diff --git a/volatility/framework/plugins/linux/lsmod.py b/volatility/framework/plugins/linux/lsmod.py index 4d6f14b21..45a1b4c25 100644 --- a/volatility/framework/plugins/linux/lsmod.py +++ b/volatility/framework/plugins/linux/lsmod.py @@ -18,6 +18,7 @@ from volatility.framework.renderers import format_hints vollog = logging.getLogger(__name__) + class Lsmod(plugins.PluginInterface): """Lists loaded kernel modules.""" @@ -65,9 +66,11 @@ class Lsmod(plugins.PluginInterface): mod_name = utility.array_to_string(module.name) yield 0, (format_hints.Hex(module.vol.offset), mod_name, mod_size) - + except exceptions.SymbolError: - vollog.debug("The required symbol 'module' is not present in symbol table. Please check that kernel modules are enabled for the system under analysis.") + vollog.debug( + "The required symbol 'module' is not present in symbol table. Please check that kernel modules are enabled for the system under analysis." + ) def run(self): return renderers.TreeGrid([("Offset", format_hints.Hex), ("Name", str), ("Size", int)], self._generator()) diff --git a/volatility/framework/plugins/mac/ifconfig.py b/volatility/framework/plugins/mac/ifconfig.py index 6447adaf6..03c58dcd9 100644 --- a/volatility/framework/plugins/mac/ifconfig.py +++ b/volatility/framework/plugins/mac/ifconfig.py @@ -9,14 +9,16 @@ from volatility.framework.interfaces import plugins from volatility.framework.objects import utility from volatility.framework.renderers import format_hints + class Ifconfig(plugins.PluginInterface): """Lists loaded kernel modules""" @classmethod def get_requirements(cls): return [ - requirements.TranslationLayerRequirement( - name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.TranslationLayerRequirement(name = 'primary', + description = 'Memory layer for the kernel', + architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Linux kernel symbols") ] @@ -33,11 +35,11 @@ class Ifconfig(plugins.PluginInterface): for ifnet in mac.MacUtilities.walk_tailq(list_head, "if_link"): name = utility.pointer_to_string(ifnet.if_name, 32) unit = ifnet.if_unit - prom = ifnet.if_flags & 0x100 == 0x100 # IFF_PROMISC + prom = ifnet.if_flags & 0x100 == 0x100 # IFF_PROMISC sock_addr_dl = ifnet.sockaddr_dl() if sock_addr_dl is None: - mac_addr = renderers.UnreadableValue() + mac_addr = renderers.UnreadableValue() else: mac_addr = str(sock_addr_dl) @@ -47,8 +49,5 @@ class Ifconfig(plugins.PluginInterface): yield (0, ("{0}{1}".format(name, unit), ip, mac_addr, prom)) def run(self): - return renderers.TreeGrid([("Interface", str), ("IP Address", str), ("Mac Address", str), ("Promiscuous", bool)], self._generator()) - - - - + return renderers.TreeGrid([("Interface", str), ("IP Address", str), ("Mac Address", str), + ("Promiscuous", bool)], self._generator()) diff --git a/volatility/framework/plugins/mac/lsof.py b/volatility/framework/plugins/mac/lsof.py index 55ef5147b..5b980566d 100644 --- a/volatility/framework/plugins/mac/lsof.py +++ b/volatility/framework/plugins/mac/lsof.py @@ -40,6 +40,6 @@ class lsof(plugins.PluginInterface): return renderers.TreeGrid([("PID", int), ("File Descriptor", int), ("File Path", str)], self._generator( tasks.Tasks.list_tasks(self.context, - self.config['primary'], - self.config['darwin'], - filter_func = filter_func))) + self.config['primary'], + self.config['darwin'], + filter_func = filter_func))) diff --git a/volatility/framework/plugins/mac/netstat.py b/volatility/framework/plugins/mac/netstat.py index ef1f7258b..63bc41796 100644 --- a/volatility/framework/plugins/mac/netstat.py +++ b/volatility/framework/plugins/mac/netstat.py @@ -80,6 +80,6 @@ class Netstat(plugins.PluginInterface): ("Remote IP", str), ("Remote Port", int), ("State", str), ("Process", str)], self._generator( tasks.Tasks.list_tasks(self.context, - self.config['primary'], - self.config['darwin'], - filter_func = filter_func))) + self.config['primary'], + self.config['darwin'], + filter_func = filter_func))) diff --git a/volatility/framework/plugins/mac/pstree.py b/volatility/framework/plugins/mac/pstree.py index 203b3d527..75f0a2a66 100644 --- a/volatility/framework/plugins/mac/pstree.py +++ b/volatility/framework/plugins/mac/pstree.py @@ -8,6 +8,7 @@ from volatility.framework.interfaces import plugins from volatility.framework.objects import utility from volatility.plugins.mac import tasks + class PsTree(plugins.PluginInterface): """Plugin for listing processes in a tree based on their parent process ID.""" diff --git a/volatility/framework/plugins/mac/tasks.py b/volatility/framework/plugins/mac/tasks.py index a3255605b..9baf52b4e 100644 --- a/volatility/framework/plugins/mac/tasks.py +++ b/volatility/framework/plugins/mac/tasks.py @@ -37,7 +37,7 @@ class Tasks(pslist.PsList): mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name) kernel = contexts.Module(context, darwin_symbols, layer_name, 0) - + kernel_as = context.layers[layer_name] queue_entry = kernel.object_from_symbol(symbol_name = "tasks") diff --git a/volatility/framework/plugins/windows/procdump.py b/volatility/framework/plugins/windows/procdump.py index 7993614a4..20fa4cedb 100644 --- a/volatility/framework/plugins/windows/procdump.py +++ b/volatility/framework/plugins/windows/procdump.py @@ -18,7 +18,7 @@ vollog = logging.getLogger(__name__) class ProcDump(interfaces.plugins.PluginInterface): """Dumps process executable images.""" - _version = (1,1,0) + _version = (1, 1, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -35,7 +35,8 @@ class ProcDump(interfaces.plugins.PluginInterface): ] @classmethod - def process_dump(cls, context: interfaces.context.ContextInterface, kernel_table_name: str, pe_table_name: str, proc: interfaces.objects.ObjectInterface) -> interfaces.plugins.FileInterface: + def process_dump(cls, context: interfaces.context.ContextInterface, kernel_table_name: str, pe_table_name: str, + proc: interfaces.objects.ObjectInterface) -> interfaces.plugins.FileInterface: """Extracts the complete data for a process as a FileInterface Args: @@ -52,21 +53,21 @@ class ProcDump(interfaces.plugins.PluginInterface): proc_id = proc.UniqueProcessId proc_layer_name = proc.add_process_layer() peb = context.object(kernel_table_name + constants.BANG + "_PEB", - layer_name = proc_layer_name, - offset = proc.Peb) + layer_name = proc_layer_name, + offset = proc.Peb) dos_header = context.object(pe_table_name + constants.BANG + "_IMAGE_DOS_HEADER", - offset = peb.ImageBaseAddress, - layer_name = proc_layer_name) - filedata = interfaces.plugins.FileInterface("pid.{0}.{1:#x}.dmp".format( - proc.UniqueProcessId, peb.ImageBaseAddress)) + offset = peb.ImageBaseAddress, + layer_name = proc_layer_name) + filedata = interfaces.plugins.FileInterface("pid.{0}.{1:#x}.dmp".format(proc.UniqueProcessId, + peb.ImageBaseAddress)) for offset, data in dos_header.reconstruct(): filedata.data.seek(offset) filedata.data.write(data) - + return filedata def _generator(self, procs): - + pe_table_name = intermed.IntermediateSymbolTable.create(self.context, self.config_path, "windows", @@ -94,7 +95,6 @@ class ProcDump(interfaces.plugins.PluginInterface): result_text = "Process {}: Required memory at {:#x} is not valid (incomplete layer {}?)".format( proc_id, exp.invalid_address, exp.layer_name) - yield (0, (proc.UniqueProcessId, process_name, result_text)) def run(self): diff --git a/volatility/framework/plugins/windows/svcscan.py b/volatility/framework/plugins/windows/svcscan.py index 18fea9f0c..e6c34ce96 100644 --- a/volatility/framework/plugins/windows/svcscan.py +++ b/volatility/framework/plugins/windows/svcscan.py @@ -36,7 +36,8 @@ class SvcScan(interfaces.plugins.PluginInterface): fallback_checks = [("ObHeaderCookie", None, True), ("_HANDLE_TABLE", "HandleCount", False), ("ObHeaderCookie", None, True), - ("_EPROCESS", "ControlFlowGuardEnabled", True)]) + ("_EPROCESS", "ControlFlowGuardEnabled", + True)]) is_win10_16299_or_later = poolscanner.os_distinguisher(version_check = lambda x: x >= (10, 0, 16299), fallback_checks = [("ObHeaderCookie", None, True), diff --git a/volatility/framework/plugins/windows/vaddump.py b/volatility/framework/plugins/windows/vaddump.py index b4b084caf..070b10752 100644 --- a/volatility/framework/plugins/windows/vaddump.py +++ b/volatility/framework/plugins/windows/vaddump.py @@ -15,7 +15,7 @@ vollog = logging.getLogger(__name__) class VadDump(interfaces.plugins.PluginInterface): """Dumps process memory ranges.""" - _version = (1,1,0) + _version = (1, 1, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -38,7 +38,8 @@ class VadDump(interfaces.plugins.PluginInterface): ] @classmethod - def vad_dump(cls, context: interfaces.context.ContextInterface, layer_name: str, vad: interfaces.objects.ObjectInterface) -> bytes: + def vad_dump(cls, context: interfaces.context.ContextInterface, layer_name: str, + vad: interfaces.objects.ObjectInterface) -> bytes: """ Returns VAD content """ diff --git a/volatility/framework/symbols/intermed.py b/volatility/framework/symbols/intermed.py index 692fff205..57213d400 100644 --- a/volatility/framework/symbols/intermed.py +++ b/volatility/framework/symbols/intermed.py @@ -369,7 +369,10 @@ class Version1Format(ISFormatTable): elif type_name == 'enum': update = self._lookup_enum(dictionary['name']) elif type_name == 'bitfield': - update = {'start_bit': dictionary['bit_position'], 'end_bit': dictionary['bit_position'] + dictionary['bit_length']} + update = { + 'start_bit': dictionary['bit_position'], + 'end_bit': dictionary['bit_position'] + dictionary['bit_length'] + } update['base_type'] = self._interdict_to_template(dictionary['type']) # We do *not* call native_template.clone(), since it slows everything down a lot # We require that the native.get_type method always returns a newly constructed python object diff --git a/volatility/framework/symbols/linux/__init__.py b/volatility/framework/symbols/linux/__init__.py index 0120010fb..f4d3a6ce7 100644 --- a/volatility/framework/symbols/linux/__init__.py +++ b/volatility/framework/symbols/linux/__init__.py @@ -25,7 +25,7 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): self.set_type_class('fs_struct', extensions.fs_struct) self.set_type_class('files_struct', extensions.files_struct) self.set_type_class('vfsmount', extensions.vfsmount) - + if 'module' in self.types: self.set_type_class('module', extensions.module) diff --git a/volatility/framework/symbols/mac/extensions/__init__.py b/volatility/framework/symbols/mac/extensions/__init__.py index a71f4f0ba..578330940 100644 --- a/volatility/framework/symbols/mac/extensions/__init__.py +++ b/volatility/framework/symbols/mac/extensions/__init__.py @@ -383,7 +383,11 @@ class inpcb(objects.StructType): class queue_entry(objects.StructType): - def walk_list(self, list_head: interfaces.objects.ObjectInterface, member_name: str, type_name: str, max_size: int = 4096) -> Iterable[interfaces.objects.ObjectInterface]: + def walk_list(self, + list_head: interfaces.objects.ObjectInterface, + member_name: str, + type_name: str, + max_size: int = 4096) -> Iterable[interfaces.objects.ObjectInterface]: yielded = 0 try: @@ -396,7 +400,7 @@ class queue_entry(objects.StructType): if yielded == max_size: return n = n.member(attr = member_name).next.dereference().cast(type_name) - + try: p = self.prev.dereference().cast(type_name) except exceptions.PagedInvalidAddressException: @@ -408,7 +412,9 @@ class queue_entry(objects.StructType): return p = p.member(attr = member_name).prev.dereference().cast(type_name) + class ifnet(objects.StructType): + def sockaddr_dl(self): if self.has_member("if_lladdr"): try: @@ -423,8 +429,10 @@ class ifnet(objects.StructType): return val + # this is used for MAC addresses class sockaddr_dl(objects.StructType): + def __str__(self): ret = "" @@ -446,22 +454,23 @@ class sockaddr_dl(objects.StructType): return ret + class sockaddr(objects.StructType): + def get_address(self): ip = "" family = self.sa_family - if family == 2: # AF_INET + if family == 2: # AF_INET addr_in = self.cast("sockaddr_in") ip = conversion.convert_ipv4(addr_in.sin_addr.s_addr) - elif family == 30: # AF_INET6 + elif family == 30: # AF_INET6 addr_in6 = self.cast("sockaddr_in6") ip = conversion.convert_ipv6(addr_in6.sin6_addr.member(attr = "__u6_addr").member(attr = "__u6_addr32")) - elif family == 18: # AF_LINK + elif family == 18: # AF_LINK addr_dl = self.cast("sockaddr_dl") ip = str(addr_dl) return ip -