WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-31 04:09:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

adds new vol3 netscan profiles and fixes rare bug

Browse Source
This commit is contained in:
Jan
2020-12-08 10:34:07 +00:00
committed by ikelos
parent 754cfcd7ac
commit 774528206c
11 changed files with 3193 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/netscan.py
+19 -16
View File
@@ -153,10 +153,10 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
(10, 0, 14393): "netscan-win10-14393-x86",
(10, 0, 15063): "netscan-win10-15063-x86",
(10, 0, 16299): "netscan-win10-15063-x86",
(10, 0, 17134): "netscan-win10-15063-x86",
(10, 0, 17763): "netscan-win10-15063-x86",
(10, 0, 18362): "netscan-win10-15063-x86",
(10, 0, 18363): "netscan-win10-15063-x86"
(10, 0, 17134): "netscan-win10-17134-x86",
(10, 0, 17763): "netscan-win10-17134-x86",
(10, 0, 18362): "netscan-win10-17134-x86",
(10, 0, 18363): "netscan-win10-17134-x86"
}
else:
version_dict = {
@@ -173,11 +173,12 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
(10, 0, 10586): "netscan-win10-x64",
(10, 0, 14393): "netscan-win10-x64",
(10, 0, 15063): "netscan-win10-15063-x64",
(10, 0, 16299): "netscan-win10-15063-x64",
(10, 0, 17134): "netscan-win10-15063-x64",
(10, 0, 17763): "netscan-win10-15063-x64",
(10, 0, 18362): "netscan-win10-15063-x64",
(10, 0, 18363): "netscan-win10-15063-x64"
(10, 0, 16299): "netscan-win10-16299-x64",
(10, 0, 17134): "netscan-win10-17134-x64",
(10, 0, 17763): "netscan-win10-17763-x64",
(10, 0, 18362): "netscan-win10-17763-x64",
(10, 0, 18363): "netscan-win10-17763-x64",
(10, 0, 19041): "netscan-win10-19041-x64"
}
# when determining the symbol file we have to consider the following cases:
@@ -187,13 +188,15 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
# windows version cannot be determined -> throw exc
filename = version_dict.get((nt_major_version, nt_minor_version, vers_minor_version))
if not filename:
if nt_major_version == 10:
# NtMajorVersion of 10 without a match means a newer version than listed
# hence try the latest supported version. If this one throws an error,
# support has to be added manually.
win_10_versions = sorted([key for key in list(version_dict.keys()) if key[0] == 10])
# as win10 MinorVersion counts upwards we can take the last entry
latest_version = win_10_versions[-1]
# no match on filename means that we possibly have a version newer than those listed here.
# try to grab the latest supported version of the current image NT version. If that symbol
# version does not work, support has to be added manually.
current_versions = [key for key in list(version_dict.keys()) if key[0] == nt_major_version and key[1] == nt_minor_version]
current_versions.sort()
if current_versions:
latest_version = current_versions[-1]
filename = version_dict.get(latest_version)
vollog.debug("Unable to find exact matching symbol file, going with latest: {}".format(filename))
else:
volatility/framework/symbols/windows/extensions/network.py
+14
View File
@@ -109,6 +109,18 @@ class _TCP_LISTENER(objects.StructType):
def get_in_addr(self):
try:
local_addr = self.LocalAddr.dereference()
# there is a rare edge case here we have to consider:
# if the struct has a null pointer at the LocalAddr offset,
# this generally means this struct has no associated local address.
# however, sometimes a pointer to the offset of 0 can be valid because
# it points to a valid virtual memory address of 0. this confuses this
# plugin because trying to access the nullpointer does not raise any
# errors, leading to errors later down the line when accessing the
# pointed-to _IN_ADDR addr4/6 attributes.
# addr4/6 are at the same offset, accessing the first byte covers both.
# if this causes no error, we can expect a valid network addr.
_ = local_addr.pData.dereference().addr4[0]
if local_addr.pData.dereference():
inaddr = local_addr.inaddr
@@ -147,9 +159,11 @@ class _TCP_LISTENER(objects.StructType):
try:
if not self.get_address_family() in (AF_INET, AF_INET6):
vollog.debug("netw obj 0x{:x} invalid due to invalid address_family {}".format(self.vol.offset, self.get_address_family()))
return False
except exceptions.InvalidAddressException:
vollog.debug("netw obj 0x{:x} invalid due to invalid address access".format(self.vol.offset))
return False
return True
volatility/framework/symbols/windows/netscan-win10-16299-x64.json
+591
View File
@@ -0,0 +1,591 @@
{
"base_types": {
"unsigned long": {
"kind": "int",
"size": 4,
"signed": false,
"endian": "little"
},
"unsigned char": {
"kind": "char",
"size": 1,
"signed": false,
"endian": "little"
},
"pointer": {
"kind": "int",
"size": 8,
"signed": false,
"endian": "little"
},
"unsigned int": {
"kind": "int",
"size": 4,
"signed": false,
"endian": "little"
},
"unsigned short": {
"kind": "int",
"size": 2,
"signed": false,
"endian": "little"
},
"unsigned be short": {
"kind": "int",
"size": 2,
"signed": false,
"endian": "big"
},
"long long": {
"endian": "little",
"kind": "int",
"signed": true,
"size": 8
},
"long": {
"kind": "int",
"size": 4,
"signed": false,
"endian": "little"
}
},
"symbols": {
"TcpCompartmentSet": {
"address": 2059400
},
"UdpCompartmentSet": {
"address": 2055504
},
"PartitionCount": {
"address": 2057284
},
"PartitionTable": {
"address": 2057288
}
},
"user_types": {
"_UDP_ENDPOINT": {
"fields": {
"Owner": {
"offset": 40,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_EPROCESS"
}
}
},
"CreateTime": {
"offset": 88,
"type": {
"kind": "union",
"name": "_LARGE_INTEGER"
}
},
"LocalAddr": {
"offset": 128,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_LOCAL_ADDRESS_WIN10_UDP"
}
}
},
"InetAF": {
"offset": 32,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INETAF"
}
}
},
"MaskedPrevObj": {
"offset": 112,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_UDP_ENDPOINT"
}
}
},
"Port": {
"offset": 120,
"type": {
"kind": "base",
"name": "unsigned be short"
}
}
},
"kind": "struct",
"size": 132
},
"_TCP_LISTENER": {
"fields": {
"Owner": {
"offset": 48,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_EPROCESS"
}
}
},
"CreateTime": {
"offset": 64,
"type": {
"kind": "union",
"name": "_LARGE_INTEGER"
}
},
"LocalAddr": {
"offset": 96,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_LOCAL_ADDRESS"
}
}
},
"InetAF": {
"offset": 40,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INETAF"
}
}
},
"Port": {
"offset": 114,
"type": {
"kind": "base",
"name": "unsigned be short"
}
},
"MaskedPrevObj": {
"offset": 120,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_TCP_LISTENER"
}
}
}
},
"kind": "struct",
"size": 128
},
"_TCP_ENDPOINT": {
"fields": {
"Owner": {
"offset": 624,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_EPROCESS"
}
}
},
"CreateTime": {
"offset": 640,
"type": {
"kind": "union",
"name": "_LARGE_INTEGER"
}
},
"AddrInfo": {
"offset": 24,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_ADDRINFO"
}
}
},
"HashTableEntry": {
"offset": 40,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_LIST_ENTRY"
}
}
},
"InetAF": {
"offset": 16,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INETAF"
}
}
},
"LocalPort": {
"offset": 112,
"type": {
"kind": "base",
"name": "unsigned be short"
}
},
"RemotePort": {
"offset": 114,
"type": {
"kind": "base",
"name": "unsigned be short"
}
},
"State": {
"offset": 108,
"type": {
"kind": "enum",
"name": "TCPStateEnum"
}
},
"MaskedPrevObj": {
"offset": 112,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_TCP_ENDPOINT"
}
}
}
},
"kind": "struct",
"size": 632
},
"_LOCAL_ADDRESS": {
"fields": {
"pData": {
"offset": 16,
"type": {
"kind": "pointer",
"subtype": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_IN_ADDR"
}
}
}
}
},
"kind": "struct",
"size": 20
},
"_LOCAL_ADDRESS_WIN10_UDP": {
"fields": {
"pData": {
"offset": 0,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_IN_ADDR"
}
}
}
},
"kind": "struct",
"size": 4
},
"_ADDRINFO": {
"fields": {
"Local": {
"offset": 0,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_LOCAL_ADDRESS"
}
}
},
"Remote": {
"offset": 16,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_IN_ADDR"
}
}
}
},
"kind": "struct",
"size": 4
},
"_IN_ADDR": {
"fields": {
"addr4": {
"offset": 0,
"type": {
"count": 4,
"subtype": {
"kind": "base",
"name": "unsigned char"
},
"kind": "array"
}
},
"addr6": {
"offset": 0,
"type": {
"count": 16,
"subtype": {
"kind": "base",
"name": "unsigned char"
},
"kind": "array"
}
}
},
"kind": "struct",
"size": 6
},
"_INETAF": {
"fields": {
"AddressFamily": {
"offset": 24,
"type": {
"kind": "base",
"name": "unsigned short"
}
}
},
"kind": "struct",
"size": 26
},
"_LARGE_INTEGER": {
"fields": {
"HighPart": {
"offset": 4,
"type": {
"kind": "base",
"name": "long"
}
},
"LowPart": {
"offset": 0,
"type": {
"kind": "base",
"name": "unsigned long"
}
},
"QuadPart": {
"offset": 0,
"type": {
"kind": "base",
"name": "long long"
}
},
"u": {
"offset": 0,
"type": {
"kind": "struct",
"name": "__unnamed_2"
}
}
},
"kind": "union",
"size": 8
},
"_INET_COMPARTMENT_SET": {
"fields": {
"InetCompartment": {
"offset": 328,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INET_COMPARTMENT"
}
}
}
},
"kind": "struct",
"size": 384
},
"_INET_COMPARTMENT": {
"fields": {
"ProtocolCompartment": {
"offset": 32,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_PROTOCOL_COMPARTMENT"
}
}
}
},
"kind": "struct",
"size": 48
},
"_PROTOCOL_COMPARTMENT": {
"fields": {
"PortPool": {
"offset": 0,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INET_PORT_POOL"
}
}
}
},
"kind": "struct",
"size": 16
},
"_PORT_ASSIGNMENT_ENTRY": {
"fields": {
"MaskedObjectPtr": {
"offset": 8,
"type": {
"kind": "pointer",
"subtype": {
"kind": "base",
"name": "void"
}
}
}
},
"kind": "struct",
"size": 24
},
"_PORT_ASSIGNMENT_LIST": {
"fields": {
"Assignments": {
"offset": 0,
"type": {
"count": 256,
"kind": "array",
"subtype": {
"kind": "struct",
"name": "_PORT_ASSIGNMENT_ENTRY"
}
}
}
},
"kind": "struct",
"size": 6144
},
"_PORT_ASSIGNMENT": {
"fields": {
"InPaBigPoolBase": {
"offset": 24,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_PORT_ASSIGNMENT_LIST"
}
}
}
},
"kind": "struct",
"size": 32
},
"_INET_PORT_POOL": {
"fields": {
"PortAssignments": {
"offset": 232,
"type": {
"count": 256,
"kind": "array",
"subtype": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_PORT_ASSIGNMENT"
}
}
}
},
"PortBitMap": {
"offset": 216,
"type": {
"kind": "struct",
