WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-12 20:57:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Convert the 'ntkrnlmp' requirement into an 'nt' requirement.

Browse Source
This commit is contained in:
Mike Auty
2017-07-24 15:43:34 +01:00
parent 8ad9fbfd24
commit 775ece3cb2
3 changed files with 40 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/plugins/windows/hivelist.py
+9 -10
View File
@@ -2,7 +2,7 @@ import volatility.framework.interfaces.plugins as plugins
from volatility.framework.configuration import requirements
from volatility.framework.renderers import TreeGrid
from volatility.framework.renderers import format_hints
from volatility.framework import exceptions
class HiveList(plugins.PluginInterface):
"""Lists the registry hives present in a particular memory image"""
@@ -12,17 +12,16 @@ class HiveList(plugins.PluginInterface):
return [requirements.TranslationLayerRequirement(name = 'primary',
description = 'Kernel Address Space',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "ntkrnlmp",
description = "Windows OS")]
requirements.SymbolRequirement(name = "nt", description = "Windows OS")]
def update_configuration(self):
"""No operation since all values provided by config/requirements initially"""
def _generator(self):
for hive in self.list_hives():
yield (0, (format_hints.Hex(hive.vol.offset),
hive.name or ""))
yield (0, (format_hints.Hex(hive.vol.offset),
hive.name or ""))
def list_hives(self):
"""Lists all the hives in the primary layer"""
@@ -31,17 +30,17 @@ class HiveList(plugins.PluginInterface):
# We only use the object factory to demonstrate how to use one
kvo = self.config['primary.kernel_virtual_offset']
ntkrnlmp = self.context.module("ntkrnlmp", layer_name = layer_name, offset = kvo)
ntkrnlmp = self.context.module(self.config["nt"], layer_name = layer_name, offset = kvo)
list_head = ntkrnlmp.get_symbol("CmpHiveListHead").address
list_entry = ntkrnlmp.object(type_name = "_LIST_ENTRY", offset = kvo + list_head)
reloff = self.context.symbol_space.get_type("ntkrnlmp!_CMHIVE").relative_child_offset("HiveList")
reloff = ntkrnlmp.get_type("_CMHIVE").relative_child_offset("HiveList")
cmhive = ntkrnlmp.object(type_name = "_CMHIVE", offset = list_entry.vol.offset - reloff)
for hive in cmhive.HiveList:
yield hive
def run(self):
return TreeGrid([("Offset", format_hints.Hex),
return TreeGrid([("Offset", format_hints.Hex),
("FileFullPath", str)],
self._generator())
volatility/plugins/windows/modules.py
+16 -16
View File
@@ -1,8 +1,9 @@
import volatility.framework.interfaces.plugins as plugins
from volatility.framework import exceptions
from volatility.framework.configuration import requirements
from volatility.framework.renderers import TreeGrid
from volatility.framework.renderers import format_hints
from volatility.framework import exceptions
class Modules(plugins.PluginInterface):
"""Lists the loaded kernel modules"""
@@ -12,31 +13,30 @@ class Modules(plugins.PluginInterface):
return [requirements.TranslationLayerRequirement(name = 'primary',
description = 'Kernel Address Space',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "ntkrnlmp",
description = "Windows OS")]
requirements.SymbolRequirement(name = "nt", description = "Windows OS")]
def update_configuration(self):
"""No operation since all values provided by config/requirements initially"""
def _generator(self):
for mod in self.list_modules():
try:
BaseDllName = mod.BaseDllName.String
except exceptions.InvalidAddressException:
BaseDllName = ""
try:
FullDllName = mod.FullDllName.String
except exceptions.InvalidAddressException:
FullDllName = ""
yield (0, (format_hints.Hex(mod.vol.offset),
format_hints.Hex(mod.DllBase),
format_hints.Hex(mod.SizeOfImage),
BaseDllName,
FullDllName,
))
yield (0, (format_hints.Hex(mod.vol.offset),
format_hints.Hex(mod.DllBase),
format_hints.Hex(mod.SizeOfImage),
BaseDllName,
FullDllName,
))
def list_modules(self):
"""Lists all the modules in the primary layer"""
@@ -44,18 +44,18 @@ class Modules(plugins.PluginInterface):
layer_name = self.config['primary']
kvo = self.config['primary.kernel_virtual_offset']
ntkrnlmp = self.context.module("ntkrnlmp", layer_name = layer_name, offset = kvo)
ntkrnlmp = self.context.module(self.config["nt"], layer_name = layer_name, offset = kvo)
list_head = ntkrnlmp.get_symbol("PsLoadedModuleList").address
list_entry = ntkrnlmp.object(type_name = "_LIST_ENTRY", offset = kvo + list_head)
reloff = self.context.symbol_space.get_type("ntkrnlmp!_LDR_DATA_TABLE_ENTRY").relative_child_offset("InLoadOrderLinks")
reloff = ntkrnlmp.get_type("_LDR_DATA_TABLE_ENTRY").relative_child_offset("InLoadOrderLinks")
module = ntkrnlmp.object(type_name = "_LDR_DATA_TABLE_ENTRY", offset = list_entry.vol.offset - reloff)
for mod in module.InLoadOrderLinks:
yield mod
def run(self):
return TreeGrid([("Offset", format_hints.Hex),
return TreeGrid([("Offset", format_hints.Hex),
("Base", format_hints.Hex),
("Size", format_hints.Hex),
("Name", str),
volatility/plugins/windows/pslist.py
+15 -4
View File
@@ -11,8 +11,7 @@ class PsList(plugins.PluginInterface):
return [requirements.TranslationLayerRequirement(name = 'primary',
description = 'Kernel Address Space',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "ntkrnlmp",
description = "Windows OS"),
requirements.SymbolRequirement(name = "nt", description = "Windows OS"),
requirements.IntRequirement(name = 'pid',
description = "Process ID",
optional = True)]
@@ -33,11 +32,23 @@ class PsList(plugins.PluginInterface):
# We only use the object factory to demonstrate how to use one
kvo = self.config['primary.kernel_virtual_offset']
ntkrnlmp = self.context.module("ntkrnlmp", layer_name = layer_name, offset = kvo)
ntkrnlmp = self.context.module(self.config['nt'], layer_name = layer_name, offset = kvo)
ps_aph_offset = ntkrnlmp.get_symbol("PsActiveProcessHead").address
list_entry = ntkrnlmp.object(type_name = "_LIST_ENTRY", offset = kvo + ps_aph_offset)
reloff = self.context.symbol_space.get_type("ntkrnlmp!_EPROCESS").relative_child_offset("ActiveProcessLinks")
# This is example code to demonstrate how to use symbol_space directly, rather than through a module:
#
# ```
# reloff = self.context.symbol_space.get_type(
# self.config['nt'] + constants.BANG + "_EPROCESS").relative_child_offset(
# "ActiveProcessLinks")
# ```
#
# Note: "nt!_EPROCESS" could have been used, but would rely on the "nt" symbol table not already
# having been present. Strictly, the value of the requirement should be joined with the BANG character
# defined in the constants file
reloff = ntkrnlmp.get_type("_EPROCESS").relative_child_offset("ActiveProcessLinks")
eproc = ntkrnlmp.object(type_name = "_EPROCESS", offset = list_entry.vol.offset - reloff)
for proc in eproc.ActiveProcessLinks: