diff --git a/volatility/framework/plugins/windows/info.py b/volatility/framework/plugins/windows/info.py index 7159d1fee..bc0235440 100644 --- a/volatility/framework/plugins/windows/info.py +++ b/volatility/framework/plugins/windows/info.py @@ -25,8 +25,9 @@ from volatility.framework.interfaces import plugins from volatility.framework import constants, interfaces, layers from volatility.framework.configuration import requirements from volatility.framework.renderers import TreeGrid -from volatility.framework.symbols.windows.kdbg import KdbgIntermedSymbols -from volatility.framework.symbols.windows.pe import PEIntermedSymbols +from volatility.framework.symbols import intermed +from volatility.framework.symbols.windows import extensions +from volatility.framework.symbols.windows.extensions import kdbg class Info(plugins.PluginInterface): @@ -66,10 +67,16 @@ class Info(plugins.PluginInterface): native_types = self.context.symbol_space[self.config["nt_symbols"]].natives - kdbg_table_name = KdbgIntermedSymbols.create( - self.context, self.config_path, "windows", "kdbg", native_types = native_types) + kdbg_table_name = intermed.IntermediateSymbolTable.create( + self.context, + self.config_path, + "windows", + "kdbg", + native_types = native_types, + class_types = extensions.kdbg.class_types) - pe_table_name = PEIntermedSymbols.create(self.context, self.config_path, "windows", "pe") + pe_table_name = intermed.IntermediateSymbolTable.create( + self.context, self.config_path, "windows", "pe", class_types = extensions.pe.class_types) kvo = virtual_layer.config["kernel_virtual_offset"] diff --git a/volatility/framework/plugins/windows/moddump.py b/volatility/framework/plugins/windows/moddump.py index 124243c65..f25839f76 100644 --- a/volatility/framework/plugins/windows/moddump.py +++ b/volatility/framework/plugins/windows/moddump.py @@ -21,21 +21,19 @@ import logging from typing import List, Generator, Iterable -import volatility.framework.constants as constants -import volatility.framework.exceptions as exceptions -import volatility.framework.interfaces.plugins as interfaces_plugins -import volatility.framework.renderers as renderers -import volatility.plugins.windows.modules as modules -import volatility.plugins.windows.pslist as pslist +from volatility.plugins.windows import pslist, modules + +from volatility.framework import constants, exceptions, renderers from volatility.framework import interfaces from volatility.framework.configuration import requirements from volatility.framework.renderers import format_hints -from volatility.framework.symbols.windows.pe import PEIntermedSymbols +from volatility.framework.symbols import intermed +from volatility.framework.symbols.windows.extensions import pe vollog = logging.getLogger(__name__) -class ModDump(interfaces_plugins.PluginInterface): +class ModDump(interfaces.plugins.PluginInterface): """Dumps kernel modules""" @classmethod @@ -108,7 +106,8 @@ class ModDump(interfaces_plugins.PluginInterface): def _generator(self, mods): session_layers = list(self.get_session_layers(self.context, self.config['primary'], self.config['nt_symbols'])) - pe_table_name = PEIntermedSymbols.create(self.context, self.config_path, "windows", "pe") + pe_table_name = intermed.IntermediateSymbolTable.create( + self.context, self.config_path, "windows", "pe", class_types = pe.class_types) for mod in mods: try: @@ -126,7 +125,7 @@ class ModDump(interfaces_plugins.PluginInterface): offset = mod.DllBase, layer_name = session_layer_name) - filedata = interfaces_plugins.FileInterface("module.{0:#x}.dmp".format(mod.DllBase)) + filedata = interfaces.plugins.FileInterface("module.