diff --git a/volatility/framework/plugins/windows/driverirp.py b/volatility/framework/plugins/windows/driverirp.py index 48395ea43..7da30a8da 100644 --- a/volatility/framework/plugins/windows/driverirp.py +++ b/volatility/framework/plugins/windows/driverirp.py @@ -18,45 +18,26 @@ # specific language governing rights and limitations under the License. # +from volatility.plugins.windows.driverscan import DriverScan + import volatility.framework.interfaces.plugins as plugins +from volatility.framework import constants from volatility.framework import renderers, exceptions from volatility.framework.configuration import requirements from volatility.framework.renderers import format_hints -from volatility.plugins.windows.driverscan import DriverScan from volatility.plugins.windows import ssdt -from volatility.framework import constants MAJOR_FUNCTIONS = [ - 'IRP_MJ_CREATE', - 'IRP_MJ_CREATE_NAMED_PIPE', - 'IRP_MJ_CLOSE', - 'IRP_MJ_READ', - 'IRP_MJ_WRITE', - 'IRP_MJ_QUERY_INFORMATION', - 'IRP_MJ_SET_INFORMATION', - 'IRP_MJ_QUERY_EA', - 'IRP_MJ_SET_EA', - 'IRP_MJ_FLUSH_BUFFERS', - 'IRP_MJ_QUERY_VOLUME_INFORMATION', - 'IRP_MJ_SET_VOLUME_INFORMATION', - 'IRP_MJ_DIRECTORY_CONTROL', - 'IRP_MJ_FILE_SYSTEM_CONTROL', - 'IRP_MJ_DEVICE_CONTROL', - 'IRP_MJ_INTERNAL_DEVICE_CONTROL', - 'IRP_MJ_SHUTDOWN', - 'IRP_MJ_LOCK_CONTROL', - 'IRP_MJ_CLEANUP', - 'IRP_MJ_CREATE_MAILSLOT', - 'IRP_MJ_QUERY_SECURITY', - 'IRP_MJ_SET_SECURITY', - 'IRP_MJ_POWER', - 'IRP_MJ_SYSTEM_CONTROL', - 'IRP_MJ_DEVICE_CHANGE', - 'IRP_MJ_QUERY_QUOTA', - 'IRP_MJ_SET_QUOTA', + 'IRP_MJ_CREATE', 'IRP_MJ_CREATE_NAMED_PIPE', 'IRP_MJ_CLOSE', 'IRP_MJ_READ', 'IRP_MJ_WRITE', + 'IRP_MJ_QUERY_INFORMATION', 'IRP_MJ_SET_INFORMATION', 'IRP_MJ_QUERY_EA', 'IRP_MJ_SET_EA', 'IRP_MJ_FLUSH_BUFFERS', + 'IRP_MJ_QUERY_VOLUME_INFORMATION', 'IRP_MJ_SET_VOLUME_INFORMATION', 'IRP_MJ_DIRECTORY_CONTROL', + 'IRP_MJ_FILE_SYSTEM_CONTROL', 'IRP_MJ_DEVICE_CONTROL', 'IRP_MJ_INTERNAL_DEVICE_CONTROL', 'IRP_MJ_SHUTDOWN', + 'IRP_MJ_LOCK_CONTROL', 'IRP_MJ_CLEANUP', 'IRP_MJ_CREATE_MAILSLOT', 'IRP_MJ_QUERY_SECURITY', 'IRP_MJ_SET_SECURITY', + 'IRP_MJ_POWER', 'IRP_MJ_SYSTEM_CONTROL', 'IRP_MJ_DEVICE_CHANGE', 'IRP_MJ_QUERY_QUOTA', 'IRP_MJ_SET_QUOTA', 'IRP_MJ_PNP' ] + class DriverIrp(plugins.PluginInterface): """List IRPs for drivers in a particular windows memory image""" @@ -70,14 +51,9 @@ class DriverIrp(plugins.PluginInterface): def _generator(self): - collection = ssdt.SSDT.build_module_collection(self.context, - self.config['primary'], - self.config['nt_symbols']) + collection = ssdt.SSDT.build_module_collection(self.context, self.config['primary'], self.config['nt_symbols']) - - for driver in DriverScan.scan_drivers(self.context, - self.config['primary'], - self.config['nt_symbols']): + for driver in DriverScan.scan_drivers(self.context, self.config['primary'], self.config['nt_symbols']): try: driver_name = driver.get_driver_name() @@ -92,26 +68,19 @@ class DriverIrp(plugins.PluginInterface): for symbol in symbol_generator: symbols_found = True - yield (0, (format_hints.Hex(driver.vol.offset), - driver_name, - MAJOR_FUNCTIONS[i], - format_hints.Hex(address), - module_name, - symbol.split(constants.BANG)[1])) + yield (0, (format_hints.Hex(driver.vol.offset), driver_name, MAJOR_FUNCTIONS[i], + format_hints.Hex(address), module_name, symbol.split(constants.BANG)[1])) if not symbols_found: - yield (0, (format_hints.Hex(driver.vol.offset), - driver_name, - MAJOR_FUNCTIONS[i], - format_hints.Hex(address), - module_name, - renderers.NotAvailableValue())) + yield (0, (format_hints.Hex(driver.vol.offset), driver_name, MAJOR_FUNCTIONS[i], + format_hints.Hex(address), module_name, renderers.NotAvailableValue())) def run(self): - return renderers.TreeGrid([("Offset", format_hints.Hex), - ("Driver Name", str), - ("IRP", str), - ("Address", format_hints.Hex), - ("Module", str), - ("Symbol", str),], - self._generator()) + return