From 8ecd7e2ddddb018164d3ef734899b91a93899d09 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 28 Nov 2024 15:17:22 +1100 Subject: [PATCH 01/11] Linux/Mac: Log producer information --- .../framework/automagic/symbol_finder.py | 31 ++++++++++++++++--- volatility3/framework/symbols/intermed.py | 15 ++++++--- volatility3/framework/symbols/metadata.py | 13 +++++++- 3 files changed, 49 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/automagic/symbol_finder.py b/volatility3/framework/automagic/symbol_finder.py index 21e594549..55e2ad6f5 100644 --- a/volatility3/framework/automagic/symbol_finder.py +++ b/volatility3/framework/automagic/symbol_finder.py @@ -142,11 +142,11 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface): ) for _, banner in banner_list: - vollog.debug(f"Identified banner: {repr(banner)}") - symbol_files = self.banners.get(banner, None) - if symbol_files: - isf_path = symbol_files - vollog.debug(f"Using symbol library: {symbol_files}") + vollog.debug(f"Identified banner: {banner!r}") + symbols_file = self.banners.get(banner, None) + if symbols_file: + isf_path = symbols_file + vollog.debug(f"Using symbol library: {symbols_file}") clazz = self.symbol_class # Set the discovered options path_join = interfaces.configuration.path_join @@ -160,8 +160,29 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface): path_join(config_path, requirement.name, "symbol_mask") ] = layer.address_mask + # Keep track of the existing table names so we know which ones were added + old_table_names = set(context.symbol_space._dict) + # Construct the appropriate symbol table requirement.construct(context, config_path) + + new_table_names = context.symbol_space._dict.keys() - old_table_names + # It should add only one symbol table. Ignore the next steps if it doesn't + if len(new_table_names) == 1: + new_table_name = new_table_names.pop() + symbol_table = context.symbol_space._dict[new_table_name] + producer = symbol_table.producer + vollog.debug( + f"producer_name: {producer.name}, producer_version: {producer.version_string}" + ) + for category in symbol_table.metadata._json_data: + vollog.debug(f"{category}:") + for subkey in symbol_table.metadata._json_data[category]: + subkey_item = ", ".join( + f"{key}: '{value}'" for key, value in subkey.items() + ) + vollog.debug(f"\t{subkey_item}") + break else: vollog.debug(f"Symbol library path not found for: {banner}") diff --git a/volatility3/framework/symbols/intermed.py b/volatility3/framework/symbols/intermed.py index 751f88e39..5f558bf12 100644 --- a/volatility3/framework/symbols/intermed.py +++ b/volatility3/framework/symbols/intermed.py @@ -738,10 +738,17 @@ class Version6Format(Version5Format): @property def metadata(self) -> Optional[interfaces.symbols.MetadataInterface]: """Returns a MetadataInterface object.""" - if self._json_object.get("metadata", {}).get("windows"): - return metadata.WindowsMetadata(self._json_object["metadata"]["windows"]) - if self._json_object.get("metadata", {}).get("linux"): - return metadata.LinuxMetadata(self._json_object["metadata"]["linux"]) + if "metadata" not in self._json_object: + return None + + json_metadata = self._json_object["metadata"] + if "windows" in json_metadata: + return metadata.WindowsMetadata(json_metadata["windows"]) + if "linux" in json_metadata: + return metadata.LinuxMetadata(json_metadata["linux"]) + if "mac" in json_metadata: + return metadata.MacMetadata(json_metadata["mac"]) + return None diff --git a/volatility3/framework/symbols/metadata.py b/volatility3/framework/symbols/metadata.py index 95f542f07..39ddd6544 100644 --- a/volatility3/framework/symbols/metadata.py +++ b/volatility3/framework/symbols/metadata.py @@ -18,10 +18,17 @@ class ProducerMetadata(interfaces.symbols.MetadataInterface): def name(self) -> Optional[str]: return self._json_data.get("name", None) + @property + def version_string(self) -> str: + """Returns the ISF file producer's version as a string. + If no version is present, an empty string is returned. + """ + return self._json_data.get("version", "") + @property def version(self) -> Optional[Tuple[int]]: """Returns the version