From 6fc12e9b01fd81a068e28aa2ce3d36a8de7cba0d Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 23 Aug 2019 21:41:50 +0100 Subject: [PATCH] Make sure options are specific to each plugin. So this feels like a contentious decision. It'd be awesome to have the options for the methods stored along-side the methods themselves. The downside with this is that the thing accessing the configuration data is always the plugin, so it's the plugin that must have requested the configuration option. This is also important in case the description of the configuration option needs modifying for clarity or providing context for how it will be used. If the interface changes, all plugins calling the plugin methods will need updating, so the config options can be updated if necessary. --- volatility/framework/plugins/windows/cmdline.py | 6 ++++-- volatility/framework/plugins/windows/dlldump.py | 6 +++++- volatility/framework/plugins/windows/dlllist.py | 6 ++++-- volatility/framework/plugins/windows/handles.py | 6 ++++-- volatility/framework/plugins/windows/malfind.py | 6 ++++-- volatility/framework/plugins/windows/procdump.py | 6 ++++-- volatility/framework/plugins/windows/pslist.py | 11 ++++------- volatility/framework/plugins/windows/vaddump.py | 6 +++++- volatility/framework/plugins/windows/vadinfo.py | 6 +++++- volatility/framework/plugins/windows/vadyarascan.py | 6 ++++-- 10 files changed, 43 insertions(+), 22 deletions(-) diff --git a/volatility/framework/plugins/windows/cmdline.py b/volatility/framework/plugins/windows/cmdline.py index 99f31fb62..71480c86f 100644 --- a/volatility/framework/plugins/windows/cmdline.py +++ b/volatility/framework/plugins/windows/cmdline.py @@ -36,8 +36,10 @@ class CmdLine(interfaces_plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") - ] + pslist.PsList.list_processes_filter_requirements + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.IntRequirement( + name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True) + ] def _generator(self, procs): diff --git a/volatility/framework/plugins/windows/dlldump.py b/volatility/framework/plugins/windows/dlldump.py index d1ccadeb1..171b845fe 100644 --- a/volatility/framework/plugins/windows/dlldump.py +++ b/volatility/framework/plugins/windows/dlldump.py @@ -52,7 +52,11 @@ class DllDump(interfaces_plugins.PluginInterface): description = "Process virtual memory address to include " \ "(all other address ranges are excluded). This must be " \ "a base address, not an address within the desired range.", - optional = True)] + pslist.PsList.list_processes_filter_requirements + optional = True), + requirements.IntRequirement( + name = 'pid', description = "Process ID to include (all other processes are excluded)", + optional = True) + ] def _generator(self, procs): pe_table_name = intermed.IntermediateSymbolTable.create( diff --git a/volatility/framework/plugins/windows/dlllist.py b/volatility/framework/plugins/windows/dlllist.py index 7f872f357..ac7afe7fb 100644 --- a/volatility/framework/plugins/windows/dlllist.py +++ b/volatility/framework/plugins/windows/dlllist.py @@ -36,8 +36,10 @@ class DllList(interfaces_plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") - ] + pslist.PsList.list_processes_filter_requirements + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.IntRequirement( + name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True) + ] def _generator(self, procs): diff --git a/volatility/framework/plugins/windows/handles.py b/volatility/framework/plugins/windows/handles.py index 180d1fe50..c358e45bb 100644 --- a/volatility/framework/plugins/windows/handles.py +++ b/volatility/framework/plugins/windows/handles.py @@ -55,8 +55,10 @@ class Handles(interfaces_plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") - ] + pslist.PsList.list_processes_filter_requirements + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.IntRequirement( + name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True) + ] def _decode_pointer(self, value, magic): """Windows encodes pointers to objects and decodes them on the fly diff --git a/volatility/framework/plugins/windows/malfind.py b/volatility/framework/plugins/windows/malfind.py index 4e665d4a6..7faffacf1 