renderers.TreeGrid([ + ("Offset", format_hints.Hex), + ("Driver Name", str), + ("IRP", str), + ("Address", format_hints.Hex), + ("Module", str), + ("Symbol", str), + ], self._generator()) diff --git a/volatility/framework/plugins/windows/driverscan.py b/volatility/framework/plugins/windows/driverscan.py index 1deac7e52..414eb33dc 100644 --- a/volatility/framework/plugins/windows/driverscan.py +++ b/volatility/framework/plugins/windows/driverscan.py @@ -20,11 +20,13 @@ from typing import Iterable +import volatility.plugins.windows.poolscanner as poolscanner + import volatility.framework.interfaces.plugins as plugins from volatility.framework import renderers, interfaces, exceptions from volatility.framework.configuration import requirements from volatility.framework.renderers import format_hints -import volatility.plugins.windows.poolscanner as poolscanner + class DriverScan(plugins.PluginInterface): """Scans for drivers present in a particular windows memory image""" @@ -45,21 +47,15 @@ class DriverScan(plugins.PluginInterface): Iterable[interfaces.objects.ObjectInterface]: """Scans for drivers using the poolscanner module and constraints""" - constraints = poolscanner.PoolScanner.builtin_constraints(symbol_table, - [b'Dri\xf6', b'Driv']) + constraints = poolscanner.PoolScanner.builtin_constraints(symbol_table, [b'Dri\xf6', b'Driv']) - for result in poolscanner.PoolScanner.generate_pool_scan(context, - layer_name, - symbol_table, - constraints): + for result in poolscanner.PoolScanner.generate_pool_scan(context, layer_name, symbol_table, constraints): _constraint, mem_object, _header = result yield mem_object def _generator(self): - for driver in self.scan_drivers(self.context, - self.config['primary'], - self.config['nt_symbols']): + for driver in self.scan_drivers(self.context, self.config['primary'], self.config['nt_symbols']): try: driver_name = driver.get_driver_name() @@ -76,18 +72,10 @@ class DriverScan(plugins.PluginInterface): except exceptions.InvalidAddressException: name = renderers.NotApplicableValue() - yield (0, (format_hints.Hex(driver.vol.offset), - format_hints.Hex(driver.DriverStart), - format_hints.Hex(driver.DriverSize), - service_key, - driver_name, - name)) + yield (0, (format_hints.Hex(driver.vol.offset), format_hints.Hex(driver.DriverStart), + format_hints.Hex(driver.DriverSize), service_key, driver_name, name)) def run(self): return renderers.TreeGrid([("Offset", format_hints.Hex), - ("Start", format_hints.Hex), - ("Size", format_hints.Hex), - ("Service Key", str), - ("Driver Name", str), - ("Name", str)], - self._generator()) + ("Start", format_hints.Hex), ("Size", format_hints.Hex), ("Service Key", str), + ("Driver Name", str), ("Name", str)], self._generator()) diff --git a/volatility/framework/plugins/windows/filescan.py b/volatility/framework/plugins/windows/filescan.py index 64074bc4b..dfd07fc9d 100644 --- a/volatility/framework/plugins/windows/filescan.py +++ b/volatility/framework/plugins/windows/filescan.py @@ -26,6 +26,7 @@ from volatility.framework.configuration import requirements from volatility.framework.renderers import format_hints import volatility.plugins.windows.poolscanner as poolscanner + class FileScan(plugins.PluginInterface): """Scans for file objects present in a particular windows memory image""" @@ -45,21 +46,15 @@ class FileScan(plugins.PluginInterface): Iterable[interfaces.objects.ObjectInterface]: """Scans for file objects using the poolscanner module and constraints""" - constraints = poolscanner.PoolScanner.builtin_constraints(symbol_table, - [b'Fil\xe5', b'File']) + constraints = poolscanner.PoolScanner.builtin_constraints(symbol_table, [b'Fil\xe5', b'File']) - for result in poolscanner.PoolScanner.generate_pool_scan(context, - layer_name, - symbol_table, - constraints): + for result in poolscanner.PoolScanner.generate_pool_scan(context, layer_name, symbol_table, constraints): _constraint, mem_object, _header = result yield mem_object def _generator(self): - for fileobj in self.scan_files(self.context, - self.config['primary'], - self.config['nt_symbols']): + for fileobj in self.scan_files(self.context, self.config['primary'], self.config['nt_symbols']): try: file_name = fileobj.FileName.String @@ -69,5 +64,7 @@ class FileScan(plugins.PluginInterface): yield (0, (format_hints.Hex(fileobj.vol.offset), file_name)) def run(self): - return renderers.TreeGrid([("Offset", format_hints.Hex), ("Name", str),], - self._generator()) + return renderers.TreeGrid([ + ("Offset", format_hints.Hex), + ("Name", str), + ], self._generator()) diff --git a/volatility/framework/plugins/windows/handles.py b/volatility/framework/plugins/windows/handles.py index eacb703d1..6995a1d5e 100644 --- a/volatility/framework/plugins/windows/handles.py +++ b/volatility/framework/plugins/windows/handles.py @@ -306,24 +306,17 @@ class Handles(interfaces_plugins.PluginInterface): "Cannot access _OBJECT_HEADER at {0:#x}".format(entry.vol.offset)) continue - yield (0, (proc.UniqueProcessId, - process_name, - format_hints.Hex(entry.Body.vol.offset), - format_hints.Hex(entry.HandleValue), - obj_type, - format_hints.Hex(entry.GrantedAccess), + yield (0, (proc.UniqueProcessId, process_name, format_hints.Hex(entry.Body.vol.offset), + format_hints.Hex(entry.HandleValue), obj_type, format_hints.Hex(entry.GrantedAccess), obj_name)) def run(self): filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) - return renderers.TreeGrid([("PID", int), ("Process", str), - ("Offset", format_hints.Hex), - ("HandleValue", format_hints.Hex), - ("Type", str), - ("GrantedAccess", format_hints.Hex), - ("Name", str)], + return renderers.TreeGrid([("PID", int), ("Process", str), ("Offset", format_hints.Hex), + ("HandleValue", format_hints.Hex), ("Type", str), + ("GrantedAccess", format_hints.Hex), ("Name", str)], self._generator( pslist.PsList.list_processes( self.context, diff --git a/volatility/framework/plugins/windows/modscan.py b/volatility/framework/plugins/windows/modscan.py index 200a1fd75..506b6952b 100644 --- a/volatility/framework/plugins/windows/modscan.py +++ b/volatility/framework/plugins/windows/modscan.py @@ -20,11 +20,13 @@ from typing import Iterable +import volatility.plugins.windows.poolscanner as poolscanner + import volatility.framework.interfaces.plugins as plugins from volatility.framework import renderers, interfaces, exceptions from volatility.framework.configuration import requirements from volatility.framework.renderers import format_hints -import volatility.plugins.windows.poolscanner as poolscanner + class ModScan(plugins.PluginInterface): """Scans for modules present in a particular windows memory image""" @@ -47,18 +49,13 @@ class ModScan(plugins.PluginInterface): constraints = poolscanner.PoolScanner.builtin_constraints(symbol_table, [b'MmLd']) - for result in poolscanner.PoolScanner.generate_pool_scan(context, - layer_name, - symbol_table, - constraints): + for result in poolscanner.PoolScanner.generate_pool_scan(context, layer_name, symbol_table, constraints): _constraint, mem_object, _header = result yield mem_object def _generator(self): - for mod in self.scan_modules(self.context, - self.config['primary'], - self.config['nt_symbols']): + for mod in self.scan_modules(self.context, self.config['primary'], self.config['nt_symbols']): try: BaseDllName = mod.BaseDllName.get_string() @@ -79,9 +76,5 @@ class ModScan(plugins.PluginInterface): )) def run(self): - return renderers.TreeGrid([("Offset", format_hints.Hex), - ("Base", format_hints.Hex), - ("Size", format_hints.Hex), - ("Name", str), - ("Path", str)], - self._generator()) + return