of the ISF file producer""" - version = self._json_data.get("version", None) + version = self.version_string() if not version: return None if all(x in "0123456789." for x in version): @@ -81,3 +88,7 @@ class WindowsMetadata(interfaces.symbols.MetadataInterface): class LinuxMetadata(interfaces.symbols.MetadataInterface): """Class to handle the metadata from a Linux symbol table.""" + + +class MacMetadata(interfaces.symbols.MetadataInterface): + """Class to handle the metadata from a Mac symbol table.""" From 3748cb89b8e2493fd8792315a9b3419d9a26dfb3 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 28 Nov 2024 10:22:45 +0000 Subject: [PATCH 02/11] Windows: Improve debugging output for pdbscan --- volatility3/framework/automagic/pdbscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/automagic/pdbscan.py b/volatility3/framework/automagic/pdbscan.py index 1d5bf55ea..3751b383e 100644 --- a/volatility3/framework/automagic/pdbscan.py +++ b/volatility3/framework/automagic/pdbscan.py @@ -272,7 +272,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): for kernel in kernels: vollog.log( constants.LOGLEVEL_VVVV, - f"Testing potential kernel for {kernel.get('pdb_name', 'Unknown')} at {kernel.get('signature_offset', -1)} with MZ offset at {kernel.get('mz_offset', -1)}", + f"Testing potential kernel for {kernel.get('pdb_name', 'Unknown')} at {kernel.get('signature_offset', -1):x} with MZ offset at {kernel.get('mz_offset', -1):x}", ) valid_kernel = test_kernel(physical_layer_name, virtual_layer_name, kernel) if valid_kernel is not None: From bec6bc659475b7fc016f1b05093e7783ca70d904 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 28 Nov 2024 16:59:52 +0000 Subject: [PATCH 03/11] Fix up vmayarascan and vadyarascan to use yarascan properly --- .../framework/plugins/linux/vmayarascan.py | 58 +++++++++------ .../framework/plugins/windows/vadyarascan.py | 71 ++++++++----------- 2 files changed, 64 insertions(+), 65 deletions(-) diff --git a/volatility3/framework/plugins/linux/vmayarascan.py b/volatility3/framework/plugins/linux/vmayarascan.py index 9fe06b0c8..3d8eb603b 100644 --- a/volatility3/framework/plugins/linux/vmayarascan.py +++ b/volatility3/framework/plugins/linux/vmayarascan.py @@ -2,6 +2,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # +import logging from typing import Iterable, List, Tuple from volatility3.framework import interfaces, renderers @@ -10,6 +11,8 @@ from volatility3.framework.renderers import format_hints from volatility3.plugins import yarascan from volatility3.plugins.linux import pslist +vollog = logging.getLogger(__name__) + class VmaYaraScan(interfaces.plugins.PluginInterface): """Scans all virtual memory areas for tasks using yara.""" @@ -50,6 +53,8 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): # use yarascan to parse the yara options provided and create the rules rules = yarascan.YaraScan.process_yara_options(dict(self.config)) + sanity_check = 1024 * 1024 * 1024 # 1 GB + # filter based on the pid option if provided filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) for task in pslist.PsList.list_tasks( @@ -66,29 +71,36 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): # get the proc_layer object from the context proc_layer = self.context.layers[proc_layer_name] - for start, end in self.get_vma_maps(task): - for match in rules.match( - data=proc_layer.read(start, end - start, True) - ): - if yarascan.YaraScan.yara_returns_instances(): - for match_string in match.strings: - for instance in match_string.instances: - yield 0, ( - format_hints.Hex(instance.offset + start), - task.UniqueProcessId, - match.rule, - match_string.identifier, - instance.matched_data, - ) - else: - for offset, name, value in match.strings: - yield 0, ( - format_hints.Hex(offset + start), - task.tgid, - match.rule, - name, - value, - ) + vma_maps = list(self.get_vma_maps(task)) + insane_vma_maps = [ + start for (start, size) in vma_maps if size > sanity_check + ] + for start in insane_vma_maps: + vollog.debug(f"VMA at 0x{start:x} over sanity-check size, not scanning") + + if not vma_maps: + vollog.warning(f"No VMAs were found for