"name": "nt_symbols!_RTL_BITMAP"
}
}
},
"kind": "struct",
"size": 11200
},
"_PARTITION": {
"fields": {
"Endpoints" : {
"offset": 8,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_RTL_DYNAMIC_HASH_TABLE"
}
}
},
"UnknownHashTable" : {
"offset": 16,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_RTL_DYNAMIC_HASH_TABLE"
}
}
}
},
"kind": "struct",
"size": 128
}
},
"enums": {
"TCPStateEnum": {
"base": "long",
"constants": {
"CLOSED": 0,
"LISTENING": 1,
"SYN_SENT": 2,
"SYN_RCVD": 3,
"ESTABLISHED": 4,
"FIN_WAIT1": 5,
"FIN_WAIT2": 6,
"CLOSE_WAIT": 7,
"CLOSING": 8,
"LAST_ACK": 9,
"TIME_WAIT": 12,
"DELETE_TCB": 13
},
"size": 4
}
},
"metadata": {
"producer": {
"version": "0.0.1",
"name": "japhlange-by-hand",
"datetime": "2020-05-29T19:28:34"
},
"format": "6.0.0"
}
}
volatility/framework/symbols/windows/netscan-win10-17134-x64.json
+388
View File
@@ -0,0 +1,388 @@
{
"base_types": {
"unsigned long": {
"kind": "int",
"size": 4,
"signed": false,
"endian": "little"
},
"unsigned char": {
"kind": "char",
"size": 1,
"signed": false,
"endian": "little"
},
"pointer": {
"kind": "int",
"size": 8,
"signed": false,
"endian": "little"
},
"unsigned int": {
"kind": "int",
"size": 4,
"signed": false,
"endian": "little"
},
"unsigned short": {
"kind": "int",
"size": 2,
"signed": false,
"endian": "little"
},
"unsigned be short": {
"kind": "int",
"size": 2,
"signed": false,
"endian": "big"
},
"long long": {
"endian": "little",
"kind": "int",
"signed": true,
"size": 8
},
"long": {
"kind": "int",
"size": 4,
"signed": false,
"endian": "little"
}
},
"symbols": {},
"user_types": {
"_UDP_ENDPOINT": {
"fields": {
"Owner": {
"offset": 40,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_EPROCESS"
}
}
},
"CreateTime": {
"offset": 88,
"type": {
"kind": "union",
"name": "_LARGE_INTEGER"
}
},
"LocalAddr": {
"offset": 128,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_LOCAL_ADDRESS_WIN10_UDP"
}
}
},
"InetAF": {
"offset": 32,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INETAF"
}
}
},
"Port": {
"offset": 120,
"type": {
"kind": "base",
"name": "unsigned be short"
}
}
},
"kind": "struct",
"size": 132
},
"_TCP_LISTENER": {
"fields": {
"Owner": {
"offset": 48,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_EPROCESS"
}
}
},
"CreateTime": {
"offset": 64,
"type": {
"kind": "union",
"name": "_LARGE_INTEGER"
}
},
"LocalAddr": {
"offset": 96,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_LOCAL_ADDRESS"
}
}
},
"InetAF": {
"offset": 40,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INETAF"
}
}
},
"Port": {
"offset": 114,
"type": {
"kind": "base",
"name": "unsigned be short"
}
}
},
"kind": "struct",
"size": 116
},
"_TCP_ENDPOINT": {
"fields": {
"Owner": {
"offset": 632,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_EPROCESS"
}
}
},
"CreateTime": {
"offset": 648,
"type": {
"kind": "union",
"name": "_LARGE_INTEGER"
}
},
"AddrInfo": {
"offset": 24,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_ADDRINFO"
}
}
},
"InetAF": {
"offset": 16,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INETAF"
}
}
},
"LocalPort": {
"offset": 112,
"type": {
"kind": "base",
"name": "unsigned be short"
}
},
"RemotePort": {
"offset": 114,
"type": {
"kind": "base",
"name": "unsigned be short"
}
},
"State": {
"offset": 108,
"type": {
"kind": "enum",
"name": "TCPStateEnum"
}
}
},
"kind": "struct",
"size": 632
},
"_LOCAL_ADDRESS": {
"fields": {
"pData": {
"offset": 16,
"type": {
"kind": "pointer",
"subtype": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_IN_ADDR"
}
}
}
}
},
"kind": "struct",
"size": 20
},
"_LOCAL_ADDRESS_WIN10_UDP": {
"fields": {
"pData": {
"offset": 0,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_IN_ADDR"
}
}
}
},
"kind": "struct",
"size": 4
},
"_ADDRINFO": {
"fields": {
"Local": {
"offset": 0,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_LOCAL_ADDRESS"
}
}
},
"Remote": {
"offset": 16,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_IN_ADDR"
}
}
}
},
"kind": "struct",
"size": 4
},
"_IN_ADDR": {
"fields": {
"addr4": {
"offset": 0,
"type": {
"count": 4,
"subtype": {
"kind": "base",
"name": "unsigned char"
},
"kind": "array"
}
},
"addr6": {
"offset": 0,
"type": {
"count": 16,
"subtype": {
"kind": "base",
"name": "unsigned char"
},
"kind": "array"
}
}
},
"kind": "struct",
"size": 6
},
"_INETAF": {
"fields": {
"AddressFamily": {
"offset": 24,
"type": {
"kind": "base",
"name": "unsigned short"
}
}
},
"kind": "struct",
"size": 26
},
"_LARGE_INTEGER": {
"fields": {
"HighPart": {
"offset": 4,
"type": {
"kind": "base",
"name": "long"
}
},
"LowPart": {
"offset": 0,
"type": {
"kind": "base",
"name": "unsigned long"
}
},
"QuadPart": {
"offset": 0,
"type": {
"kind": "base",
"name": "long long"
}
},
"u": {
"offset": 0,
"type": {
"kind": "struct",
"name": "__unnamed_2"
}
}
},
"kind": "union",
"size": 8
}
},
"enums": {
"TCPStateEnum": {
"base": "long",
"constants": {
"CLOSED": 0,
"LISTENING": 1,
"SYN_SENT": 2,
"SYN_RCVD": 3,
"ESTABLISHED": 4,
"FIN_WAIT1": 5,
"FIN_WAIT2": 6,
"CLOSE_WAIT": 7,
"CLOSING": 8,
"LAST_ACK": 9,
"TIME_WAIT": 12,
"DELETE_TCB": 13
},
"size": 4
}
},
"metadata": {
"producer": {
"version": "0.0.1",
"name": "japhlange-by-hand",
"datetime": "2020-05-29T19:28:34"
},
