Merge pull request #928 from eve-mem/linux_maple_tree

Add basic support for Linux maple tree struct

volatility3/framework/plugins/linux/elfs.py

@@ -48,7 +48,7 @@ class Elfs(plugins.PluginInterface):
 
             name = utility.array_to_string(task.comm)
 
-            for vma in task.mm.get_mmap_iter():
+            for vma in task.mm.get_vma_iter():
                 hdr = proc_layer.read(vma.vm_start, 4, pad=True)
                 if not (
                     hdr[0] == 0x7F

volatility3/framework/plugins/linux/malfind.py

@@ -46,7 +46,7 @@ class Malfind(interfaces.plugins.PluginInterface):
 
         proc_layer = self.context.layers[proc_layer_name]
 
-        for vma in task.mm.get_mmap_iter():
+        for vma in task.mm.get_vma_iter():
             if vma.is_suspicious() and vma.get_name(self.context, task) != "[vdso]":
                 data = proc_layer.read(vma.vm_start, 64, pad=True)
                 yield vma, data

volatility3/framework/plugins/linux/proc.py

@@ -44,7 +44,7 @@ class Maps(plugins.PluginInterface):
 
             name = utility.array_to_string(task.comm)
 
-            for vma in task.mm.get_mmap_iter():
+            for vma in task.mm.get_vma_iter():
                 flags = vma.get_protection()
                 page_offset = vma.get_page_offset()
                 major = 0

volatility3/framework/symbols/linux/__init__.py

@@ -51,6 +51,9 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable):
         self.optional_set_type_class("bt_sock", extensions.bt_sock)
         self.optional_set_type_class("xdp_sock", extensions.xdp_sock)
 
+        # Only found in 6.1+ kernels
+        self.optional_set_type_class("maple_tree", extensions.maple_tree)
+
 
 class LinuxUtilities(interfaces.configuration.VersionableInterface):
     """Class with multiple useful linux functions."""

volatility3/framework/symbols/linux/extensions/__init__.py

@@ -34,10 +34,8 @@ class module(generic.GenericIntelProcess):
     def get_init_size(self):
         if self.has_member("init_layout"):
             return self.init_layout.size
-
         elif self.has_member("init_size"):
             return self.init_size
-
         raise AttributeError(
             "module -> get_init_size: Unable to determine .init section size of module"
         )
@@ -45,10 +43,8 @@ class module(generic.GenericIntelProcess):
     def get_core_size(self):
         if self.has_member("core_layout"):
             return self.core_layout.size
-
         elif self.has_member("core_size"):
             return self.core_size
-
         raise AttributeError(
             "module -> get_core_size: Unable to determine core size of module"
         )
@@ -58,7 +54,6 @@ class module(generic.GenericIntelProcess):
             return self.core_layout.base
         elif self.has_member("module_core"):
             return self.module_core
-
         raise AttributeError("module -> get_module_core: Unable to get module core")
 
     def get_module_init(self):
@@ -66,7 +61,6 @@ class module(generic.GenericIntelProcess):
             return self.init_layout.base
         elif self.has_member("module_init"):
             return self.module_init
-
         raise AttributeError("module -> get_module_core: Unable to get module init")
 
     def get_name(self):
@@ -88,7 +82,6 @@ class module(generic.GenericIntelProcess):
         idx = 0
         while arr[idx]:
             idx = idx + 1
-
         return idx
 
     def get_sections(self):
@@ -97,7 +90,6 @@ class module(generic.GenericIntelProcess):
             num_sects = self.sect_attrs.nsections
         else:
             num_sects = self._get_sect_count(self.sect_attrs.grp)
-
         arr = self._context.object(
             self.get_symbol_table().name + constants.BANG + "array",
             layer_name=self.vol.layer_name,
@@ -116,7 +108,6 @@ class module(generic.GenericIntelProcess):
             prefix = "Elf64_"
         else:
             prefix = "Elf32_"
-
         elf_table_name = intermed.IntermediateSymbolTable.create(
             self.context,
             self.config_path,
@@ -155,7 +146,6 @@ class module(generic.GenericIntelProcess):
             return self.kallsyms.symtab
         elif self.has_member("symtab"):
             return self.symtab
-
         raise AttributeError("module -> symtab: Unable to get symtab")
 
     @property
@@ -164,7 +154,6 @@ class module(generic.GenericIntelProcess):
             return int(self.kallsyms.num_symtab)
         elif self.has_member("num_symtab"):
             return int(self.num_symtab)
-
         raise AttributeError(
             "module -> num_symtab: Unable to determine number of symbols"
         )
@@ -177,7 +166,6 @@ class module(generic.GenericIntelProcess):
         # Older kernels
         elif self.has_member("strtab"):
             return self.strtab
-
         raise AttributeError("module -> strtab: Unable to get strtab")
 
 
@@ -195,19 +183,15 @@ class task_struct(generic.GenericIntelProcess):
             pgd = self.mm.pgd
         except exceptions.InvalidAddressException:
             return None
-
         if not isinstance(parent_layer, linear.LinearlyMappedLayer):
             raise TypeError(
                 "Parent layer is not a translation layer, unable to construct process layer"
             )
-
         dtb, layer_name = parent_layer.translate(pgd)
         if not dtb:
             return None
-
         if preferred_name is None:
             preferred_name = self.vol.layer_name + f"_Process{self.pid}"
-
         # Add the constructed layer and return the name
         return self._add_process_layer(
             self._context, dtb, config_prefix, preferred_name
@@ -229,7 +213,6 @@ class task_struct(generic.GenericIntelProcess):
                 vollog.info(
                     f"adding vma: {start:x} {self.mm.brk:x} | {end:x} {self.mm.start_brk:x}"
                 )
-
             yield (start, end - start)
 
     @property
@@ -282,7 +265,6 @@ class fs_struct(objects.StructType):
             return self.root
         elif self.root.has_member("dentry"):
             return self.root.dentry
-
         raise AttributeError("Unable to find the root dentry")
 
     def get_root_mnt(self):
@@ -291,17 +273,135 @@ class fs_struct(objects.StructType):
             return self.rootmnt
         elif self.root.has_member("mnt"):
             return self.root.mnt
-
         raise AttributeError("Unable to find the root mount")
 
