WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-22 09:34:52 +02:00
Code Issues Packages Projects Releases Wiki Activity

run yapf on the newly added files

Browse Source
This commit is contained in:
iMHLv2
2021-06-01 14:27:20 -05:00
parent 7b73f8d545
commit 7d9c66c407
3 changed files with 67 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/layers/crash.py
+17 -17
View File
@@ -29,7 +29,7 @@ class WindowsCrashDump32Layer(segmented.SegmentedLayer):
VALIDDUMP = 0x504d5544
crashdump_json = 'crash'
supported_dumptypes = [0x01, 0x05] # we need 0x5 for 32-bit bitmaps
supported_dumptypes = [0x01, 0x05] # we need 0x5 for 32-bit bitmaps
dump_header_name = '_DUMP_HEADER'
_magic_struct = struct.Struct('<II')
@@ -49,10 +49,11 @@ class WindowsCrashDump32Layer(segmented.SegmentedLayer):
self.crashdump_json)
# the _SUMMARY_DUMP is shared between 32- and 64-bit
self._crash_common_table_name = intermed.IntermediateSymbolTable.create(context, self._config_path,
self._crash_common_table_name = intermed.IntermediateSymbolTable.create(context,
self._config_path,
'windows',
'crash_common',
class_types=crash.class_types)
class_types = crash.class_types)
# Check Header
hdr_layer = self._context.layers[self._base_layer]
@@ -77,13 +78,13 @@ class WindowsCrashDump32Layer(segmented.SegmentedLayer):
def get_header(self) -> interfaces.objects.ObjectInterface:
return self.context.object(self._crash_table_name + constants.BANG + self.dump_header_name,
offset=0,
layer_name=self._base_layer)
offset = 0,
layer_name = self._base_layer)
def get_summary_header(self) -> interfaces.objects.ObjectInterface:
return self.context.object(self._crash_common_table_name + constants.BANG + "_SUMMARY_DUMP",
offset=0x1000 * self.headerpages,
layer_name=self._base_layer)
offset = 0x1000 * self.headerpages,
layer_name = self._base_layer)
def _load_segments(self) -> None:
"""Loads up the segments from the meta_layer."""
@@ -92,13 +93,14 @@ class WindowsCrashDump32Layer(segmented.SegmentedLayer):
if self.dump_type == 0x1:
header = self.context.object(self._crash_table_name + constants.BANG + self.dump_header_name,
offset=0,
layer_name=self._base_layer)
offset = 0,
layer_name = self._base_layer)
offset = self.headerpages
header.PhysicalMemoryBlockBuffer.Run.count = header.PhysicalMemoryBlockBuffer.NumberOfRuns
for run in header.PhysicalMemoryBlockBuffer.Run:
segments.append((run.BasePage * 0x1000, offset * 0x1000, run.PageCount * 0x1000, run.PageCount * 0x1000))
segments.append(
(run.BasePage * 0x1000, offset * 0x1000, run.PageCount * 0x1000, run.PageCount * 0x1000))
offset += run.PageCount
elif self.dump_type == 0x05:
@@ -150,18 +152,17 @@ class WindowsCrashDump32Layer(segmented.SegmentedLayer):
# report the segments for debugging. this is valuable for dev/troubleshooting but
# not important enough for a dedicated plugin.
for idx, (start_position, mapped_offset, length, _) in enumerate(segments):
vollog.log(constants.LOGLEVEL_VVVV,
"Segment {}: Position {:#x} Offset {:#x} Length {:#x}".format(idx,
start_position,
mapped_offset,
length))
vollog.log(
constants.LOGLEVEL_VVVV,
"Segment {}: Position {:#x} Offset {:#x} Length {:#x}".format(idx, start_position, mapped_offset,
length))
self._segments = segments
@classmethod
def check_header(cls, base_layer: interfaces.layers.DataLayerInterface, offset: int = 0) -> Tuple[int, int]:
# Verify the Window's crash dump file magic
try:
header_data = base_layer.read(offset, cls._magic_struct.size)
except exceptions.InvalidAddressException:
@@ -209,4 +210,3 @@ class WindowsCrashDumpStacker(interfaces.automagic.StackerLayerInterface):
except WindowsCrashDumpFormatException:
pass
return None
volatility3/framework/plugins/windows/crashinfo.py
+43 -40
View File
@@ -12,6 +12,7 @@ from volatility3.framework.layers import crash
vollog = logging.getLogger(__name__)
class Crashinfo(interfaces.plugins.PluginInterface):
_required_framework_version = (1, 0, 0)
@@ -20,12 +21,12 @@ class Crashinfo(interfaces.plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
]
architectures = ["Intel32", "Intel64"]),
]
def _generator(self, layer: crash.WindowsCrashDump32Layer):
