diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index adecc36d0..ff6bbbfe4 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -373,8 +373,8 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface): @staticmethod def _vmcoreinfo_find_aslr(vmcoreinfo) -> Tuple[int, int]: - phys_base_str = vmcoreinfo.get("NUMBER(phys_base)") - if phys_base_str is None: + phys_base = vmcoreinfo.get("NUMBER(phys_base)") + if phys_base is None: # In kernel < 4.10, there may be a SYMBOL(phys_base), but as noted in the # c401721ecd1dcb0a428aa5d6832ee05ffbdbffbbe commit comment, this value # isn't useful for calculating the physical address. @@ -383,15 +383,15 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface): return None # kernels 3.14 (b6085a865762236bb84934161273cdac6dd11c2d) KERNELOFFSET was added - kerneloffset_str = vmcoreinfo.get("KERNELOFFSET") - if kerneloffset_str is None: + kerneloffset = vmcoreinfo.get("KERNELOFFSET") + if kerneloffset is None: # kernels < 3.14 if KERNELOFFSET is missing, KASLR might not be implemented. # Oddly, NUMBER(phys_base) is present without it. To be safe, proceed only # if both are present. return None - aslr_shift = int(kerneloffset_str, 16) - kaslr_shift = int(phys_base_str) + aslr_shift + aslr_shift = kerneloffset + kaslr_shift = phys_base + aslr_shift return kaslr_shift, aslr_shift @@ -403,7 +403,11 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface): # in kernels 4.13 in 65ade2f872b474fa8a04c2d397783350326634e6) to init_top_pgt. # In x86-32, the pgd is swapper_pg_dir. So, in any case, for VMCOREINFO # SYMBOL(swapper_pg_dir) will always have the right value. - dtb_vaddr = int(vmcoreinfo["SYMBOL(swapper_pg_dir)"], 16) + dtb_vaddr = vmcoreinfo.get("SYMBOL(swapper_pg_dir)") + if dtb_vaddr is None: + # Abort, it should be present + return None + dtb_paddr = ( LinuxIntelStacker.virtual_to_physical_address(dtb_vaddr) - aslr_shift @@ -420,7 +424,7 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface): is_32bit = True else: # Check the swapper_pg_dir virtual address size - dtb_vaddr = int(vmcoreinfo["SYMBOL(swapper_pg_dir)"], 16) + dtb_vaddr = vmcoreinfo["SYMBOL(swapper_pg_dir)"] is_32bit = dtb_vaddr <= 2**32 return is_32bit, is_pae diff --git a/volatility3/framework/plugins/linux/vmcoreinfo.py b/volatility3/framework/plugins/linux/vmcoreinfo.py index ea30520e3..0f07f8589 100644 --- a/volatility3/framework/plugins/linux/vmcoreinfo.py +++ b/volatility3/framework/plugins/linux/vmcoreinfo.py @@ -38,6 +38,11 @@ class VMCoreInfo(plugins.PluginInterface): layer_name=layer_name, ): for key, value in vmcoreinfo.items(): + if key.startswith("SYMBOL(") or key == "KERNELOFFSET": + value = f"0x{value:x}" + else: + value = str(value) + yield 0, (format_hints.Hex(vmcoreinfo_offset), key, value) def run(self): diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index b0b6b7325..b8a2056d5 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -842,8 +842,9 @@ class VMCoreInfo(interfaces.configuration.VersionableInterface): _version = (1, 0, 0) - @staticmethod + @classmethod def _vmcoreinfo_data_to_dict( + cls, vmcoreinfo_data, ) -> Optional[Dict[str, str]]: """Converts the input VMCoreInfo data buffer into a dictionary""" @@ -859,10 +860,22 @@ class VMCoreInfo(interfaces.configuration.VersionableInterface): break key, value = line.split("=", 1) - vmcoreinfo_dict[key] = value + vmcoreinfo_dict[key] = cls._parse_value(key, value) return vmcoreinfo_dict + @classmethod + def _parse_value(cls, key, value): + if key.startswith("SYMBOL(") or key == "KERNELOFFSET": + return int(value, 16) + elif key.startswith(("NUMBER(", "LENGTH(", "SIZE(", "OFFSET(")): + return int(value) + elif key == "PAGESIZE": + return int(value) + + # Default, as string + return value + @classmethod def search_vmcoreinfo_elf_note( cls,