 
+class maple_tree(objects.StructType):
+    # include/linux/maple_tree.h
+    # Mask for Maple Tree Flags
+    MT_FLAGS_HEIGHT_MASK = 0x7C
+    MT_FLAGS_HEIGHT_OFFSET = 0x02
+
+    # Shift and mask to extract information from maple tree node pointers
+    MAPLE_NODE_TYPE_SHIFT = 0x03
+    MAPLE_NODE_TYPE_MASK = 0x0F
+    MAPLE_NODE_POINTER_MASK = 0xFF
+
+    # types of Maple Tree Nodes
+    MAPLE_DENSE = 0
+    MAPLE_LEAF_64 = 1
+    MAPLE_RANGE_64 = 2
+    MAPLE_ARANGE_64 = 3
+
+    def get_slot_iter(self):
+        """Parse the Maple Tree and return every non zero slot."""
+        maple_tree_offset = self.vol.offset & ~(self.MAPLE_NODE_POINTER_MASK)
+        expected_maple_tree_depth = (
+            self.ma_flags & self.MT_FLAGS_HEIGHT_MASK
+        ) >> self.MT_FLAGS_HEIGHT_OFFSET
+        yield from self._parse_maple_tree_node(
+            self.ma_root, maple_tree_offset, expected_maple_tree_depth
+        )
+
+    def _parse_maple_tree_node(
+        self,
+        maple_tree_entry,
+        parent,
+        expected_maple_tree_depth,
+        seen=set(),
+        current_depth=1,
+    ):
+        """Recursively parse Maple Tree Nodes and yield all non empty slots"""
+
+        # protect against unlikely loop
+        if maple_tree_entry in seen:
+            vollog.warning(
+                f"The mte {hex(maple_tree_entry)} has all ready been seen, no further results will be produced for this node."
+            )
+            return
+        else:
+            seen.add(maple_tree_entry)
+        # check if we have exceeded the expected depth of this maple tree.
+        # e.g. when current_depth is larger than expected_maple_tree_depth there may be an issue.
+        # it is normal that expected_maple_tree_depth is equal to current_depth.
+        if expected_maple_tree_depth < current_depth:
+            vollog.warning(
+                f"The depth for the maple tree at {hex(self.vol.offset)} is {expected_maple_tree_depth}, however when parsing the nodes "
+                f"a depth of {current_depth} was reached. This is unexpected and may lead to incorrect results."
+            )
+        # parse the mte to extract the pointer value, node type, and leaf status
+        pointer = maple_tree_entry & ~(self.MAPLE_NODE_POINTER_MASK)
+        node_type = (
+            maple_tree_entry >> self.MAPLE_NODE_TYPE_SHIFT
+        ) & self.MAPLE_NODE_TYPE_MASK
+
+        # create a pointer object for the node parent mte (note this will include flags in the low bits)
+        symbol_table_name = self.get_symbol_table_name()
+        node_parent_mte = self._context.object(
+            symbol_table_name + constants.BANG + "pointer",
+            layer_name=self.vol.native_layer_name,
+            offset=pointer,
+        )
+
+        # extract the actual pointer to the parent of this node
+        node_parent_pointer = node_parent_mte & ~(self.MAPLE_NODE_POINTER_MASK)
+
+        # verify that the node_parent_pointer correctly points to the parent
+        assert node_parent_pointer == parent
+
+        # create a node object
+        node = self._context.object(
+            symbol_table_name + constants.BANG + "maple_node",
+            layer_name=self.vol.layer_name,
+            offset=pointer,
+        )
+
+        # parse the slots based on the node type
+        if node_type == self.MAPLE_DENSE:
+            for slot in node.alloc.slot:
+                if (slot & ~(self.MAPLE_NODE_TYPE_MASK)) != 0:
+                    yield slot
+        elif node_type == self.MAPLE_LEAF_64:
+            for slot in node.mr64.slot:
+                if (slot & ~(self.MAPLE_NODE_TYPE_MASK)) != 0:
+                    yield slot
+        elif node_type == self.MAPLE_RANGE_64:
+            for slot in node.mr64.slot:
+                if (slot & ~(self.MAPLE_NODE_TYPE_MASK)) != 0:
+                    yield from self._parse_maple_tree_node(
+                        slot,
+                        pointer,
+                        expected_maple_tree_depth,
+                        seen,
+                        current_depth + 1,
+                    )
+        elif node_type == self.MAPLE_ARANGE_64:
+            for slot in node.ma64.slot:
+                if (slot & ~(self.MAPLE_NODE_TYPE_MASK)) != 0:
+                    yield from self._parse_maple_tree_node(
+                        slot,
+                        pointer,
+                        expected_maple_tree_depth,
+                        seen,
+                        current_depth + 1,
+                    )
+        else:
+            # unkown maple node type
+            raise AttributeError(
+                f"Unkown Maple Tree node type {node_type} at offset {hex(pointer)}."
+            )
+
+
 class mm_struct(objects.StructType):
     def get_mmap_iter(self) -> Iterable[interfaces.objects.ObjectInterface]:
         """Returns an iterator for the mmap list member of an mm_struct."""
 
+        if not self.has_member("mmap"):
+            raise AttributeError(
+                "get_mmap_iter called on mm_struct where no mmap member exists."
+            )
         if not self.mmap:
             return
-
         yield self.mmap
 
         seen = {self.mmap.vol.offset}
@@ -312,6 +412,33 @@ class mm_struct(objects.StructType):
             seen.add(link.vol.offset)
             link = link.vm_next
 