task {task.pid}, aborting") + continue + + max_vma_size: int = max( + [size for (start, size) in vma_maps if size <= sanity_check] + ) + scanner = yarascan.YaraScanner(rules=rules) + scanner.chunk_size = max_vma_size + + # scan the process layer with the yarascanner + for offset, rule_name, name, value in proc_layer.scan( + context=self.context, + scanner=scanner, + sections=vma_maps, + ): + yield 0, ( + format_hints.Hex(offset), + task.tgid, + rule_name, + name, + value, + ) @staticmethod def get_vma_maps( diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py index efcc70d07..65006bdc2 100644 --- a/volatility3/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -32,6 +32,9 @@ class VadYaraScan(interfaces.plugins.PluginInterface): requirements.PluginRequirement( name="pslist", plugin=pslist.PsList, version=(2, 0, 0) ), + requirements.VersionRequirement( + name="yarascanner", component=yarascan.YaraScanner, version=(2, 0, 0) + ), requirements.PluginRequirement( name="yarascan", plugin=yarascan.YaraScan, version=(2, 0, 0) ), @@ -66,49 +69,33 @@ class VadYaraScan(interfaces.plugins.PluginInterface): ): layer_name = task.add_process_layer() layer = self.context.layers[layer_name] - for start, size in self.get_vad_maps(task): - if size > sanity_check: - vollog.debug( - f"VAD at 0x{start:x} over sanity-check size, not scanning" - ) - continue - data = layer.read(start, size, True) - if not yarascan.YaraScan._yara_x: - for match in rules.match(data=data): - if yarascan.YaraScan.yara_returns_instances(): - for match_string in match.strings: - for instance in match_string.instances: - yield 0, ( - format_hints.Hex(instance.offset + start), - task.UniqueProcessId, - match.rule, - match_string.identifier, - instance.matched_data, - ) - else: - for offset, name, value in match.strings: - yield 0, ( - format_hints.Hex(offset + start), - task.UniqueProcessId, - match.rule, - name, - value, - ) - else: - for match in rules.scan(data).matching_rules: - for match_string in match.patterns: - for instance in match_string.matches: - yield 0, ( - format_hints.Hex(instance.offset + start), - task.UniqueProcessId, - f"{match.namespace}.{match.identifier}", - match_string.identifier, - data[ - instance.offset : instance.offset - + instance.length - ], - ) + vad_maps = list(self.get_vad_maps(task)) + insane_vad_maps = [ + start for (start, size) in vad_maps if size > sanity_check + ] + for start in insane_vad_maps: + vollog.debug(f"VAD at 0x{start:x} over sanity-check size, not scanning") + + max_vad_size: int = max( + [size for (start, size) in vad_maps if size <= sanity_check] + ) + scanner = yarascan.YaraScanner(rules=rules) + scanner.chunk_size = max_vad_size + + # scan the process layer with the yarascanner + for offset, rule_name, name, value in layer.scan( + context=self.context, + scanner=scanner, + sections=vad_maps, + ): + yield 0, ( + format_hints.Hex(offset), + task.UniqueProcessId, + rule_name, + name, + value, + ) @staticmethod def get_vad_maps( From b8023f0c97ae97253ab9b8eae99e1dc4cba1eb79 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 29 Nov 2024 19:05:27 +1100 Subject: [PATCH 04/11] Linux/Mac: Address code review suggestions - Add getters for Linux/Mac ISF sources - Avoid using internal attributes - Use the dict repr instead of walking the dict to simplify code --- .../framework/automagic/symbol_finder.py | 26 ++++++++++--------- volatility3/framework/symbols/metadata.py | 19 +++++++++++--- 2 files changed, 29 insertions(+), 16 deletions(-) diff --git a/volatility3/framework/automagic/symbol_finder.py b/volatility3/framework/automagic/symbol_finder.py index 55e2ad6f5..6d689e194 100644 --- a/volatility3/framework/automagic/symbol_finder.py +++ b/volatility3/framework/automagic/symbol_finder.py @@ -161,27 +161,29 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface): ] = layer.address_mask # Keep track of the existing table names so we know which ones were added - old_table_names = set(context.symbol_space._dict) + old_table_names = set(context.symbol_space) # Construct the appropriate symbol table requirement.construct(context, config_path) - new_table_names = context.symbol_space._dict.keys() - old_table_names + new_table_names = set(context.symbol_space) - old_table_names # It should add only one symbol table. Ignore the next steps if it doesn't if len(new_table_names) == 1: new_table_name = new_table_names.pop() - symbol_table = context.symbol_space._dict[new_table_name] - producer = symbol_table.producer + symbol_table = context.symbol_space[new_table_name] + producer_metadata = symbol_table.producer vollog.debug( - f"producer_name: {producer.name}, producer_version: {producer.version_string}" + f"producer_name: {producer_metadata.name}, producer_version: {producer_metadata.version_string}" ) - for category in symbol_table.metadata._json_data: - vollog.debug(f"{category}:") - for subkey in symbol_table.metadata._json_data[category]: - subkey_item = ", ".join( - f"{key}: '{value}'" for key, value in subkey.items() - ) - vollog.debug(f"\t{subkey_item}") + + symbol_metadata = symbol_table.metadata + vollog.debug("Types:") + for types_source_dict in symbol_metadata.get_types_sources(): + vollog.debug(f"\t{types_source_dict}") + + vollog.debug("Symbols:") + for symbol_source_dict in symbol_metadata.get_symbols_sources(): + vollog.debug(f"\t{symbol_source_dict}") break else: diff --git a/volatility3/framework/symbols/metadata.py b/volatility3/framework/symbols/metadata.py index 39ddd6544..02e9cc489 100644 --- a/volatility3/framework/symbols/metadata.py +++ b/volatility3/framework/symbols/metadata.py @@ -4,8 +4,7 @@ import datetime import logging -from typing import Optional, Tuple, Union - +from typing import Optional, Tuple, Union, List, Dict from volatility3.framework import constants, interfaces vollog = logging.getLogger(__name__) @@ -86,9 +85,21 @@ class WindowsMetadata(interfaces.symbols.MetadataInterface): return self._json_data.get("pdb", {}).get("age", None) -class LinuxMetadata(interfaces.symbols.MetadataInterface): +class DwarfMetadata(interfaces.symbols.MetadataInterface): + """Base class to handle metadata of DWARF-based ISF sources""" + + def get_types_sources(self) -> List[Optional[Dict]]: + """Returns the types sources metadata""" + return self._json_data.get("types", []) + + def get_symbols_sources(self) -> List[Optional[Dict]]: + """Returns the symbols sources metadata""" + return self._json_data.get("symbols", []) + + +class LinuxMetadata(DwarfMetadata): """Class to handle the metadata from a Linux symbol table.""" -class MacMetadata(interfaces.symbols.MetadataInterface): +class MacMetadata(DwarfMetadata): """Class to handle the metadata from a Mac symbol table.""" From 77778ee6f6cfaa9a9af1d73a225c67a8836727c7 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 29 Nov 2024 19:35:18 +1100 Subject: [PATCH 05/11] Linux/Mac: ISF metadata: Rename s/DWARF/POSIX/, as I'm not happy with the generic name. BTF source could potentially generate the same keys --- volatility3/framework/symbols/metadata.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/symbols/metadata.py b/volatility3/framework/symbols/metadata.py index 02e9cc489..73ad2cf21 100644 --- a/volatility3/framework/symbols/metadata.py +++ b/volatility3/framework/symbols/metadata.py @@ -85,8 +85,8 @@ class WindowsMetadata(interfaces.symbols.MetadataInterface): return self._json_data.get("pdb", {}).get("age", None) -class DwarfMetadata(interfaces.symbols.MetadataInterface): - """Base class to handle metadata of DWARF-based ISF sources""" +class PosixMetadata(interfaces.symbols.MetadataInterface): + """Base class to handle metadata of Posix-based ISF sources""" def get_types_sources(self) -> List[Optional[Dict]]: """Returns the types sources metadata""" @@ -97,9 +97,9 @@ class DwarfMetadata(interfaces.symbols.MetadataInterface): return self._json_data.get("symbols", []) -class LinuxMetadata(DwarfMetadata): +class LinuxMetadata(PosixMetadata): """Class to handle the metadata from a Linux symbol table.""" -class MacMetadata(DwarfMetadata): +class MacMetadata(PosixMetadata): """Class to handle the metadata from a Mac symbol table.""" From 0030129ff8b440f8f3e43870f87d697b3847baa6 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 29 Nov 2024 