renderers.TreeGrid([("Offset", format_hints.Hex), ("Base", format_hints.Hex), ("Size", format_hints.Hex), + ("Name", str), ("Path", str)], self._generator()) diff --git a/volatility/framework/plugins/windows/mutantscan.py b/volatility/framework/plugins/windows/mutantscan.py index 3c3975d03..598c95924 100644 --- a/volatility/framework/plugins/windows/mutantscan.py +++ b/volatility/framework/plugins/windows/mutantscan.py @@ -26,6 +26,7 @@ from volatility.framework.configuration import requirements from volatility.framework.renderers import format_hints import volatility.plugins.windows.poolscanner as poolscanner + class MutantScan(plugins.PluginInterface): """Scans for mutexes present in a particular windows memory image""" @@ -45,21 +46,15 @@ class MutantScan(plugins.PluginInterface): Iterable[interfaces.objects.ObjectInterface]: """Scans for mutants using the poolscanner module and constraints""" - constraints = poolscanner.PoolScanner.builtin_constraints(symbol_table, - [b'Mut\xe1', b'Muta']) + constraints = poolscanner.PoolScanner.builtin_constraints(symbol_table, [b'Mut\xe1', b'Muta']) - for result in poolscanner.PoolScanner.generate_pool_scan(context, - layer_name, - symbol_table, - constraints): + for result in poolscanner.PoolScanner.generate_pool_scan(context, layer_name, symbol_table, constraints): _constraint, mem_object, _header = result yield mem_object def _generator(self): - for mutant in self.scan_mutants(self.context, - self.config['primary'], - self.config['nt_symbols']): + for mutant in self.scan_mutants(self.context, self.config['primary'], self.config['nt_symbols']): try: name = mutant.get_name() @@ -69,5 +64,7 @@ class MutantScan(plugins.PluginInterface): yield (0, (format_hints.Hex(mutant.vol.offset), name)) def run(self): - return renderers.TreeGrid([("Offset", format_hints.Hex), ("Name", str),], - self._generator()) + return renderers.TreeGrid([ + ("Offset", format_hints.Hex), + ("Name", str), + ], self._generator()) diff --git a/volatility/framework/plugins/windows/psscan.py b/volatility/framework/plugins/windows/psscan.py index 5af17ff46..d4018cddc 100644 --- a/volatility/framework/plugins/windows/psscan.py +++ b/volatility/framework/plugins/windows/psscan.py @@ -28,6 +28,7 @@ from volatility.framework.renderers import format_hints from volatility.plugins import timeliner import volatility.plugins.windows.poolscanner as poolscanner + class PsScan(plugins.PluginInterface, timeliner.TimeLinerInterface): """Scans for processes present in a particular windows memory image""" @@ -47,27 +48,20 @@ class PsScan(plugins.PluginInterface, timeliner.TimeLinerInterface): Iterable[interfaces.objects.ObjectInterface]: """Scans for processes using the poolscanner module and constraints""" - constraints = poolscanner.PoolScanner.builtin_constraints(symbol_table, - [b'Pro\xe3', b'Proc']) + constraints = poolscanner.PoolScanner.builtin_constraints(symbol_table, [b'Pro\xe3', b'Proc']) - for result in poolscanner.PoolScanner.generate_pool_scan(context, - layer_name, - symbol_table, - constraints): + for result in poolscanner.PoolScanner.generate_pool_scan(context, layer_name, symbol_table, constraints): _constraint, mem_object, _header = result yield mem_object def _generator(self): - for proc in self.scan_processes( - self.context, - self.config['primary'], - self.config['nt_symbols']): + for proc in self.scan_processes(self.context, self.config['primary'], self.config['nt_symbols']): yield (0, (proc.UniqueProcessId, proc.InheritedFromUniqueProcessId, proc.ImageFileName.cast("string", max_length = proc.ImageFileName.vol.count, errors = 'replace'), - format_hints.Hex(proc.vol.offset), proc.ActiveThreads, proc.get_handle_count(), proc.get_session_id(), - proc.get_is_wow64(), proc.get_create_time(), proc.get_exit_time())) + format_hints.Hex(proc.vol.offset), proc.ActiveThreads, proc.get_handle_count(), + proc.get_session_id(), proc.get_is_wow64(), proc.get_create_time(), proc.get_exit_time())) def