"format": "6.0.0"
}
}
volatility/framework/symbols/windows/netscan-win10-17134-x86.json
+535
View File
@@ -0,0 +1,535 @@
{
"base_types": {
"unsigned long": {
"kind": "int",
"size": 4,
"signed": false,
"endian": "little"
},
"unsigned char": {
"kind": "char",
"size": 1,
"signed": false,
"endian": "little"
},
"pointer": {
"kind": "int",
"size": 4,
"signed": false,
"endian": "little"
},
"unsigned int": {
"kind": "int",
"size": 4,
"signed": false,
"endian": "little"
},
"unsigned short": {
"kind": "int",
"size": 2,
"signed": false,
"endian": "little"
},
"unsigned be short": {
"kind": "int",
"size": 2,
"signed": false,
"endian": "big"
},
"long long": {
"endian": "little",
"kind": "int",
"signed": true,
"size": 8
},
"long": {
"kind": "int",
"size": 4,
"signed": false,
"endian": "little"
}
},
"symbols": {},
"user_types": {
"_TCP_SYN_ENDPOINT": {
"fields": {
"Owner": {
"offset": 32,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_SYN_OWNER"
}
}
},
"CreateTime": {
"offset": 0,
"type": {
"kind": "union",
"name": "_LARGE_INTEGER"
}
},
"ListEntry": {
"offset": 8,
"type": {
"kind": "union",
"name": "nt_symbols!_LIST_ENTRY"
}
},
"InetAF": {
"offset": 24,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INETAF"
}
}
},
"LocalPort": {
"offset": 60,
"type": {
"kind": "base",
"name": "unsigned be short"
}
},
"RemotePort": {
"offset": 62,
"type": {
"kind": "base",
"name": "unsigned be short"
}
},
"LocalAddr": {
"offset": 28,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_LOCAL_ADDRESS"
}
}
},
"RemoteAddress": {
"offset": 40,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_IN_ADDR"
}
}
}
},
"kind": "struct",
"size": 64
},
"_TCP_TIMEWAIT_ENDPOINT": {
"fields": {
"CreateTime": {
"offset": 0,
"type": {
"kind": "union",
"name": "_LARGE_INTEGER"
}
},
"ListEntry": {
"offset": 20,
"type": {
"kind": "union",
"name": "nt_symbols!_LIST_ENTRY"
}
},
"InetAF": {
"offset": 12,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INETAF"
}
}
},
"LocalPort": {
"offset": 28,
"type": {
"kind": "base",
"name": "unsigned be short"
}
},
"RemotePort": {
"offset": 30,
"type": {
"kind": "base",
"name": "unsigned be short"
}
},
"LocalAddr": {
"offset": 32,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_LOCAL_ADDRESS"
}
}
},
"RemoteAddress": {
"offset": 36,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_IN_ADDR"
}
}
}
},
"kind": "struct",
"size": 40
},
"_UDP_ENDPOINT": {
"fields": {
"Owner": {
"offset": 24,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_EPROCESS"
}
}
},
"CreateTime": {
"offset": 48,
"type": {
"kind": "union",
"name": "_LARGE_INTEGER"
}
},
"LocalAddr": {
"offset": 56,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_LOCAL_ADDRESS"
}
}
},
"InetAF": {
"offset": 20,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INETAF"
}
}
},
"Port": {
"offset": 68,
"type": {
"kind": "base",
"name": "unsigned be short"
}
}
},
"kind": "struct",
"size": 74
},
"_TCP_LISTENER": {
"fields": {
"Owner": {
"offset": 24,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_EPROCESS"
}
}
},
"CreateTime": {
"offset": 32,
"type": {
"kind": "union",
"name": "_LARGE_INTEGER"
}
},
"LocalAddr": {
"offset": 52,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_LOCAL_ADDRESS"
}
}
},
"InetAF": {
"offset": 56,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INETAF"
}
}
},
"Port": {
"offset": 62,
"type": {
"kind": "base",
"name": "unsigned be short"
}
}
},
"kind": "struct",
"size": 64
},
"_TCP_ENDPOINT": {
"fields": {
"Owner": {
"offset": 460,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_EPROCESS"
}
}
},
"CreateTime": {
"offset": 0,
"type": {
"kind": "union",
"name": "_LARGE_INTEGER"
}
},
"ListEntry": {
"offset": 20,
"type": {
"kind": "union",
"name": "nt_symbols!_LIST_ENTRY"
}
},
"AddrInfo": {
"offset": 12,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_ADDRINFO"
}
}
},
"InetAF": {
"offset": 8,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INETAF"
}
}
},
"LocalPort": {
"offset": 60,
"type": {
"kind": "base",
"name": "unsigned be short"
}
},
"RemotePort": {
"offset": 62,
"type": {
"kind": "base",
"name": "unsigned be short"
}
},
"State": {
"offset": 56,
"type": {
"kind": "enum",
"name": "TCPStateEnum"
}
}
},
"kind": "struct",
"size": 464
},
"_LOCAL_ADDRESS": {
"fields": {
"pData": {
"offset": 12,
"type": {
"kind": "pointer",
"subtype": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_IN_ADDR"
}
}
}
}
},
"kind": "struct",
"size": 16
},
"_ADDRINFO": {
"fields": {
"Local": {
"offset": 0,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_LOCAL_ADDRESS"
}
}
},
"Remote": {
"offset": 12,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_IN_ADDR"
}
}
}
},
"kind": "struct",
"size": 16
},
"_IN_ADDR": {
"fields": {
"addr4": {
"offset": 0,
"type": {
"count": 4,
"subtype": {
"kind": "base",
"name": "unsigned char"
},
"kind": "array"
}
},
"addr6": {
"offset": 0,
"type": {
"count": 16,
"subtype": {
"kind": "base",
"name": "unsigned char"
},
"kind": "array"
}
}
},
"kind": "struct",
"size": 6
},
"_INETAF": {
"fields": {
"AddressFamily": {
"offset": 12,
"type": {
"kind": "base",
"name": "unsigned short"
}
}
},
"kind": "struct",
"size": 14
},
"_SYN_OWNER": {
"fields": {
"Process": {
"offset": 24,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_EPROCESS"
}
}
}
},
"kind": "struct",
"size": 14
},
"_LARGE_INTEGER": {
"fields": {
"HighPart": {
"offset": 4,
"type": {
"kind": "base",
"name": "long"
}
},
"LowPart": {
"offset": 0,
"type": {
"kind": "base",
"name": "unsigned long"
}
},
"QuadPart": {
"offset": 0,
"type": {
"kind": "base",
"name": "long long"
}
},
"u": {
"offset": 0,
"type": {
"kind": "struct",
"name": "__unnamed_2"
}
}
},
"kind": "union",
"size": 8
}
},
"enums": {
"TCPStateEnum": {
"base": "long",
"constants": {
"CLOSED": 0,
"LISTENING": 1,
"SYN_SENT": 2,
"SYN_RCVD": 3,
"ESTABLISHED": 4,
"FIN_WAIT1": 5,
"FIN_WAIT2": 6,
"CLOSE_WAIT": 7,
"CLOSING": 8,
"LAST_ACK": 9,
"TIME_WAIT": 12,
"DELETE_TCB": 13
},
"size": 4
}
},
"metadata": {
"producer": {
"version": "0.0.1",
"name": "japhlange-by-hand",
"datetime": "2020-05-29T19:28:34"
},
"format": "6.0.0"
}
}
volatility/framework/symbols/windows/netscan-win10-17763-x64.json
+388
View File
@@ -0,0 +1,388 @@
{
"base_types": {
"unsigned long": {
"kind": "int",
"size": 4,
"signed": false,
"endian": "little"
},
"unsigned char": {
"kind": "char",
"size": 1,
"signed": false,
"endian": "little"
},
"pointer": {
"kind": "int",
"size": 8,
"signed": false,
"endian": "little"
},
"unsigned int": {
"kind": "int",
"size": 4,
"signed": false,
"endian": "little"
},
"unsigned short": {
"kind": "int",
"size": 2,
"signed": false,
"endian": "little"
},
"unsigned be short": {
"kind": "int",
"size": 2,
"signed": false,
"endian": "big"
},
"long long": {
"endian": "little",
"kind": "int",
"signed": true,
"size": 8
},
"long": {
"kind": "int",
"size": 4,
"signed": false,
"endian": "little"
}
},
"symbols": {},
"user_types": {
"_UDP_ENDPOINT": {
"fields": {
"Owner": {
"offset": 40,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_EPROCESS"
}
}
},
"CreateTime": {
"offset": 88,
"type": {
"kind": "union",
"name": "_LARGE_INTEGER"
}
},
"LocalAddr": {
"offset": 128,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_LOCAL_ADDRESS_WIN10_UDP"
}
}
},
"InetAF": {
"offset": 32,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INETAF"
}
}
},
"Port": {
"offset": 120,
"type": {
"kind": "base",
"name": "unsigned be short"
}
}
},
"kind": "struct",
"size": 132
},
"_TCP_LISTENER": {
"fields": {
"Owner": {
"offset": 48,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_EPROCESS"
}
}
},
"CreateTime": {
"offset": 64,
"type": {
"kind": "union",
"name": "_LARGE_INTEGER"
}
},
"LocalAddr": {
"offset": 96,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_LOCAL_ADDRESS"
}
}
},
"InetAF": {
"offset": 40,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INETAF"
}
}
},
"Port": {
"offset": 114,
"type": {
"kind": "base",
"name": "unsigned be short"
}
}
},
"kind": "struct",
"size": 116
},
"_TCP_ENDPOINT": {
"fields": {
"Owner": {
"offset": 656,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_EPROCESS"
}
}
},
"CreateTime": {
"offset": 672,
"type": {
"kind": "union",
"name": "_LARGE_INTEGER"
}
},
"AddrInfo": {
"offset": 24,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_ADDRINFO"
}
}
},
"InetAF": {
"offset": 16,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INETAF"
}
}
},
"LocalPort": {
"offset": 112,
"type": {
"kind": "base",
"name": "unsigned be short"
}
},
"RemotePort": {
"offset": 114,
"type": {
"kind": "base",
"name": "unsigned be short"
}
},
"State": {
"offset": 108,
"type": {
"kind": "enum",
"name": "TCPStateEnum"
}
}
},
"kind": "struct",
"size": 632
},
"_LOCAL_ADDRESS": {
"fields": {
"pData": {
"offset": 16,
"type": {
"kind": "pointer",
"subtype": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_IN_ADDR"
}
}
}
}
},
"kind": "struct",
"size": 20
},
"_LOCAL_ADDRESS_WIN10_UDP": {
"fields": {
"pData": {
"offset": 0,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_IN_ADDR"
}
}
}
},
"kind": "struct",
"size": 4
},
"_ADDRINFO": {
"fields": {
"Local": {
"offset": 0,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_LOCAL_ADDRESS"
}
}
},
"Remote": {
"offset": 16,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_IN_ADDR"
}
}
}
},
"kind": "struct",
"size": 4
},
"_IN_ADDR": {
"fields": {
"addr4": {
"offset": 0,
"type": {
"count": 4,
"subtype": {
"kind": "base",
"name": "unsigned char"
},
"kind": "array"
}
},
"addr6": {
"offset": 0,
"type": {
"count": 16,
"subtype": {
"kind": "base",
"name": "unsigned char"
},
"kind": "array"
}
}
},
"kind": "struct",
"size": 6
},
"_INETAF": {
"fields": {
"AddressFamily": {
"offset": 24,
"type": {
"kind": "base",
"name": "unsigned short"
}
}
},
"kind": "struct",
"size": 26
},
"_LARGE_INTEGER": {
"fields": {
"HighPart": {
"offset": 4,
"type": {
"kind": "base",
"name": "long"
}
},
"LowPart": {
"offset": 0,
"type": {
"kind": "base",
"name": "unsigned long"
}
},
"QuadPart": {
"offset": 0,
"type": {
"kind": "base",
"name": "long long"
}
},
"u": {
"offset": 0,
"type": {
"kind": "struct",
"name": "__unnamed_2"
}
}
},
"kind": "union",
"size": 8
}
},
"enums": {
"TCPStateEnum": {
"base": "long",
"constants": {
"CLOSED": 0,
"LISTENING": 1,
"SYN_SENT": 2,
"SYN_RCVD": 3,
"ESTABLISHED": 4,
"FIN_WAIT1": 5,
"FIN_WAIT2": 6,
"CLOSE_WAIT": 7,
"CLOSING": 8,
"LAST_ACK": 9,
"TIME_WAIT": 12,
"DELETE_TCB": 13
},
"size": 4
}
},
