FreeBSD: symbol init, pslist, cr3 module

testing/Makefile

@@ -0,0 +1,6 @@
+KMOD=cr3_printer
+SRCS=cr3_printer.c
+
+# Name of KLD to build.
+# List of source files.
+.include <bsd.kmod.mk>

testing/cr3_printer.c

@@ -0,0 +1,41 @@
+#include<sys/param.h>
+#include<sys/module.h>
+#include<sys/kernel.h>
+#include<sys/systm.h>
+#include<vm/vm.h>
+#include<vm/pmap.h>
+
+static void print_symbols() {
+	uprintf("kernel_pmap: %p\n", kernel_pmap);
+	uprintf("pm_cr3: %lu\n", kernel_pmapi->pm_cr3);
+}
+
+
+
+/* The function called at load/unload. */
+static int load(struct module *module, int cmd, void *arg) {
+	int error = 0;
+	
+	switch (cmd) {
+	case MOD_LOAD:
+		uprintf("Hello, world!\n");
+		break;
+	case MOD_UNLOAD:
+		uprintf("Good-bye, cruel world!\n");
+		break;
+	default:
+		error = EOPNOTSUPP;
+		break;
+	}
+	
+	return(error);
+}
+
+/* The second argument of DECLARE_MODULE. */
+static moduledata_t hello_mod = {
+	"hello", /* module name */
+	load,    /* event handler */
+	NULL     /* extra data */
+};
+
+DECLARE_MODULE(hello, hello_mod, SI_SUB_DRIVERS, SI_ORDER_MIDDLE);

volatility/plugins/freebsd/pslist.py

@@ -36,10 +36,9 @@ class PsList(interfaces_plugins.PluginInterface):
                     name = 'primary',
                     description = "Memory layer for the kernel",
                     architectures = ['Intel32', 'Intel64']),
-                requirements.SymbolRequirement(
-                    name = 'ksyms',  #TODO: is this right?
-                    description = "FreeBSD kernel Symbols")
-                # Would it make sense to require the 'allproc' symbol?
+                #requirements.SymbolTableRequirement(
+                #    name = 'freebsd',  #TODO: is this right?
+                #    description = "FreeBSD kernel Symbols")
             ]
 
     @classmethod
@@ -55,32 +54,18 @@ class PsList(interfaces_plugins.PluginInterface):
         else:
             return lambda _: False
 
-    def _generator(self):
-        """Produces all task after filtering"""
-        for task in list_tasks(
-                self.context,
-                self.config['primary'],
-                self.config['ksyms'],
-                filter = self.create_filter([self.config.get('pid', None)])):
-            pid = task.pid
-            ppid = 0
-            if task.parent:
-                ppid = task.parent.pid
-            name = utility.array_to_string(task.comm)
-            yield (0, (pid, ppid, name))
-
     @classmethod
     def list_tasks(cls,
                    context: interfaces.context.ContextInterface,
                    layer_name: str,
-                   ksyms_symbols: str,
+                   freebsd_symbols: str,
                    filter: Callable[[int],bool] = lambda _:False) \
                    -> Iterable[interfaces.objects.ObjectInterface]:
         """List all processes (tasks) in primary layer"""
         #TODO: aslr_mask_symbol_table?
 
         view = contexts.Module(context,
-                               ksyms_symbols,
+                               freebsd_symbols,
                                layer_name,
                                0,
                                absolute_symbol_addresses=True)
@@ -101,6 +86,19 @@ class PsList(interfaces_plugins.PluginInterface):
             yield proc
             proc = proc.p_list.le_next.dereference()
 
+    def _generator(self):
+        """Produces all task after filtering"""
+        for task in self.list_tasks(
+                self.context,
+                self.config['primary'],
+                self.config['freebsd'],
+                filter = self.create_filter([self.config.get('pid', None)])):
+            pid = task.pid
+            ppid = 0
+            if task.parent:
+                ppid = task.parent.pid
+            name = utility.array_to_string(task.comm)
+            yield (0, (pid, ppid, name))
 
     def run(self):
         """Entry point for plugin"""

volatility/symbols/freebsd/__init__.py

@@ -0,0 +1,30 @@
+# This file was contributed to the Volatility Framework Version 3.
+# Copyright (C) 2018 Volatility Foundation.
+#
+# THE LICENSED WORK IS PROVIDED UNDER THE TERMS OF THE Volatility Contributors
+# Public License V1.0("LICENSE") AS FIRST COMPLETED BY: Volatility Foundation,
+# Inc. ANY USE, PUBLIC DISPLAY, PUBLIC PERFORMANCE, REPRODUCTION OR DISTRIBUTION
+# OF, OR PREPARATION OF SUBSEQUENT WORKS, DERIVATIVE WORKS OR DERIVED WORKS BASED
+# ON, THE LICENSED WORK CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS LICENSE AND ITS
+# TERMS, WHETHER OR NOT SUCH RECIPIENT READS THE TERMS OF THE LICENSE. "LICENSED
+# WORK,” “RECIPIENT" AND “DISTRIBUTOR" ARE DEFINED IN THE LICENSE. A COPY OF THE
+# LICENSE IS LOCATED IN THE TEXT FILE ENTITLED "LICENSE.txt" ACCOMPANYING THE
+# CONTENTS OF THIS FILE. IF A COPY OF THE LICENSE DOES NOT ACCOMPANY THIS FILE, A
+# COPY OF THE LICENSE MAY ALSO BE OBTAINED AT THE FOLLOWING WEB SITE:
+# https://www.volatilityfoundation.org/license/vcpl_v1.0
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License for the
+# specific language governing rights and limitations under the License.
+#
+
+from volatility.framework import interfaces
+from volatility.framework.symbols import intermed
+#from volatility.framework.symbols.linux import extensions #TODO change
+
+
+class FreeBSDKernelIntermedSymbols(intermed.IntermediateSymbolTable):
+    provides = {"type": "interface"}
+
+    def __init__(self, context: interfaces.context.ContextInterface, config_path: str, name: str, isf_url: str) -> None:
+        super().__init__(context = context, config_path = config_path, name = name, isf_url = isf_url)