From 775ece3cb225714a3c4ae85d36d10179510b156d Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 24 Jul 2017 15:43:34 +0100 Subject: [PATCH] Convert the 'ntkrnlmp' requirement into an 'nt' requirement. --- volatility/plugins/windows/hivelist.py | 19 ++++++++------- volatility/plugins/windows/modules.py | 32 +++++++++++++------------- volatility/plugins/windows/pslist.py | 19 +++++++++++---- 3 files changed, 40 insertions(+), 30 deletions(-) diff --git a/volatility/plugins/windows/hivelist.py b/volatility/plugins/windows/hivelist.py index 9cd1a0c04..77e08e225 100644 --- a/volatility/plugins/windows/hivelist.py +++ b/volatility/plugins/windows/hivelist.py @@ -2,7 +2,7 @@ import volatility.framework.interfaces.plugins as plugins from volatility.framework.configuration import requirements from volatility.framework.renderers import TreeGrid from volatility.framework.renderers import format_hints -from volatility.framework import exceptions + class HiveList(plugins.PluginInterface): """Lists the registry hives present in a particular memory image""" @@ -12,17 +12,16 @@ class HiveList(plugins.PluginInterface): return [requirements.TranslationLayerRequirement(name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "ntkrnlmp", - description = "Windows OS")] + requirements.SymbolRequirement(name = "nt", description = "Windows OS")] def update_configuration(self): """No operation since all values provided by config/requirements initially""" - + def _generator(self): for hive in self.list_hives(): - - yield (0, (format_hints.Hex(hive.vol.offset), - hive.name or "")) + + yield (0, (format_hints.Hex(hive.vol.offset), + hive.name or "")) def list_hives(self): """Lists all the hives in the primary layer""" @@ -31,17 +30,17 @@ class HiveList(plugins.PluginInterface): # We only use the object factory to demonstrate how to use one kvo = self.config['primary.kernel_virtual_offset'] - ntkrnlmp = self.context.module("ntkrnlmp", layer_name = layer_name, offset = kvo) + ntkrnlmp = self.context.module(self.config["nt"], layer_name = layer_name, offset = kvo) list_head = ntkrnlmp.get_symbol("CmpHiveListHead").address list_entry = ntkrnlmp.object(type_name = "_LIST_ENTRY", offset = kvo + list_head) - reloff = self.context.symbol_space.get_type("ntkrnlmp!_CMHIVE").relative_child_offset("HiveList") + reloff = ntkrnlmp.get_type("_CMHIVE").relative_child_offset("HiveList") cmhive = ntkrnlmp.object(type_name = "_CMHIVE", offset = list_entry.vol.offset - reloff) for hive in cmhive.HiveList: yield hive def run(self): - return TreeGrid([("Offset", format_hints.Hex), + return TreeGrid([("Offset", format_hints.Hex), ("FileFullPath", str)], self._generator()) diff --git a/volatility/plugins/windows/modules.py b/volatility/plugins/windows/modules.py index 9cbd42c58..6a4c874f1 100644 --- a/volatility/plugins/windows/modules.py +++ b/volatility/plugins/windows/modules.py @@ -1,8 +1,9 @@ import volatility.framework.interfaces.plugins as plugins +from volatility.framework import exceptions from volatility.framework.configuration import requirements from volatility.framework.renderers import TreeGrid from volatility.framework.renderers import format_hints -from volatility.framework import exceptions + class Modules(plugins.PluginInterface): """Lists the loaded kernel modules""" @@ -12,31 +13,30 @@ class Modules(plugins.PluginInterface): return [requirements.TranslationLayerRequirement(name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "ntkrnlmp", - description = "Windows OS")] + requirements.SymbolRequirement(name = "nt", description = "Windows OS")] def update_configuration(self): """No operation since all