"metadata": {
"producer": {
"version": "0.0.1",
"name": "japhlange-by-hand",
"datetime": "2020-05-29T19:28:34"
},
"format": "6.0.0"
}
}
volatility/framework/symbols/windows/netscan-win10-18363-x64.json
+388
View File
@@ -0,0 +1,388 @@
{
"base_types": {
"unsigned long": {
"kind": "int",
"size": 4,
"signed": false,
"endian": "little"
},
"unsigned char": {
"kind": "char",
"size": 1,
"signed": false,
"endian": "little"
},
"pointer": {
"kind": "int",
"size": 8,
"signed": false,
"endian": "little"
},
"unsigned int": {
"kind": "int",
"size": 4,
"signed": false,
"endian": "little"
},
"unsigned short": {
"kind": "int",
"size": 2,
"signed": false,
"endian": "little"
},
"unsigned be short": {
"kind": "int",
"size": 2,
"signed": false,
"endian": "big"
},
"long long": {
"endian": "little",
"kind": "int",
"signed": true,
"size": 8
},
"long": {
"kind": "int",
"size": 4,
"signed": false,
"endian": "little"
}
},
"symbols": {},
"user_types": {
"_UDP_ENDPOINT": {
"fields": {
"Owner": {
"offset": 40,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_EPROCESS"
}
}
},
"CreateTime": {
"offset": 88,
"type": {
"kind": "union",
"name": "_LARGE_INTEGER"
}
},
"LocalAddr": {
"offset": 128,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_LOCAL_ADDRESS_WIN10_UDP"
}
}
},
"InetAF": {
"offset": 32,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INETAF"
}
}
},
"Port": {
"offset": 120,
"type": {
"kind": "base",
"name": "unsigned be short"
}
}
},
"kind": "struct",
"size": 132
},
"_TCP_LISTENER": {
"fields": {
"Owner": {
"offset": 48,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_EPROCESS"
}
}
},
"CreateTime": {
"offset": 64,
"type": {
"kind": "union",
"name": "_LARGE_INTEGER"
}
},
"LocalAddr": {
"offset": 96,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_LOCAL_ADDRESS"
}
}
},
"InetAF": {
"offset": 40,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INETAF"
}
}
},
"Port": {
"offset": 114,
"type": {
"kind": "base",
"name": "unsigned be short"
}
}
},
"kind": "struct",
"size": 116
},
"_TCP_ENDPOINT": {
"fields": {
"Owner": {
"offset": 656,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_EPROCESS"
}
}
},
"CreateTime": {
"offset": 672,
"type": {
"kind": "union",
"name": "_LARGE_INTEGER"
}
},
"AddrInfo": {
"offset": 24,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_ADDRINFO"
}
}
},
"InetAF": {
"offset": 16,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INETAF"
}
}
},
"LocalPort": {
"offset": 112,
"type": {
"kind": "base",
"name": "unsigned be short"
}
},
"RemotePort": {
"offset": 114,
"type": {
"kind": "base",
"name": "unsigned be short"
}
},
"State": {
"offset": 108,
"type": {
"kind": "enum",
"name": "TCPStateEnum"
}
}
},
"kind": "struct",
"size": 632
},
"_LOCAL_ADDRESS": {
"fields": {
"pData": {
"offset": 16,
"type": {
"kind": "pointer",
"subtype": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_IN_ADDR"
}
}
}
}
},
"kind": "struct",
"size": 20
},
"_LOCAL_ADDRESS_WIN10_UDP": {
"fields": {
"pData": {
"offset": 0,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_IN_ADDR"
}
}
}
},
"kind": "struct",
"size": 4
},
"_ADDRINFO": {
"fields": {
"Local": {
"offset": 0,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_LOCAL_ADDRESS"
}
}
},
"Remote": {
"offset": 16,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_IN_ADDR"
}
}
}
},
"kind": "struct",
"size": 4
},
"_IN_ADDR": {
"fields": {
"addr4": {
"offset": 0,
"type": {
"count": 4,
"subtype": {
"kind": "base",
"name": "unsigned char"
},
"kind": "array"
}
},
"addr6": {
"offset": 0,
"type": {
"count": 16,
"subtype": {
"kind": "base",
"name": "unsigned char"
},
"kind": "array"
}
}
},
"kind": "struct",
"size": 6
},
"_INETAF": {
"fields": {
"AddressFamily": {
"offset": 24,
"type": {
"kind": "base",
"name": "unsigned short"
}
}
},
"kind": "struct",
"size": 26
},
"_LARGE_INTEGER": {
"fields": {
"HighPart": {
"offset": 4,
"type": {
"kind": "base",
"name": "long"
}
},
"LowPart": {
"offset": 0,
"type": {
"kind": "base",
"name": "unsigned long"
}
},
"QuadPart": {
"offset": 0,
"type": {
"kind": "base",
"name": "long long"
}
},
"u": {
"offset": 0,
"type": {
"kind": "struct",
"name": "__unnamed_2"
}
}
},
"kind": "union",
"size": 8
}
},
"enums": {
"TCPStateEnum": {
"base": "long",
"constants": {
"CLOSED": 0,
"LISTENING": 1,
"SYN_SENT": 2,
"SYN_RCVD": 3,
"ESTABLISHED": 4,
"FIN_WAIT1": 5,
"FIN_WAIT2": 6,
"CLOSE_WAIT": 7,
"CLOSING": 8,
"LAST_ACK": 9,
"TIME_WAIT": 12,
"DELETE_TCB": 13
},
"size": 4
}
},
"metadata": {
"producer": {
"version": "0.0.1",
"name": "japhlange-by-hand",
"datetime": "2020-05-29T19:28:34"
},
"format": "6.0.0"
}
}
volatility/framework/symbols/windows/netscan-win10-19041-x64.json
+408
View File
@@ -0,0 +1,408 @@
{
"base_types": {
"unsigned long": {
"kind": "int",
"size": 4,
"signed": false,
"endian": "little"
},
"unsigned char": {
"kind": "char",
"size": 1,
"signed": false,
"endian": "little"
},
"pointer": {
"kind": "int",
"size": 8,
"signed": false,
"endian": "little"
},
"unsigned int": {
"kind": "int",
"size": 4,
"signed": false,
"endian": "little"
},
"unsigned short": {
"kind": "int",
"size": 2,
"signed": false,
"endian": "little"
},
"unsigned be short": {
"kind": "int",
"size": 2,
"signed": false,
"endian": "big"
},
"long long": {
"endian": "little",
"kind": "int",
"signed": true,
"size": 8
},
"long": {
"kind": "int",
"size": 4,
"signed": false,
"endian": "little"
}
},
"symbols": {},
"user_types": {
"_UDP_ENDPOINT": {
"fields": {
"Owner": {
"offset": 40,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_EPROCESS"
}
}
},
"CreateTime": {
"offset": 88,
"type": {
"kind": "union",
"name": "_LARGE_INTEGER"
}
},
"LocalAddr": {
"offset": 168,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_LOCAL_ADDRESS_WIN10_UDP"
}
}
},
"InetAF": {
"offset": 32,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INETAF"
}
}
},
"MaskedPrevObj": {
"offset": 112,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_UDP_ENDPOINT"
}
}
},
"Port": {
"offset": 160,
"type": {
"kind": "base",
"name": "unsigned be short"
}
}
},
"kind": "struct",
"size": 132
},
"_TCP_LISTENER": {
"fields": {
"Owner": {
"offset": 48,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_EPROCESS"
}
}
},
"CreateTime": {
"offset": 64,
"type": {
"kind": "union",
"name": "_LARGE_INTEGER"
}
},
"LocalAddr": {
"offset": 96,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_LOCAL_ADDRESS"
}
}
},
"InetAF": {
"offset": 40,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INETAF"
}
}
},
"MaskedPrevObj": {
"offset": 120,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_TCP_LISTENER"
}
}
},
"Port": {
"offset": 114,
"type": {
"kind": "base",
"name": "unsigned be short"
}
}
},
"kind": "struct",
"size": 128
},
"_TCP_ENDPOINT": {
"fields": {
"Owner": {
"offset": 728,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_EPROCESS"
}
}
},
"CreateTime": {
"offset": 744,
"type": {
"kind": "union",
"name": "_LARGE_INTEGER"
}
},
"AddrInfo": {
"offset": 24,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_ADDRINFO"
}
}
},
"InetAF": {
"offset": 16,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INETAF"
}
}
},
"LocalPort": {
"offset": 112,
"type": {
"kind": "base",
"name": "unsigned be short"
}
},
"RemotePort": {
"offset": 114,
"type": {
"kind": "base",
"name": "unsigned be short"
}
},
"State": {
"offset": 108,
"type": {
"kind": "enum",
"name": "TCPStateEnum"
}
}
},
"kind": "struct",
"size": 632
},
"_LOCAL_ADDRESS": {
"fields": {
"pData": {
"offset": 16,
"type": {
"kind": "pointer",
"subtype": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_IN_ADDR"
}
}
}
}
},
"kind": "struct",
"size": 20
},
"_LOCAL_ADDRESS_WIN10_UDP": {
"fields": {
"pData": {
"offset": 0,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_IN_ADDR"
}
}
}
},
"kind": "struct",
"size": 4
},
"_ADDRINFO": {
"fields": {
"Local": {
"offset": 0,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_LOCAL_ADDRESS"
}
}
},
"Remote": {
"offset": 16,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_IN_ADDR"
}
}
}
},
"kind": "struct",
"size": 4
},
"_IN_ADDR": {
"fields": {
"addr4": {
"offset": 0,
"type": {
"count": 4,
"subtype": {
"kind": "base",
"name": "unsigned char"
},
"kind": "array"
}
},
"addr6": {
"offset": 0,
"type": {
"count": 16,
"subtype": {
"kind": "base",
"name": "unsigned char"
},
"kind": "array"
}
}
},
"kind": "struct",
"size": 6
},
"_INETAF": {
"fields": {
"AddressFamily": {
"offset": 24,
"type": {
"kind": "base",
"name": "unsigned short"
}
}
},
"kind": "struct",
"size": 26
},
"_LARGE_INTEGER": {
"fields": {
"HighPart": {
"offset": 4,
"type": {
"kind": "base",
"name": "long"
}
},
"LowPart": {
"offset": 0,
"type": {
"kind": "base",
"name": "unsigned long"
}
},
"QuadPart": {
"offset": 0,
"type": {
"kind": "base",
"name": "long long"
}
},
"u": {
"offset": 0,
"type": {
"kind": "struct",
"name": "__unnamed_2"
}
}
},
"kind": "union",
"size": 8
}
},
"enums": {
"TCPStateEnum": {
"base": "long",
"constants": {
"CLOSED": 0,
"LISTENING": 1,
"SYN_SENT": 2,
"SYN_RCVD": 3,
"ESTABLISHED": 4,
"FIN_WAIT1": 5,
"FIN_WAIT2": 6,
"CLOSE_WAIT": 7,
"CLOSING": 8,
"LAST_ACK": 9,
"TIME_WAIT": 12,
"DELETE_TCB": 13
},
"size": 4
}
},
"metadata": {
"producer": {
"version": "0.0.1",
"name": "japhlange-by-hand",
"datetime": "2020-05-29T19:28:34"
},
"format": "6.0.0"
}
}
volatility/framework/symbols/windows/netscan-win10-19041-x86.json
+388
View File
@@ -0,0 +1,388 @@
{
"base_types": {
"unsigned long": {
"kind": "int",
"size": 4,
"signed": false,
"endian": "little"
},
"unsigned char": {
"kind": "char",
"size": 1,
"signed": false,
"endian": "little"
},
"pointer": {
"kind": "int",
"size": 4,
"signed": false,
"endian": "little"
},
"unsigned int": {
"kind": "int",
"size": 4,
"signed": false,
"endian": "little"
},
"unsigned short": {
"kind": "int",
"size": 2,
"signed": false,
"endian": "little"
},
"unsigned be short": {
"kind": "int",
"size": 2,
"signed": false,
"endian": "big"
},
"long long": {
"endian": "little",
"kind": "int",
"signed": true,
"size": 8
},
"long": {
"kind": "int",
"size": 4,
"signed": false,
"endian": "little"
}
},
"symbols": {},
"user_types": {
"_UDP_ENDPOINT": {
"fields": {
"Owner": {
"offset": 40,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_EPROCESS"
}
}
},
"CreateTime": {
"offset": 88,
"type": {
"kind": "union",
"name": "_LARGE_INTEGER"
}
},
"LocalAddr": {
"offset": 160,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_LOCAL_ADDRESS_WIN10_UDP"
}
}
},
"InetAF": {
"offset": 32,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INETAF"
}
}
},
"Port": {
"offset": 152,
"type": {
"kind": "base",
"name": "unsigned be short"
}
}
},
"kind": "struct",
"size": 132
},
"_TCP_LISTENER": {
"fields": {
"Owner": {
"offset": 48,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_EPROCESS"
}
}
},
"CreateTime": {
"offset": 64,
"type": {
"kind": "union",
"name": "_LARGE_INTEGER"
}
},
"LocalAddr": {
"offset": 96,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_LOCAL_ADDRESS"
}
}
},
"InetAF": {
"offset": 40,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INETAF"
}
}
},
"Port": {
"offset": 114,
"type": {
"kind": "base",
"name": "unsigned be short"
}
}
},
"kind": "struct",
"size": 116
},
"_TCP_ENDPOINT": {
"fields": {
"Owner": {
"offset": 624,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "nt_symbols!_EPROCESS"
}
}
},
"CreateTime": {
"offset": 616,
"type": {
"kind": "union",
"name": "_LARGE_INTEGER"
}
},
"AddrInfo": {
"offset": 24,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_ADDRINFO"
}
}
},
"InetAF": {
"offset": 16,
"type":{
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_INETAF"
}
}
},
"LocalPort": {
"offset": 112,
"type": {
"kind": "base",
"name": "unsigned be short"
}
},
"RemotePort": {
"offset": 114,
"type": {
"kind": "base",
"name": "unsigned be short"
}
},
"State": {
"offset": 108,
"type": {
"kind": "enum",
"name": "TCPStateEnum"
}
}
},
"kind": "struct",
"size": 632
},
"_LOCAL_ADDRESS": {
"fields": {
"pData": {
"offset": 16,
"type": {
"kind": "pointer",
"subtype": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_IN_ADDR"
}
}
}
}
},
"kind": "struct",
"size": 20
},
"_LOCAL_ADDRESS_WIN10_UDP": {
"fields": {
"pData": {
"offset": 0,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_IN_ADDR"
}
}
}
},
"kind": "struct",
"size": 4
},
"_ADDRINFO": {
"fields": {
"Local": {
"offset": 0,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_LOCAL_ADDRESS"
}
}
},
"Remote": {
"offset": 16,
"type": {
"kind": "pointer",
"subtype": {
"kind": "struct",
"name": "_IN_ADDR"
}
}
}
},
"kind": "struct",
"size": 4
},
"_IN_ADDR": {
"fields": {
"addr4": {
"offset": 0,
"type": {
"count": 4,
"subtype": {
"kind": "base",
"name": "unsigned char"
},
"kind": "array"
}
},
"addr6": {
"offset": 0,
"type": {
"count": 16,
"subtype": {
"kind": "base",
"name": "unsigned char"
},
"kind": "array"
}
}
},
"kind": "struct",
"size": 6
},
"_INETAF": {
"fields": {
"AddressFamily": {
"offset": 24,
"type": {
"kind": "base",
"name": "unsigned short"
}
}
},
"kind": "struct",
"size": 26
},
"_LARGE_INTEGER": {
"fields": {
"HighPart": {
"offset": 4,
"type": {
"kind": "base",
"name": "long"
}
},
"LowPart": {
"offset": 0,
"type": {
"kind": "base",
"name": "unsigned long"
}
},
"QuadPart": {
"offset": 0,
"type": {
"kind": "base",
"name": "long long"
}
},
"u": {
"offset": 0,
"type": {
"kind": "struct",
"name": "__unnamed_2"
}
}
},
"kind": "union",
"size": 8
}
},
"enums": {
"TCPStateEnum": {
"base": "long",
"constants": {
"CLOSED": 0,
"LISTENING": 1,
"SYN_SENT": 2,
"SYN_RCVD": 3,
"ESTABLISHED": 4,
"FIN_WAIT1": 5,
"FIN_WAIT2": 6,
"CLOSE_WAIT": 7,
"CLOSING": 8,
"LAST_ACK": 9,
"TIME_WAIT": 12,
"DELETE_TCB": 13
},
"size": 4
}
},
"metadata": {
"producer": {
"version": "0.0.1",
"name": "japhlange-by-hand",
"datetime": "2020-08-20T17:00:00"
},
"format": "6.0.0"
}
}
volatility/framework/symbols/windows/netscan-win10-x86.json
+8 -8
View File
@@ -246,7 +246,7 @@
"_TCP_LISTENER": {
"fields": {
"Owner": {
"offset": 24,
"offset": 28,
"type": {
"kind": "pointer",
"subtype": {
@@ -257,14 +257,14 @@
}
},
"CreateTime": {
"offset": 32,
"offset": 40,
"type": {
"kind": "union",
"name": "_LARGE_INTEGER"
}
},
"LocalAddr": {
"offset": 52,
"offset": 60,
"type":{
"kind": "pointer",
"subtype": {
@@ -275,7 +275,7 @@
}
},
"InetAF": {
"offset": 56,
"offset": 64,
"type":{
"kind": "pointer",
"subtype": {
@@ -286,7 +286,7 @@
}
},
"Port": {
"offset": 62,
"offset": 70,
"type": {
"kind": "base",
"name": "unsigned be short"
@@ -294,7 +294,7 @@
}
},
"kind": "struct",
"size": 64
"size": 72
},
"_TCP_ENDPOINT": {
"fields": {
@@ -309,7 +309,7 @@
}
},
"CreateTime": {
"offset": 0,
"offset": 440,
"type": {
"kind": "union",
"name": "_LARGE_INTEGER"
@@ -365,7 +365,7 @@
}
},
"kind": "struct",
"size": 436
"size": 448
},
"_LOCAL_ADDRESS": {
"fields": {
volatility/framework/symbols/windows/netscan-win7-x64.json
+66
View File
@@ -469,6 +469,72 @@
"kind": "struct",
"size": 48
},
"_PARTITION_TABLE": {
"fields": {
"HashTable": {
"offset": 0,
"type": {
"kind": "pointer",
"subtype": {
"kind": "base",
"name": "void"
}
}
},
"Unknown2": {
"offset": 8,
"type": {
"kind": "pointer",
"subtype": {
"kind": "base",
"name": "void"
}
}
},
"Unknown3": {
"offset": 16,
"type": {
"kind": "pointer",
"subtype": {
"kind": "base",
"name": "void"
}
}
},
"Unknown4": {
"offset": 24,
"type": {
"kind": "pointer",
"subtype": {
"kind": "base",
"name": "void"
}
}
},
"Unknown5": {
"offset": 32,
"type": {
"kind": "pointer",
"subtype": {
"kind": "base",
"name": "void"
}
}
},
"Unknown6": {
"offset": 40,
"type": {
"kind": "pointer",
"subtype": {
"kind": "base",
"name": "void"
}
}
}
},
"kind": "struct",
"size": 128
},
"_LARGE_INTEGER": {
"fields": {
"HighPart": {