WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 09:47:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Avoid 'inheritance' issues with requirements.

Browse Source
This commit is contained in:
Mike Auty
2018-12-08 17:43:28 +00:00
parent f1780bc547
commit 780c5d2646
1 changed files with 21 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/plugins/linux/bash.py
+21 -17
View File
@@ -7,26 +7,29 @@ import struct
from operator import attrgetter
from volatility.framework import constants, renderers, symbols
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from volatility.framework.symbols.linux.bash import BashIntermedSymbols
from volatility.plugins.linux import pslist
from volatility.framework.symbols.linux.bash import BashIntermedSymbols
class Bash(plugins.PluginInterface):
"""Recovers bash command history from memory"""
@classmethod
def get_requirements(cls):
# Since we're calling the plugin, make sure we have the plugin's requirements
return pslist.PsList.get_requirements() + []
return [requirements.TranslationLayerRequirement(name = 'primary',
description = 'Kernel Address Space',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "vmlinux",
description = "Linux Kernel")]
def _generator(self, tasks):
is_32bit = not symbols.utility.symbol_table_is_64bit(self.context, self.config["vmlinux"])
if is_32bit:
pack_format = "I"
bash_json_file = "bash32"
pack_format = "I"
bash_json_file = "bash32"
else:
pack_format = "Q"
bash_json_file = "bash64"
@@ -36,10 +39,9 @@ class Bash(plugins.PluginInterface):
"linux",
bash_json_file)
ts_offset = self.context.symbol_space.get_type(bash_table_name + constants.BANG + "hist_entry").relative_child_offset(
"timestamp")
ts_offset = self.context.symbol_space.get_type(
bash_table_name + constants.BANG + "hist_entry").relative_child_offset("timestamp")
for task in tasks:
task_name = utility.array_to_string(task.comm)
if task_name not in ["bash", "sh", "dash"]:
@@ -54,19 +56,21 @@ class Bash(plugins.PluginInterface):
bang_addrs = []
# find '#' values on the heap
for address, _ in task.search_process_memory(self.context, self.config, proc_layer, proc_layer_name, [str.encode("#")], heap_only = True):
bang_addrs.append(struct.pack(pack_format, address))
for address, _ in task.search_process_memory(self.context, self.config, proc_layer, proc_layer_name,
[str.encode("#")], heap_only = True):
bang_addrs.append(struct.pack(pack_format, address))
history_entries = []
for address, _ in task.search_process_memory(self.context, self.config, proc_layer, proc_layer_name, bang_addrs, heap_only = True):
hist = self.context.object(bash_table_name + constants.BANG + "hist_entry",
offset = address - ts_offset,
layer_name = proc_layer_name)
for address, _ in task.search_process_memory(self.context, self.config, proc_layer, proc_layer_name,
bang_addrs, heap_only = True):
hist = self.context.object(bash_table_name + constants.BANG + "hist_entry",
offset = address - ts_offset,
layer_name = proc_layer_name)
if hist.is_valid():
history_entries.append(hist)
for hist in sorted(history_entries, key = attrgetter('time_as_integer')):
yield (0, (task.pid, task_name, hist.get_time_object(), hist.get_command()))