100644 --- a/volatility/framework/plugins/windows/malfind.py +++ b/volatility/framework/plugins/windows/malfind.py @@ -37,8 +37,10 @@ class Malfind(interfaces.plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") - ] + pslist.PsList.list_processes_filter_requirements + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.IntRequirement( + name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True) + ] @classmethod def is_vad_empty(self, proc_layer, vad): diff --git a/volatility/framework/plugins/windows/procdump.py b/volatility/framework/plugins/windows/procdump.py index 202ceec01..0dc14f0b4 100644 --- a/volatility/framework/plugins/windows/procdump.py +++ b/volatility/framework/plugins/windows/procdump.py @@ -45,8 +45,10 @@ class ProcDump(interfaces_plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") - ] + pslist.PsList.list_processes_filter_requirements + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.IntRequirement( + name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True) + ] def _generator(self, procs): diff --git a/volatility/framework/plugins/windows/pslist.py b/volatility/framework/plugins/windows/pslist.py index 8ed738328..8a5531039 100644 --- a/volatility/framework/plugins/windows/pslist.py +++ b/volatility/framework/plugins/windows/pslist.py @@ -45,13 +45,10 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface): name = 'physical', description = 'Display physical offsets instead of virtual', default = cls.PHYSICAL_DEFAULT, - optional = True) - ] + cls.list_processes_filter_requirements - - list_processes_filter_requirements = [ - requirements.IntRequirement( - name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True) - ] + optional = True), + requirements.IntRequirement( + name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True) + ] @classmethod def create_pid_filter(cls, pid_list: List[int] = None) -> Callable[[interfaces.objects.ObjectInterface], bool]: diff --git a/volatility/framework/plugins/windows/vaddump.py b/volatility/framework/plugins/windows/vaddump.py index 814161294..f9b9f28b8 100644 --- a/volatility/framework/plugins/windows/vaddump.py +++ b/volatility/framework/plugins/windows/vaddump.py @@ -47,7 +47,11 @@ class VadDump(interfaces_plugins.PluginInterface): description = "Process virtual memory address to include " \ "(all other address ranges are excluded). This must be " \ "a base address, not an address within the desired range.", - optional = True)] + pslist.PsList.list_processes_filter_requirements + optional = True), + requirements.IntRequirement( + name = 'pid', description = "Process ID to include (all other processes are excluded)", + optional = True) + ] def _generator(self, procs): diff --git a/volatility/framework/plugins/windows/vadinfo.py b/volatility/framework/plugins/windows/vadinfo.py index e83543281..b3f541725 100644 --- a/volatility/framework/plugins/windows/vadinfo.py +++ b/volatility/framework/plugins/windows/vadinfo.py @@ -66,7 +66,11 @@ class VadInfo(interfaces.plugins.PluginInterface): description = "Process virtual memory address to include " \ "(all other address ranges are excluded). This must be " \ "a base address, not an address within the desired range.", - optional = True)] + pslist.PsList.list_processes_filter_requirements + optional = True), + requirements.IntRequirement( + name = 'pid', description = "Process ID to include (all other processes are excluded)", + optional = True) + ] @classmethod def protect_values(cls, context: interfaces.context.ContextInterface, virtual_layer: str, diff --git a/volatility/framework/plugins/windows/vadyarascan.py b/volatility/framework/plugins/windows/vadyarascan.py index 1c245f3de..811a322e7 100644 --- a/volatility/framework/plugins/windows/vadyarascan.py +++ b/volatility/framework/plugins/windows/vadyarascan.py @@ -53,8 +53,10 @@ class VadYaraScan(interfaces.plugins.PluginInterface): name = "max_size", default = 0x40000000, description = "Set the maximum size (default is 1GB)", - optional = True) - ] + pslist.PsList.list_processes_filter_requirements + optional = True), + requirements.IntRequirement( + name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True) + ] def _generator(self):