From 57b2a5bab7dffc00fc658caf99cabd22e211448c Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 12 Dec 2018 00:52:28 +0000 Subject: [PATCH] Fix up a rogue classmethod, and ensure we have a separate variable for the new layer. --- volatility/framework/automagic/mac.py | 33 +++++++++++++++------------ 1 file changed, 19 insertions(+), 14 deletions(-) diff --git a/volatility/framework/automagic/mac.py b/volatility/framework/automagic/mac.py index def713986..3bb234ca4 100644 --- a/volatility/framework/automagic/mac.py +++ b/volatility/framework/automagic/mac.py @@ -2,7 +2,7 @@ import logging import struct import typing -from volatility.framework import interfaces, constants, validity +from volatility.framework import interfaces, constants, validity, layers from volatility.framework import symbols from volatility.framework.automagic import symbol_cache, symbol_finder from volatility.framework.layers import intel, scanners @@ -38,6 +38,7 @@ class MacintelStacker(interfaces.automagic.StackerLayerInterface): """Attempts to identify mac within this layer""" # Bail out by default unless we can stack properly layer = context.memory[layer_name] + new_layer = None join = interfaces.configuration.path_join # Never stack on top of an intel layer @@ -46,9 +47,9 @@ class MacintelStacker(interfaces.automagic.StackerLayerInterface): return None mac_banners = MacBannerCache.load_banners() - mss = scanners.MultiStringScanner([x for x in mac_banners if x is not None]) - for banner_offset, banner in layer.scan(context = context, scanner = mss, + for banner_offset, banner in layer.scan(context = context, + scanner = scanners.MultiStringScanner([x for x in mac_banners if x]), progress_callback = progress_callback): dtb = None vollog.debug("Identified banner: {}".format(repr(banner))) @@ -57,11 +58,17 @@ class MacintelStacker(interfaces.automagic.StackerLayerInterface): if symbol_files: isf_path = symbol_files[0] table_name = context.symbol_space.free_table_name('MacintelStacker') - table = mac.MacKernelIntermedSymbols(context, 'temporary.' + table_name, name = table_name, + table = mac.MacKernelIntermedSymbols(context = context, + config_path = join('temporary', table_name), + name = table_name, isf_url = isf_path) context.symbol_space.append(table) - kaslr_shift = MacUtilities.find_aslr(context, table_name, layer_name, - banner, banner_offset, progress_callback = progress_callback) + kaslr_shift = MacUtilities.find_aslr(context = context, + symbol_table = table_name, + layer_name = layer_name, + compare_banner = banner, + compare_banner_offset = banner_offset, + progress_callback = progress_callback) ###################### # ikelos: The following is what I tried to get the dtb, but couldn't figure out how to do @@ -98,11 +105,11 @@ class MacintelStacker(interfaces.automagic.StackerLayerInterface): context.config[join(config_path, "page_map_offset")] = dtb context.config[join(config_path, MacSymbolFinder.banner_config_key)] = str(banner, 'latin-1') - layer = intel.Intel32e(context, config_path = config_path, name = new_layer_name) + new_layer = intel.Intel32e(context, config_path = config_path, name = new_layer_name) - if layer and dtb: + if new_layer and dtb: vollog.debug("DTB was found at: 0x{:0x}".format(dtb)) - return layer + return new_layer return None @@ -124,7 +131,8 @@ class MacUtilities(object): symbols.utility.mask_symbol_table(context.symbol_space[sym_table_name], context.memory[sym_layer_name].address_mask, aslr_shift) - def _scan_generator(self, context, layer_name, progress_callback): + @classmethod + def _scan_generator(cls, context, layer_name, progress_callback): darwin_signature = b"Darwin Kernel Version \d{1,3}\.\d{1,3}\.\d{1,3}: [^\x00]+\x00" for offset in context.memory[layer_name].scan(scanner = scanners.RegExScanner(darwin_signature), @@ -150,7 +158,6 @@ class MacUtilities(object): """Determines the offset of the actual DTB in physical space and its symbol offset""" version_symbol = symbol_table + constants.BANG + 'version' version_json_address = context.symbol_space.get_symbol(version_symbol).address - version_phys_offset = MacUtilities.virtual_to_physical_address(version_json_address) version_major_symbol = symbol_table + constants.BANG + 'version_major' version_major_json_address = context.symbol_space.get_symbol(version_major_symbol).address @@ -160,10 +167,8 @@ class MacUtilities(object): version_minor_json_address = context.symbol_space.get_symbol(version_minor_symbol).address version_minor_phys_offset = MacUtilities.virtual_to_physical_address(version_minor_json_address) - module = context.module(symbol_table, layer_name, 0) - if compare_banner_offset == 0 or compare_banner == "": - offset_generator = cls._scan_generator(cls, context, layer_name, progress_callback) + offset_generator = cls._scan_generator(context, layer_name, progress_callback) else: offset_generator = [(compare_banner_offset, compare_banner)]