+    def get_maple_tree_iter(self) -> Iterable[interfaces.objects.ObjectInterface]:
+        """Returns an iterator for the mm_mt member of an mm_struct."""
+
+        if not self.has_member("mm_mt"):
+            raise AttributeError(
+                "get_maple_tree_iter called on mm_struct where no mm_mt member exists."
+            )
+        symbol_table_name = self.get_symbol_table_name()
+        for vma_pointer in self.mm_mt.get_slot_iter():
+            # convert pointer to vm_area_struct and yield
+            vma = self._context.object(
+                symbol_table_name + constants.BANG + "vm_area_struct",
+                layer_name=self.vol.native_layer_name,
+                offset=vma_pointer,
+            )
+            yield vma
+
+    def get_vma_iter(self) -> Iterable[interfaces.objects.ObjectInterface]:
+        """Returns an iterator for the VMAs in an mm_struct. Automatically choosing the mmap or mm_mt as required."""
+
+        if self.has_member("mmap"):
+            yield from self.get_mmap_iter()
+        elif self.has_member("mm_mt"):
+            yield from self.get_maple_tree_iter()
+        else:
+            raise AttributeError("Unable to find mmap or mm_mt in mm_struct")
+
 
 class super_block(objects.StructType):
     # include/linux/kdev_t.h
@@ -418,7 +545,6 @@ class vm_area_struct(objects.StructType):
                 retval = retval + char
             else:
                 retval = retval + "-"
-
         return retval
 
     # only parse the rwx bits
@@ -432,7 +558,6 @@ class vm_area_struct(objects.StructType):
     def get_page_offset(self) -> int:
         if self.vm_file == 0:
             return 0
-
         return self.vm_pgoff << constants.linux.PAGE_SHIFT
 
     def get_name(self, context, task):
@@ -449,7 +574,6 @@ class vm_area_struct(objects.StructType):
             fname = "[vdso]"
         else:
             fname = "Anonymous Mapping"
-
         return fname
 
     # used by malfind
@@ -460,10 +584,8 @@ class vm_area_struct(objects.StructType):
 
         if flags_str == "rwx":
             ret = True
-
         elif flags_str == "r-x" and self.vm_file.dereference().vol.offset == 0:
             ret = True
-
         return ret
 
 
@@ -473,12 +595,10 @@ class qstr(objects.StructType):
             str_length = self.len + 1  # Maximum length should include null terminator
         else:
             str_length = 255
-
         try:
             ret = objects.utility.pointer_to_string(self.name, str_length)
         except (exceptions.InvalidAddressException, ValueError):
             ret = ""
-
         return ret
 
 
@@ -509,7 +629,6 @@ class dentry(objects.StructType):
         """
         if self.vol.offset == old_dentry:
             return True
-
         return self.d_ancestor(old_dentry)
 
     def d_ancestor(self, ancestor_dentry):
@@ -527,10 +646,8 @@ class dentry(objects.StructType):
         ):
             if current_dentry.d_parent == ancestor_dentry.vol.offset:
                 return current_dentry
-
             dentry_seen.add(current_dentry.vol.offset)
             current_dentry = current_dentry.d_parent
-
         return None
 
 
@@ -588,12 +705,10 @@ class list_head(objects.StructType, collections.abc.Iterable):
             link = getattr(self, direction).dereference()
         except exceptions.InvalidAddressException:
             return
-
         if not sentinel:
             yield self._context.object(
                 symbol_type, layer, offset=self.vol.offset - relative_offset
             )
-
         seen = {self.vol.offset}
         while link.vol.offset not in seen:
             obj = self._context.object(
@@ -775,7 +890,6 @@ class mount(objects.StructType):
             peer = current_mnt.get_peer_under_root(self.mnt_ns, root)
             if peer and peer.vol.offset != 0:
                 return peer.mnt_group_id
-
             mnt_seen.add(current_mnt.vol.offset)
             current_mnt = current_mnt.mnt_master
         return 0
@@ -791,12 +905,10 @@ class mount(objects.StructType):
                 current_mnt.mnt.mnt_root, root
             ):
                 return current_mnt
-
             mnt_seen.add(current_mnt.vol.offset)
             current_mnt = current_mnt.next_peer()
             if current_mnt.vol.offset == self.vol.offset:
                 break
-
         return None
 