values provided by config/requirements initially""" - + def _generator(self): for mod in self.list_modules(): - + try: BaseDllName = mod.BaseDllName.String except exceptions.InvalidAddressException: BaseDllName = "" - + try: FullDllName = mod.FullDllName.String except exceptions.InvalidAddressException: FullDllName = "" - - yield (0, (format_hints.Hex(mod.vol.offset), - format_hints.Hex(mod.DllBase), - format_hints.Hex(mod.SizeOfImage), - BaseDllName, - FullDllName, - )) + + yield (0, (format_hints.Hex(mod.vol.offset), + format_hints.Hex(mod.DllBase), + format_hints.Hex(mod.SizeOfImage), + BaseDllName, + FullDllName, + )) def list_modules(self): """Lists all the modules in the primary layer""" @@ -44,18 +44,18 @@ class Modules(plugins.PluginInterface): layer_name = self.config['primary'] kvo = self.config['primary.kernel_virtual_offset'] - ntkrnlmp = self.context.module("ntkrnlmp", layer_name = layer_name, offset = kvo) + ntkrnlmp = self.context.module(self.config["nt"], layer_name = layer_name, offset = kvo) list_head = ntkrnlmp.get_symbol("PsLoadedModuleList").address list_entry = ntkrnlmp.object(type_name = "_LIST_ENTRY", offset = kvo + list_head) - reloff = self.context.symbol_space.get_type("ntkrnlmp!_LDR_DATA_TABLE_ENTRY").relative_child_offset("InLoadOrderLinks") + reloff = ntkrnlmp.get_type("_LDR_DATA_TABLE_ENTRY").relative_child_offset("InLoadOrderLinks") module = ntkrnlmp.object(type_name = "_LDR_DATA_TABLE_ENTRY", offset = list_entry.vol.offset - reloff) for mod in module.InLoadOrderLinks: yield mod def run(self): - return TreeGrid([("Offset", format_hints.Hex), + return TreeGrid([("Offset", format_hints.Hex), ("Base", format_hints.Hex), ("Size", format_hints.Hex), ("Name", str), diff --git a/volatility/plugins/windows/pslist.py b/volatility/plugins/windows/pslist.py index 0b6a9b20d..63d97aa15 100644 --- a/volatility/plugins/windows/pslist.py +++ b/volatility/plugins/windows/pslist.py @@ -11,8 +11,7 @@ class PsList(plugins.PluginInterface): return [requirements.TranslationLayerRequirement(name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "ntkrnlmp", - description = "Windows OS"), + requirements.SymbolRequirement(name = "nt", description = "Windows OS"), requirements.IntRequirement(name = 'pid', description = "Process ID", optional = True)] @@ -33,11 +32,23 @@ class PsList(plugins.PluginInterface): # We only use the object factory to demonstrate how to use one kvo = self.config['primary.kernel_virtual_offset'] - ntkrnlmp = self.context.module("ntkrnlmp", layer_name = layer_name, offset = kvo) + ntkrnlmp = self.context.module(self.config['nt'], layer_name = layer_name, offset = kvo) ps_aph_offset = ntkrnlmp.get_symbol("PsActiveProcessHead").address list_entry = ntkrnlmp.object(type_name = "_LIST_ENTRY", offset = kvo + ps_aph_offset) - reloff = self.context.symbol_space.get_type("ntkrnlmp!_EPROCESS").relative_child_offset("ActiveProcessLinks") + + # This is example code to demonstrate how to use symbol_space directly, rather than through a module: + # + # ``` + # reloff = self.context.symbol_space.get_type( + # self.config['nt'] + constants.BANG + "_EPROCESS").relative_child_offset( + # "ActiveProcessLinks") + # ``` + # + # Note: "nt!_EPROCESS" could have been used, but would rely on the "nt" symbol table not already + # having been present. Strictly, the value of the requirement should be joined with the BANG character + # defined in the constants file + reloff = ntkrnlmp.get_type("_EPROCESS").relative_child_offset("ActiveProcessLinks") eproc = ntkrnlmp.object(type_name = "_EPROCESS", offset = list_entry.vol.offset - reloff) for proc in eproc.ActiveProcessLinks: