WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-07 18:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' of github.com:volatilityfoundation/volatility3

Browse Source
This commit is contained in:
Mike Auty
2016-12-26 22:53:29 +00:00
parent ba7275f973 b54cb86c89
commit 4cd9b98211
4 changed files with 34 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/automagic/pdbscan.py
+4 -1
View File
@@ -8,6 +8,7 @@ import struct
from volatility.framework import exceptions, layers
from volatility.framework.layers import scanners
from volatility.framework.symbols import native
if __name__ == "__main__":
import sys
@@ -237,7 +238,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface):
seen = set()
for result in results:
# TODO: Identify the specific structure we're finding and document this a bit better
pointer = context.object("unsigned long long", offset = (result - 16 - 8),
pointer = context.object("pdbscan!unsigned long long", offset = (result - 16 - 8),
layer_name = physical_layer_name)
address = pointer & vlayer.address_mask
if address in seen:
@@ -261,6 +262,8 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface):
def __call__(self, context, config_path, requirement):
# TODO: Check if we really need to search for pdbs
if "pdbscan" not in context.symbol_space:
context.symbol_space.append(native.NativeTable("pdbscan", native.std_ctypes))
self._symbol_requirements = self.recurse_symbol_requirements(context, config_path, requirement)
if self._symbol_requirements:
potential_kernels = self.recurse_pdb_finder(context, config_path, requirement)
volatility/framework/layers/vmware.py
+11 -5
View File
@@ -5,6 +5,7 @@ from urllib import parse
from volatility.framework import interfaces
from volatility.framework.configuration import requirements
from volatility.framework.layers import physical, segmented
from volatility.framework.symbols import native
PAGE_SIZE = 0x1000
@@ -30,6 +31,9 @@ class VmwareLayer(segmented.SegmentedLayer):
def _read_header(self):
"""Checks the vmware header to make sure it's valid"""
if "vmware" not in self._context.symbol_space:
self._context.symbol_space.append(native.NativeTable("vmware", native.std_ctypes))
meta_layer = self.context.memory.get(self._meta_layer, None)
header_size = struct.calcsize(self.header_structure)
data = meta_layer.read(0, header_size)
@@ -54,27 +58,29 @@ class VmwareLayer(segmented.SegmentedLayer):
tags_read = False
offset = memory
tags = {}
index_len = self._context.symbol_space.get_type("unsigned int").size
index_len = self._context.symbol_space.get_type("vmware!unsigned int").size
while not tags_read:
flags = ord(meta_layer.read(offset, 1))
name_len = ord(meta_layer.read(offset + 1, 1))
tags_read = (flags == 0) and (name_len == 0)
if not tags_read:
name = self._context.object("string", layer_name = self._meta_layer, offset = offset + 2,
name = self._context.object("vmware!string", layer_name = self._meta_layer, offset = offset + 2,
max_length = name_len)
indicies_len = (flags >> 6) & 3
indicies = []
for index in range(indicies_len):
indicies.append(
self._context.object("unsigned int",
self._context.object("vmware!unsigned int",
offset = offset + name_len + 2 + (index * index_len),
layer_name = self._meta_layer))
data = self._context.object("unsigned int", layer_name = self._meta_layer,
data = self._context.object("vmware!unsigned int", layer_name = self._meta_layer,
offset = offset + 2 + name_len + (indicies_len * index_len))
tags[(name, tuple(indicies))] = (flags, data)
offset += 2 + name_len + (indicies_len * index_len) + self._context.symbol_space.get_type(
"unsigned int").size
"vmware!unsigned int").size
if tags[("regionsCount", ())][1] == 0:
raise ValueError("VMware VMEM is not split into regions")
for region in range(tags[("regionsCount", ())][1]):
offset = tags[("regionPPN", (region,))][1] * PAGE_SIZE
mapped_offset = tags[("regionPageNum", (region,))][1] * PAGE_SIZE
volatility/framework/symbols/__init__.py
+1 -1
View File
@@ -69,7 +69,7 @@ class SymbolSpace(collections.abc.Mapping):
def append(self, value):
"""Adds a symbol_list to the end of the space"""
if not isinstance(value, interfaces.symbols.SymbolTableInterface):
if not isinstance(value, interfaces.symbols.BaseSymbolTableInterface):
raise TypeError(value)
if value.name in self._dict:
self.remove(value.name)
volatility/framework/symbols/native.py
+18 -17
View File
@@ -76,23 +76,24 @@ class NativeTable(interfaces.symbols.NativeTableInterface):
**additional)
native_types = {'int': (objects.Integer, '<i'),
'long': (objects.Integer, '<i'),
'unsigned long': (objects.Integer, '<I'),
'unsigned int': (objects.Integer, '<I'),
'pointer': (objects.Pointer, '<I'),
'char': (objects.Integer, '<b'),
'byte': (objects.Bytes, '<c'),
'unsigned char': (objects.Integer, '<B'),
'unsigned short int': (objects.Integer, '<H'),
'unsigned short': (objects.Integer, '<H'),
'unsigned be short': (objects.Integer, '>H'),
'short': (objects.Integer, '<h'),
'long long': (objects.Integer, '<q'),
'unsigned long long': (objects.Integer, '<Q'),
'float': (objects.Float, "<d"),
'double': (objects.Float, "<d"),
'wchar': (objects.Integer, '<H')}
std_ctypes = {'int': (objects.Integer, '<i'),
'long': (objects.Integer, '<i'),
'unsigned long': (objects.Integer, '<I'),
'unsigned int': (objects.Integer, '<I'),
'char': (objects.Integer, '<b'),
'byte': (objects.Bytes, '<c'),
'unsigned char': (objects.Integer, '<B'),
'unsigned short int': (objects.Integer, '<H'),
'unsigned short': (objects.Integer, '<H'),
'unsigned be short': (objects.Integer, '>H'),
'short': (objects.Integer, '<h'),
'long long': (objects.Integer, '<q'),
'unsigned long long': (objects.Integer, '<Q'),
'float': (objects.Float, "<d"),
'double': (objects.Float, "<d"),
'wchar': (objects.Integer, '<H')}
native_types = std_ctypes.copy()
native_types['pointer'] = (objects.Pointer, "<I")
x86NativeTable = NativeTable("native", native_types)
native_types['pointer'] = (objects.Pointer, '<Q')
x64NativeTable = NativeTable("native", native_types)