header = layer.get_header()
uptime = datetime.timedelta(microseconds=int(header.SystemUpTime) / 10)
uptime = datetime.timedelta(microseconds = int(header.SystemUpTime) / 10)
if header.DumpType == 0x1:
dump_type = "Full Dump (0x1)"
@@ -43,24 +44,25 @@ class Crashinfo(interfaces.plugins.PluginInterface):
else:
bitmap_header_size = bitmap_size = bitmap_pages = renderers.NotApplicableValue()
yield(0, (utility.array_to_string(header.Signature),
header.MajorVersion,
header.MinorVersion,
format_hints.Hex(header.DirectoryTableBase),
format_hints.Hex(header.PfnDataBase),
format_hints.Hex(header.PsLoadedModuleList),
format_hints.Hex(header.PsActiveProcessHead),
header.MachineImageType,
header.NumberProcessors,
format_hints.Hex(header.KdDebuggerDataBlock),
dump_type,
str(uptime),
utility.array_to_string(header.Comment),
conversion.wintime_to_datetime(header.SystemTime),
bitmap_header_size,
bitmap_size,
bitmap_pages,
))
yield (0, (
utility.array_to_string(header.Signature),
header.MajorVersion,
header.MinorVersion,
format_hints.Hex(header.DirectoryTableBase),
format_hints.Hex(header.PfnDataBase),
format_hints.Hex(header.PsLoadedModuleList),
format_hints.Hex(header.PsActiveProcessHead),
header.MachineImageType,
header.NumberProcessors,
format_hints.Hex(header.KdDebuggerDataBlock),
dump_type,
str(uptime),
utility.array_to_string(header.Comment),
conversion.wintime_to_datetime(header.SystemTime),
bitmap_header_size,
bitmap_size,
bitmap_pages,
))
def run(self):
crash_layer = None
@@ -74,21 +76,22 @@ class Crashinfo(interfaces.plugins.PluginInterface):
vollog.error("This plugin requires a Windows crash dump")
raise
return renderers.TreeGrid([("Signature", str),
("MajorVersion", int),
("MinorVersion", int),
("DirectoryTableBase", format_hints.Hex),
("PfnDataBase", format_hints.Hex),
("PsLoadedModuleList", format_hints.Hex),
("PsActiveProcessHead", format_hints.Hex),
("MachineImageType", int),
("NumberProcessors", int),
("KdDebuggerDataBlock", format_hints.Hex),
("DumpType", str),
("SystemUpTime", str),
("Comment", str),
("SystemTime", datetime.datetime),
("BitmapHeaderSize", format_hints.Hex),
("BitmapSize", format_hints.Hex),
("BitmapPages", format_hints.Hex),
], self._generator(crash_layer))
return renderers.TreeGrid([
("Signature", str),
("MajorVersion", int),
("MinorVersion", int),
("DirectoryTableBase", format_hints.Hex),
("PfnDataBase", format_hints.Hex),
("PsLoadedModuleList", format_hints.Hex),
("PsActiveProcessHead", format_hints.Hex),
("MachineImageType", int),
("NumberProcessors", int),
("KdDebuggerDataBlock", format_hints.Hex),
("DumpType", str),
("SystemUpTime", str),
("Comment", str),
("SystemTime", datetime.datetime),
("BitmapHeaderSize", format_hints.Hex),
("BitmapSize", format_hints.Hex),
("BitmapPages", format_hints.Hex),
], self._generator(crash_layer))
volatility3/framework/symbols/windows/extensions/crash.py
+7 -7
View File
@@ -11,17 +11,17 @@ class SUMMARY_DUMP(objects.StructType):
def get_buffer(self, sub_type: str, count: int) -> interfaces.objects.ObjectInterface:
symbol_table_name = self.get_symbol_table_name()
subtype = self._context.symbol_space.get_type(symbol_table_name + constants.BANG + sub_type)
return self._context.object(object_type=symbol_table_name + constants.BANG + "array",
layer_name=self.vol.layer_name,
offset=self.BufferChar.vol.offset,
count=count,
subtype=subtype)
return self._context.object(object_type = symbol_table_name + constants.BANG + "array",
layer_name = self.vol.layer_name,
offset = self.BufferChar.vol.offset,
count = count,
subtype = subtype)
def get_buffer_char(self) -> interfaces.objects.ObjectInterface:
return self.get_buffer(sub_type="unsigned char", count=(self.BitmapSize + 7) // 8)
return self.get_buffer(sub_type = "unsigned char", count = (self.BitmapSize + 7) // 8)
def get_buffer_long(self) -> interfaces.objects.ObjectInterface:
return self.get_buffer(sub_type="unsigned long", count=(self.BitmapSize + 31) // 32)
return self.get_buffer(sub_type = "unsigned long", count = (self.BitmapSize + 31) // 32)
class_types = {'_SUMMARY_DUMP': SUMMARY_DUMP}