     def is_path_reachable(self, current_dentry, root):
@@ -813,7 +925,6 @@ class mount(objects.StructType):
             current_dentry = current_mnt.mnt_mountpoint
             mnt_seen.add(current_mnt.vol.offset)
             current_mnt = current_mnt.mnt_parent
-
         return current_mnt.mnt.vol.offset == root.mnt and current_dentry.is_subdir(
             root.dentry
         )
@@ -1006,7 +1117,6 @@ class kobject(objects.StructType):
             ret = refcnt.counter
         else:
             ret = refcnt.refs.counter
-
         return ret
 
 
@@ -1025,7 +1135,6 @@ class mnt_namespace(objects.StructType):
         if not self._context.symbol_space.has_type(mnt_type):
             # Old kernels ~ 2.6
             mnt_type = table_name + constants.BANG + "vfsmount"
-
         for mount in self.list.to_list(mnt_type, "mnt_list"):
             yield mount
 
@@ -1053,7 +1162,6 @@ class socket(objects.StructType):
         )
         if not module_names:
             raise ValueError(f"No module using the symbol table {symbol_table}")
-
         kernel_module_name = module_names[0]
         kernel = self._context.modules[kernel_module_name]
         return kernel
@@ -1063,7 +1171,6 @@ class socket(objects.StructType):
             kernel = self._get_vol_kernel()
         except ValueError:
             return 0
-
         socket_alloc = linux.LinuxUtilities.container_of(
             self.vol.offset, "socket_alloc", "socket", kernel
         )
@@ -1089,7 +1196,6 @@ class sock(objects.StructType):
     def get_inode(self):
         if not self.sk_socket:
             return 0
-
         return self.sk_socket.get_inode()
 
     def get_protocol(self):
@@ -1099,7 +1205,6 @@ class sock(objects.StructType):
         # Return the generic socket state
         if self.has_member("sk"):
             return self.sk.sk_socket.get_state()
-
         return self.sk_socket.get_state()
 
 
@@ -1107,7 +1212,6 @@ class unix_sock(objects.StructType):
     def get_name(self):
         if not self.addr:
             return
-
         sockaddr_un = self.addr.name.cast("sockaddr_un")
         saddr = str(utility.array_to_string(sockaddr_un.sun_path))
         return saddr
@@ -1143,7 +1247,6 @@ class inet_sock(objects.StructType):
         protocol = IP_PROTOCOLS.get(self.sk.sk_protocol)
         if self.get_family() == "AF_INET6":
             protocol = IPV6_PROTOCOLS.get(self.sk.sk_protocol, protocol)
-
         return protocol
 
     def get_state(self):
@@ -1174,7 +1277,6 @@ class inet_sock(objects.StructType):
             dport_le = sk_common.skc_dport
         else:
             return
-
         return socket_module.htons(dport_le)
 
     def get_src_addr(self):
@@ -1193,7 +1295,6 @@ class inet_sock(objects.StructType):
             saddr = self.pinet6.saddr
         else:
             return
-
         parent_layer = self._context.layers[self.vol.layer_name]
         try:
             addr_bytes = parent_layer.read(saddr.vol.offset, addr_size)
@@ -1202,7 +1303,6 @@ class inet_sock(objects.StructType):
                 f"Unable to read socket src address from {saddr.vol.offset:#x}"
             )
             return
-
         return socket_module.inet_ntop(family, addr_bytes)
 
     def get_dst_addr(self):
@@ -1224,7 +1324,6 @@ class inet_sock(objects.StructType):
             addr_size = 16
         else:
             return
-
         parent_layer = self._context.layers[self.vol.layer_name]
         try:
             addr_bytes = parent_layer.read(daddr.vol.offset, addr_size)
@@ -1233,7 +1332,6 @@ class inet_sock(objects.StructType):
                 f"Unable to read socket dst address from {daddr.vol.offset:#x}"
             )
             return
-
         return socket_module.inet_ntop(family, addr_bytes)