diff --git a/testing/Makefile b/testing/Makefile new file mode 100644 index 000000000..d0fd53e33 --- /dev/null +++ b/testing/Makefile @@ -0,0 +1,6 @@ +KMOD=cr3_printer +SRCS=cr3_printer.c + +# Name of KLD to build. +# List of source files. +.include diff --git a/testing/cr3_printer.c b/testing/cr3_printer.c new file mode 100644 index 000000000..2fc52b424 --- /dev/null +++ b/testing/cr3_printer.c @@ -0,0 +1,41 @@ +#include +#include +#include +#include +#include +#include + +static void print_symbols() { + uprintf("kernel_pmap: %p\n", kernel_pmap); + uprintf("pm_cr3: %lu\n", kernel_pmapi->pm_cr3); +} + + + +/* The function called at load/unload. */ +static int load(struct module *module, int cmd, void *arg) { + int error = 0; + + switch (cmd) { + case MOD_LOAD: + uprintf("Hello, world!\n"); + break; + case MOD_UNLOAD: + uprintf("Good-bye, cruel world!\n"); + break; + default: + error = EOPNOTSUPP; + break; + } + + return(error); +} + +/* The second argument of DECLARE_MODULE. */ +static moduledata_t hello_mod = { + "hello", /* module name */ + load, /* event handler */ + NULL /* extra data */ +}; + +DECLARE_MODULE(hello, hello_mod, SI_SUB_DRIVERS, SI_ORDER_MIDDLE); diff --git a/volatility/plugins/freebsd/pslist.py b/volatility/plugins/freebsd/pslist.py index d6ef6af99..a0ef3de59 100644 --- a/volatility/plugins/freebsd/pslist.py +++ b/volatility/plugins/freebsd/pslist.py @@ -36,10 +36,9 @@ class PsList(interfaces_plugins.PluginInterface): name = 'primary', description = "Memory layer for the kernel", architectures = ['Intel32', 'Intel64']), - requirements.SymbolRequirement( - name = 'ksyms', #TODO: is this right? - description = "FreeBSD kernel Symbols") - # Would it make sense to require the 'allproc' symbol? + #requirements.SymbolTableRequirement( + # name = 'freebsd', #TODO: is this right? + # description = "FreeBSD kernel Symbols") ] @classmethod @@ -55,32 +54,18 @@ class PsList(interfaces_plugins.PluginInterface): else: return lambda _: False - def _generator(self): - """Produces all task after filtering""" - for task in list_tasks( - self.context, - self.config['primary'], - self.config['ksyms'], - filter = self.create_filter([self.config.get('pid', None)])): - pid = task.pid - ppid = 0 - if task.parent: - ppid = task.parent.pid - name = utility.array_to_string(task.comm) - yield (0, (pid, ppid, name)) - @classmethod def list_tasks(cls, context: interfaces.context.ContextInterface, layer_name: str, - ksyms_symbols: str, + freebsd_symbols: str, filter: Callable[[int],bool] = lambda _:False) \ -> Iterable[interfaces.objects.ObjectInterface]: """List all processes (tasks) in primary layer""" #TODO: aslr_mask_symbol_table? view = contexts.Module(context, - ksyms_symbols, + freebsd_symbols, layer_name, 0, absolute_symbol_addresses=True) @@ -101,6 +86,19 @@ class PsList(interfaces_plugins.PluginInterface): yield proc proc = proc.p_list.le_next.dereference() + def _generator(self): + """Produces all task after filtering""" + for task in self.list_tasks( + self.context, + self.config['primary'], + self.config['freebsd'], + filter = self.create_filter([self.config.get('pid', None)])): + pid = task.pid + ppid = 0 + if task.parent: + ppid = task.parent.pid + name = utility.array_to_string(task.comm) + yield (0, (pid, ppid, name)) def run(self): """Entry point for plugin""" diff --git a/volatility/symbols/freebsd/__init__.py b/volatility/symbols/freebsd/__init__.py new file mode 100644 index 000000000..57972f791 --- /dev/null +++ b/volatility/symbols/freebsd/__init__.py @@ -0,0 +1,30 @@ +# This file was contributed to the Volatility Framework Version 3. +# Copyright (C) 2018 Volatility Foundation. +# +# THE LICENSED WORK IS PROVIDED UNDER THE TERMS OF THE Volatility Contributors +# Public License V1.0("LICENSE") AS FIRST COMPLETED BY: Volatility Foundation, +# Inc. ANY USE, PUBLIC DISPLAY, PUBLIC PERFORMANCE, REPRODUCTION OR DISTRIBUTION +# OF, OR PREPARATION OF SUBSEQUENT WORKS, DERIVATIVE WORKS OR DERIVED WORKS BASED +# ON, THE LICENSED WORK CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS LICENSE AND ITS +# TERMS, WHETHER OR NOT SUCH RECIPIENT READS THE TERMS OF THE LICENSE. "LICENSED +# WORK,” “RECIPIENT" AND “DISTRIBUTOR" ARE DEFINED IN THE LICENSE. A COPY OF THE +# LICENSE IS LOCATED IN THE TEXT FILE ENTITLED "LICENSE.txt" ACCOMPANYING THE +# CONTENTS OF THIS FILE. IF A COPY OF THE LICENSE DOES NOT ACCOMPANY THIS FILE, A +# COPY OF THE LICENSE MAY ALSO BE OBTAINED AT THE FOLLOWING WEB SITE: +# https://www.volatilityfoundation.org/license/vcpl_v1.0 +# +# Software distributed under the License is distributed on an "AS IS" basis, +# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License for the +# specific language governing rights and limitations under the License. +# + +from volatility.framework import interfaces +from volatility.framework.symbols import intermed +#from volatility.framework.symbols.linux import extensions #TODO change + + +class FreeBSDKernelIntermedSymbols(intermed.IntermediateSymbolTable): + provides = {"type": "interface"} + + def __init__(self, context: interfaces.context.ContextInterface, config_path: str, name: str, isf_url: str) -> None: + super().__init__(context = context, config_path = config_path, name = name, isf_url = isf_url)