08:43:04 +0000 Subject: [PATCH 06/11] Make suggested fixes to reduce loops and ignore insane sections --- .../framework/plugins/linux/vmayarascan.py | 25 +++++++++-------- .../framework/plugins/windows/vadyarascan.py | 28 ++++++++++++------- 2 files changed, 31 insertions(+), 22 deletions(-) diff --git a/volatility3/framework/plugins/linux/vmayarascan.py b/volatility3/framework/plugins/linux/vmayarascan.py index 3d8eb603b..89210be69 100644 --- a/volatility3/framework/plugins/linux/vmayarascan.py +++ b/volatility3/framework/plugins/linux/vmayarascan.py @@ -71,20 +71,21 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): # get the proc_layer object from the context proc_layer = self.context.layers[proc_layer_name] - vma_maps = list(self.get_vma_maps(task)) - insane_vma_maps = [ - start for (start, size) in vma_maps if size > sanity_check - ] - for start in insane_vma_maps: - vollog.debug(f"VMA at 0x{start:x} over sanity-check size, not scanning") + max_vma_size = 0 + vma_maps_to_scan = [] + for start, size in self.get_vma_maps(task): + if size > sanity_check: + vollog.debug( + f"VMA at 0x{start:x} over sanity-check size, not scanning" + ) + continue + max_vma_size = max(max_vma_size, size) + vma_maps_to_scan.append((start, size)) - if not vma_maps: - vollog.warning(f"No VMAs were found for task {task.pid}, aborting") + if not vma_maps_to_scan: + vollog.warning(f"No VMAs were found for task {task.tgid}, not scanning") continue - max_vma_size: int = max( - [size for (start, size) in vma_maps if size <= sanity_check] - ) scanner = yarascan.YaraScanner(rules=rules) scanner.chunk_size = max_vma_size @@ -92,7 +93,7 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): for offset, rule_name, name, value in proc_layer.scan( context=self.context, scanner=scanner, - sections=vma_maps, + sections=vma_maps_to_scan, ): yield 0, ( format_hints.Hex(offset), diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py index 65006bdc2..a67b8dc0b 100644 --- a/volatility3/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -70,16 +70,24 @@ class VadYaraScan(interfaces.plugins.PluginInterface): layer_name = task.add_process_layer() layer = self.context.layers[layer_name] - vad_maps = list(self.get_vad_maps(task)) - insane_vad_maps = [ - start for (start, size) in vad_maps if size > sanity_check - ] - for start in insane_vad_maps: - vollog.debug(f"VAD at 0x{start:x} over sanity-check size, not scanning") + max_vad_size = 0 + vad_maps_to_scan = [] + + for start, size in self.get_vad_maps(task): + if size > sanity_check: + vollog.debug( + f"VAD at 0x{start:x} over sanity-check size, not scanning" + ) + continue + max_vad_size = max(max_vad_size, size) + vad_maps_to_scan.append((start, size)) + + if not vad_maps_to_scan: + vollog.warning( + f"No VADs were found for task {task.UniqueProcessID}, not scanning" + ) + continue - max_vad_size: int = max( - [size for (start, size) in vad_maps if size <= sanity_check] - ) scanner = yarascan.YaraScanner(rules=rules) scanner.chunk_size = max_vad_size @@ -87,7 +95,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface): for offset, rule_name, name, value in layer.scan( context=self.context, scanner=scanner, - sections=vad_maps, + sections=vad_maps_to_scan, ): yield 0, ( format_hints.Hex(offset), From 393db1050f7df14d39c6f71bc0782e5422ed3188 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 29 Nov 2024 08:51:06 +0000 Subject: [PATCH 07/11] Windows: protect again mz_offsets being None --- volatility3/framework/automagic/pdbscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/automagic/pdbscan.py b/volatility3/framework/automagic/pdbscan.py index 3751b383e..0b4f6c73a 100644 --- a/volatility3/framework/automagic/pdbscan.py +++ b/volatility3/framework/automagic/pdbscan.py @@ -272,7 +272,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): for kernel in kernels: vollog.log( constants.LOGLEVEL_VVVV, - f"Testing potential kernel for {kernel.get('pdb_name', 'Unknown')} at {kernel.get('signature_offset', -1):x} with MZ offset at {kernel.get('mz_offset', -1):x}", + f"Testing potential kernel for {kernel.get('pdb_name', 'Unknown')} at {kernel.get('signature_offset', -1):x} with MZ offset at {(kernel.get('mz_offset', -1) or -1):x}", ) valid_kernel = test_kernel(physical_layer_name, virtual_layer_name, kernel) if valid_kernel is not None: From 3df385369cbd2489f8e057b616e98a83b79cf397 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 30 Nov 2024 11:28:09 +0000 Subject: [PATCH 08/11] Ensure the VAD/VMA gets scanned in a single block --- .../framework/plugins/linux/vmayarascan.py | 28 ++++++++++--------- .../framework/plugins/windows/vadyarascan.py | 25 ++++++++--------- 2 files changed, 27 insertions(+), 26 deletions(-) diff --git a/volatility3/framework/plugins/linux/vmayarascan.py b/volatility3/framework/plugins/linux/vmayarascan.py index 89210be69..8dd64404d 100644 --- a/volatility3/framework/plugins/linux/vmayarascan.py +++ b/volatility3/framework/plugins/linux/vmayarascan.py @@ -36,6 +36,9 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): requirements.PluginRequirement( name="yarascan", plugin=yarascan.YaraScan, version=(2, 0, 0) ), + requirements.VersionRequirement( + name="yarascanner", component=yarascan.YaraScanner, version=(2, 0, 0) + ), requirements.ModuleRequirement( name="kernel", description="Linux kernel", @@ -89,19 +92,18 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): scanner = yarascan.YaraScanner(rules=rules) scanner.chunk_size = max_vma_size - # scan the process layer with the yarascanner - for offset, rule_name, name, value in proc_layer.scan( - context=self.context, - scanner=scanner, - sections=vma_maps_to_scan, - ): - yield 0, ( - format_hints.Hex(offset), - task.tgid, - rule_name, - name, - value, - ) + # scan the VMA data (in one contiguous block) with the yarascanner + for start, size in vma_maps_to_scan: + for offset, rule_name, name, value in scanner( + proc_layer.read(start, size, pad=True), start + ): + yield 0, ( + format_hints.Hex(offset), + task.tgid, + rule_name, + name, + value, + ) @staticmethod def get_vma_maps( diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py index a67b8dc0b..2e9cc44ea 100644 --- a/volatility3/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -91,19 +91,18 @@ class VadYaraScan(interfaces.plugins.PluginInterface): scanner = yarascan.YaraScanner(rules=rules) scanner.chunk_size = max_vad_size - # scan the process layer with the yarascanner - for offset, rule_name, name, value in layer.scan( - context=self.context, - scanner=scanner, - sections=vad_maps_to_scan, - ): - yield 0, ( - format_hints.Hex(offset), - task.UniqueProcessId, - rule_name, - name, - value, - ) + # scan the VAD data (in one contiguous block) with the yarascanner + for start, size in vad_maps_to_scan: + for offset, rule_name, name, value in scanner( + layer.read(start, size, pad=True), start + ): + yield 0, ( + format_hints.Hex(offset), + task.UniqueProcessId, + rule_name, + name, + value, + ) @staticmethod def get_vad_maps( From 56f6ef0add6d73ecebeb41837a69627f960e8b0d Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 30 Nov 2024 11:52:16 +0000 Subject: [PATCH 09/11] Include a test developed by @gcmoreira and @eve-mem --- test/test_volatility.py | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/test/test_volatility.py b/test/test_volatility.py index 847be88d9..ea9ad8211 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -14,6 +14,7 @@ import tempfile import hashlib import ntpath import json +import contextlib # # HELPER FUNCTIONS @@ -378,6 +379,42 @@ def test_linux_library_list(image, volatility, python): assert out.count(b"\n") >= 2677 assert rc == 0 +def test_linux_vmayarascan_yara_rule(image, volatility, python): + yara_rule_01 = r""" + rule fullvmayarascan + { + strings: + $s1 = "_nss_files_parse_grent" + $s2 = "/lib64/ld-linux-x86-64.so.2" + $s3 = "(bufferend - (char *) 0) % sizeof (char *) == 0" + condition: + all of them + } + """ + + # FIXME: When the minimum Python version includes 3.12, replace the following with: + # with tempfile.NamedTemporaryFile(delete_on_close=False) as fd: ... + fd, filename = tempfile.mkstemp(suffix=".yar") + try: + with os.fdopen(fd, "w") as f: + f.write(yara_rule_01) + + rc, out, _err = runvol_plugin( + "linux.vmayarascan.VmaYaraScan", + image, + volatility, + python, + pluginargs=["--pid", "8600", "--yara-file", filename], + ) + finally: + with contextlib.suppress(FileNotFoundError): + os.remove(filename) + + out = out.lower() + assert out.count(b"\n") > 4 + assert rc == 0 + + # MAC From 2dc168628936ffcc334c1de37c024dc3d0fd7ff6 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 30 Nov 2024 13:36:14 +0000 Subject: [PATCH 10/11] Windows: Protect the SERICE_RECORD is_valid function a little more The request to .Order could fail depending on where the structure lies in memory. --- .../symbols/windows/extensions/services.py | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/services.py b/volatility3/framework/symbols/windows/extensions/services.py index e14de761d..0a2194e07 100644 --- a/volatility3/framework/symbols/windows/extensions/services.py +++ b/volatility3/framework/symbols/windows/extensions/services.py @@ -14,13 +14,16 @@ class SERVICE_RECORD(objects.StructType): def is_valid(self) -> bool: """Determine if the structure is valid.""" - if self.Order < 0 or self.Order > 0xFFFF: - return False - try: - _ = self.State.description - _ = self.Start.description - except ValueError: + if self.Order < 0 or self.Order > 0xFFFF: + return False + + try: + _ = self.State.description + _ = self.Start.description + except ValueError: + return False + except exceptions.InvalidAddressException: return False return True From d404747de5ce622ac1907199ed48b4f9905f2bbc Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 1 Dec 2024 00:04:46 +0000 Subject: [PATCH 11/11] Tests: Add in vadyarascan tests --- test/test_volatility.py | 58 +++++++++++++++++++++++++++++++++++++++-- 1 file changed, 56 insertions(+), 2 deletions(-) diff --git a/test/test_volatility.py b/test/test_volatility.py index ea9ad8211..371dd281c 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -197,7 +197,7 @@ def test_windows_thrdscan(image, volatility, python): assert out.find(b"\t4\t8") != -1 assert out.find(b"\t4\t12") != -1 assert out.find(b"\t4\t16") != -1 - #assert out.find(b"this raieses AssertionError") != -1 + # assert out.find(b"this raieses AssertionError") != -1 assert rc == 0 @@ -274,6 +274,59 @@ def test_windows_devicetree(image, volatility, python): assert rc == 0 +def test_windows_vadyarascan_yara_rule(image, volatility, python): + yara_rule_01 = r""" + rule fullvadyarascan + { + strings: + $s1 = "!This program cannot be run in DOS mode." + $s2 = "Qw))Pw" + $s3 = "W_wD)Pw" + $s4 = "1Xw+2Xw" + $s5 = "xd`wh``w" + $s6 = "0g`w0g`w8g`w8g`w@g`w@g`wHg`wHg`wPg`wPg`wXg`wXg`w`g`w`g`whg`whg`wpg`wpg`wxg`wxg`w" + condition: + all of them + } + """ + + # FIXME: When the minimum Python version includes 3.12, replace the following with: + # with tempfile.NamedTemporaryFile(delete_on_close=False) as fd: ... + fd, filename = tempfile.mkstemp(suffix=".yar") + try: + with os.fdopen(fd, "w") as f: + f.write(yara_rule_01) + + rc, out, _err = runvol_plugin( + "windows.vadyarascan.VadYaraScan", + image, + volatility, + python, + pluginargs=["--pid", "4012", "--yara-file", filename], + ) + finally: + with contextlib.suppress(FileNotFoundError): + os.remove(filename) + + out = out.lower() + assert out.count(b"\n") > 4 + assert rc == 0 + + +def test_windows_vadyarascan(image, volatility, python): + rc, out, _err = runvol_plugin( + "windows.vadyarascan.VadYaraScan", + image, + volatility, + python, + pluginargs=["--pid", "4012", "--yara-string", "MZ"], + ) + out = out.lower() + + assert out.count(b"\n") > 10 + assert rc == 0 + + # LINUX @@ -342,6 +395,7 @@ def test_linux_tty_check(image, volatility, python): assert out.count(b"\n") >= 5 assert rc == 0 + def test_linux_sockstat(image, volatility, python): rc, out, err = runvol_plugin("linux.sockstat.Sockstat", image, volatility, python) @@ -379,6 +433,7 @@ def test_linux_library_list(image, volatility, python): assert out.count(b"\n") >= 2677 assert rc == 0 + def test_linux_vmayarascan_yara_rule(image, volatility, python): yara_rule_01 = r""" rule fullvmayarascan @@ -415,7 +470,6 @@ def test_linux_vmayarascan_yara_rule(image, volatility, python): assert rc == 0 - # MAC