generate_timeline(self): for row in self._generator(): @@ -77,8 +71,7 @@ class PsScan(plugins.PluginInterface, timeliner.TimeLinerInterface): yield (description, timeliner.TimeLinerType.MODIFIED, row_data[9]) def run(self): - return renderers.TreeGrid([("PID", int), ("PPID", int), ("ImageFileName", str), - ("Offset", format_hints.Hex), ("Threads", int), - ("Handles", int), ("SessionId", int), ("Wow64", bool), + return renderers.TreeGrid([("PID", int), ("PPID", int), ("ImageFileName", str), ("Offset", format_hints.Hex), + ("Threads", int), ("Handles", int), ("SessionId", int), ("Wow64", bool), ("CreateTime", datetime.datetime), ("ExitTime", datetime.datetime)], self._generator()) diff --git a/volatility/framework/plugins/windows/ssdt.py b/volatility/framework/plugins/windows/ssdt.py index 44c93d2e8..96a73deeb 100644 --- a/volatility/framework/plugins/windows/ssdt.py +++ b/volatility/framework/plugins/windows/ssdt.py @@ -44,9 +44,7 @@ class SSDT(plugins.PluginInterface): ] @classmethod - def build_module_collection(cls, - context: interfaces.context.ContextInterface, - layer_name: str, + def build_module_collection(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str) -> contexts.ModuleCollection: """Builds a collection of modules""" @@ -68,11 +66,7 @@ class SSDT(plugins.PluginInterface): else: symbol_table_name = None - context_module = contexts.SizedModule(context, - module_name, - layer_name, - mod.DllBase, - mod.SizeOfImage, + context_module = contexts.SizedModule(context, module_name, layer_name, mod.DllBase, mod.SizeOfImage, symbol_table_name) context_modules.append(context_module) @@ -82,9 +76,7 @@ class SSDT(plugins.PluginInterface): def _generator(self) -> Iterator[Tuple[int, Tuple[int, int, Any, Any]]]: layer_name = self.config['primary'] - collection = self.build_module_collection(self.context, - self.config["primary"], - self.config["nt_symbols"]) + collection = self.build_module_collection(self.context, self.config["primary"], self.config["nt_symbols"]) kvo = self.context.memory[layer_name].config['kernel_virtual_offset'] ntkrnlmp = self.context.module(self.config["nt_symbols"], layer_name = layer_name, offset = kvo) diff --git a/volatility/framework/symbols/linux/extensions/__init__.py b/volatility/framework/symbols/linux/extensions/__init__.py index f079ebe29..a74d25b9a 100644 --- a/volatility/framework/symbols/linux/extensions/__init__.py +++ b/volatility/framework/symbols/linux/extensions/__init__.py @@ -239,9 +239,10 @@ class vm_area_struct(objects.Struct): elif flags_str == "r-x" and self.vm_file.dereference().vol.offset == 0: ret = True - + return ret + class qstr(objects.Struct): def name_as_str(self) -> str: diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index b643b6c16..03ed7d0a6 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -436,6 +436,7 @@ class _DEVICE_OBJECT(objects.Struct, ExecutiveObject): header = self.object_header() return header.NameInfo.Name.String # type: ignore + class _DRIVER_OBJECT(objects.Struct, ExecutiveObject): """A class for kernel driver objects.""" @@ -447,6 +448,7 @@ class _DRIVER_OBJECT(objects.Struct, ExecutiveObject): """Determine if the object is valid""" return True + class _FILE_OBJECT(objects.Struct, ExecutiveObject): """A class for windows file objects""" @@ -467,6 +469,7 @@ class _FILE_OBJECT(objects.Struct, ExecutiveObject): return name + class _KMUTANT(objects.Struct, ExecutiveObject): """A class for windows mutant objects""" @@ -479,6 +482,7 @@ class _KMUTANT(objects.Struct, ExecutiveObject): header = self.object_header() return header.NameInfo.Name.String # type: ignore + class _OBJECT_HEADER(objects.Struct): """A class for the headers for executive kernel objects, which contains quota information, ownership details, naming data, and ACLs."""