def run(self) -> renderers.TreeGrid: filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) - plugin = pslist.PsList.list_tasks - - return renderers.TreeGrid( - [("PID", int), ("Process", str), ("Argc", int), ("Arguments", str)], - self._generator(plugin(self.context, self.config['primary'], self.config['darwin'], filter = filter_func))) + return renderers.TreeGrid([("PID", int), ("Process", str), ("Argc", int), ("Arguments", str)], + self._generator( + pslist.PsList.list_tasks( + self.context, + self.config['primary'], + self.config['darwin'], + filter_func = filter_func))) diff --git a/volatility/framework/plugins/mac/pslist.py b/volatility/framework/plugins/mac/pslist.py index dcfe393ab..2648df457 100644 --- a/volatility/framework/plugins/mac/pslist.py +++ b/volatility/framework/plugins/mac/pslist.py @@ -64,7 +64,7 @@ class PsList(interfaces_plugins.PluginInterface): self.context, self.config['primary'], self.config['darwin'], - filter = self.create_filter([self.config.get('pid', None)])): + filter_func = self.create_filter([self.config.get('pid', None)])): pid = task.p_pid ppid = task.p_ppid name = utility.array_to_string(task.p_comm) @@ -75,7 +75,7 @@ class PsList(interfaces_plugins.PluginInterface): context: interfaces.context.ContextInterface, layer_name: str, darwin_symbols: str, - filter: Callable[[int], bool] = lambda _: False) -> \ + filter_func: Callable[[int], bool] = lambda _: False) -> \ Iterable[interfaces.objects.ObjectInterface]: """Lists all the tasks in the primary layer""" @@ -93,7 +93,8 @@ class PsList(interfaces_plugins.PluginInterface): else: seen[proc.vol.offset] = 1 - yield proc + if not filter_func(proc): + yield proc proc = proc.p_list.le_next.dereference()