WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-29 13:04:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

Windows: Fix up modules dumping

Browse Source
This commit is contained in:
Mike Auty
2020-10-29 09:43:16 +00:00
committed by ikelos
parent b703210024
commit 616f7e5d96
1 changed files with 91 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/modscan.py
+91 -8
View File
@@ -1,15 +1,17 @@
# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
import logging
from typing import Iterable, List, Generator
from typing import Iterable
from volatility.framework import renderers, interfaces, exceptions
from volatility.framework import renderers, interfaces, exceptions, constants
from volatility.framework.configuration import requirements
from volatility.framework.renderers import format_hints
from volatility.framework.symbols import intermed
from volatility.framework.symbols.windows.extensions import pe
from volatility.plugins.windows import poolscanner, dlllist
from volatility.plugins.windows import poolscanner, dlllist, pslist
vollog = logging.getLogger(__name__)
class ModScan(interfaces.plugins.PluginInterface):
@@ -27,6 +29,7 @@ class ModScan(interfaces.plugins.PluginInterface):
requirements.VersionRequirement(name = 'poolerscanner',
component = poolscanner.PoolScanner,
version = (1, 0, 0)),
requirements.VersionRequirement(name = 'pslist', component = dlllist.DllList, version = (2, 0, 0)),
requirements.VersionRequirement(name = 'dlllist', component = dlllist.DllList, version = (2, 0, 0)),
requirements.BooleanRequirement(name = 'dump',
description = "Extract listed modules",
@@ -58,7 +61,82 @@ class ModScan(interfaces.plugins.PluginInterface):
_constraint, mem_object, _header = result
yield mem_object
@classmethod
def get_session_layers(cls,
context: interfaces.context.ContextInterface,
layer_name: str,
symbol_table: str,
pids: List[int] = None) -> Generator[str, None, None]:
"""Build a cache of possible virtual layers, in priority starting with
the primary/kernel layer. Then keep one layer per session by cycling
through the process list.
Args:
context: The context to retrieve required elements (layers, symbol tables) from
layer_name: The name of the layer on which to operate
symbol_table: The name of the table containing the kernel symbols
pids: A list of process identifiers to include exclusively or None for no filter
Returns:
A list of session layer names
"""
seen_ids = [] # type: List[interfaces.objects.ObjectInterface]
filter_func = pslist.PsList.create_pid_filter(pids or [])
for proc in pslist.PsList.list_processes(context = context,
layer_name = layer_name,
symbol_table = symbol_table,
filter_func = filter_func):
proc_id = "Unknown"
try:
proc_id = proc.UniqueProcessId
proc_layer_name = proc.add_process_layer()
# create the session space object in the process' own layer.
# not all processes have a valid session pointer.
session_space = context.object(symbol_table + constants.BANG + "_MM_SESSION_SPACE",
layer_name = layer_name,
offset = proc.Session)
if session_space.SessionId in seen_ids:
continue
except exceptions.InvalidAddressException:
vollog.log(
constants.LOGLEVEL_VVV,
"Process {} does not have a valid Session or a layer could not be constructed for it".format(
proc_id))
continue
# save the layer if we haven't seen the session yet
seen_ids.append(session_space.SessionId)
yield proc_layer_name
@classmethod
def find_session_layer(cls, context: interfaces.context.ContextInterface, session_layers: Iterable[str],
base_address: int):
"""Given a base address and a list of layer names, find a layer that
can access the specified address.
Args:
context: The context to retrieve required elements (layers, symbol tables) from
layer_name: The name of the layer on which to operate
symbol_table: The name of the table containing the kernel symbols
session_layers: A list of session layer names
base_address: The base address to identify the layers that can access it
Returns:
Layer name or None if no layers that contain the base address can be found
"""
for layer_name in session_layers:
if context.layers[layer_name].is_valid(base_address):
return layer_name
return None
def _generator(self):
session_layers = list(self.get_session_layers(self.context, self.config['primary'], self.config['nt_symbols']))
pe_table_name = intermed.IntermediateSymbolTable.create(self.context,
self.config_path,
"windows",
@@ -79,10 +157,15 @@ class ModScan(interfaces.plugins.PluginInterface):
file_output = "Disabled"
if self.config['dump']:
file_handler = dlllist.DllList.dump_pe(self.context, pe_table_name, mod, self.open)
file_output = "Error outputting file"
if file_handler:
file_output = file_handler.preferred_filename
session_layer_name = self.find_session_layer(self.context, session_layers, mod.DllBase)
file_output = "Cannot find a viable session layer for {0:#x}".format(mod.DllBase)
if session_layer_name:
file_handler = dlllist.DllList.dump_pe(self.context, pe_table_name, mod, self.open,
layer_name = session_layer_name)
file_output = "Error outputting file"
if file_handler:
file_output = file_handler.preferred_filename
yield (0, (
format_hints.Hex(mod.vol.offset),