{0:#x}.dmp".format(mod.DllBase)) for offset, data in dos_header.reconstruct(): filedata.data.seek(offset) diff --git a/volatility/framework/plugins/windows/procdump.py b/volatility/framework/plugins/windows/procdump.py index 6b34c5505..202ceec01 100644 --- a/volatility/framework/plugins/windows/procdump.py +++ b/volatility/framework/plugins/windows/procdump.py @@ -29,7 +29,9 @@ import volatility.plugins.windows.pslist as pslist from volatility.framework import interfaces from volatility.framework.configuration import requirements from volatility.framework.objects import utility -from volatility.framework.symbols.windows.pe import PEIntermedSymbols +from volatility.framework.symbols.windows.extensions import pe + +from volatility.framework.symbols import intermed vollog = logging.getLogger(__name__) @@ -48,7 +50,8 @@ class ProcDump(interfaces_plugins.PluginInterface): def _generator(self, procs): - pe_table_name = PEIntermedSymbols.create(self.context, self.config_path, "windows", "pe") + pe_table_name = intermed.IntermediateSymbolTable.create( + self.context, self.config_path, "windows", "pe", class_types = pe.class_types) for proc in procs: process_name = utility.array_to_string(proc.ImageFileName) diff --git a/volatility/framework/symbols/windows/extensions/kdbg.py b/volatility/framework/symbols/windows/extensions/kdbg.py index ea1db9c07..4ae8b8aaf 100644 --- a/volatility/framework/symbols/windows/extensions/kdbg.py +++ b/volatility/framework/symbols/windows/extensions/kdbg.py @@ -47,3 +47,6 @@ class _KDDEBUGGER_DATA64(objects.Struct): symbol_table_name + constants.BANG + "unsigned long", layer_name = layer_name, offset = self.CmNtCSDVersion) return (csdresult >> 8) & 0xffffffff + + +class_types = {'_KDDEBUGGER_DATA64': _KDDEBUGGER_DATA64} diff --git a/volatility/framework/symbols/windows/extensions/pe.py b/volatility/framework/symbols/windows/extensions/pe.py index 48e5ee027..55c03c5ae 100644 --- a/volatility/framework/symbols/windows/extensions/pe.py +++ b/volatility/framework/symbols/windows/extensions/pe.py @@ -183,3 +183,11 @@ class _IMAGE_NT_HEADERS(objects.Struct): symbol_table_name + constants.BANG + "_IMAGE_SECTION_HEADER", offset = sect_addr, layer_name = layer_name) + + +class_types = { + '_IMAGE_DOS_HEADER': _IMAGE_DOS_HEADER, + # the 32- and 64-bit extensions behave the same way, but the underlying structure is different + '_IMAGE_NT_HEADERS': _IMAGE_NT_HEADERS, + '_IMAGE_NT_HEADERS64': _IMAGE_NT_HEADERS +} diff --git a/volatility/framework/symbols/windows/extensions/registry.py b/volatility/framework/symbols/windows/extensions/registry.py index c8d2a1607..e0677098a 100644 --- a/volatility/framework/symbols/windows/extensions/registry.py +++ b/volatility/framework/symbols/windows/extensions/registry.py @@ -25,6 +25,7 @@ from typing import Optional, Iterable, Union from volatility.framework import constants, exceptions, objects, interfaces from volatility.framework.layers.registry import RegistryHive +from volatility.framework.symbols import intermed vollog = logging.getLogger(__name__) diff --git a/volatility/framework/symbols/windows/kdbg.py b/volatility/framework/symbols/windows/kdbg.py deleted file mode 100644 index 0402369a8..000000000 --- a/volatility/framework/symbols/windows/kdbg.py +++ /dev/null @@ -1,28 +0,0 @@ -# This file was contributed to the Volatility Framework Version 3. -# Copyright (C) 2018 Volatility Foundation. -# -# THE LICENSED WORK IS PROVIDED UNDER THE TERMS OF THE Volatility Contributors -# Public License V1.0("LICENSE") AS FIRST COMPLETED BY: Volatility Foundation, -# Inc. ANY USE, PUBLIC DISPLAY, PUBLIC PERFORMANCE, REPRODUCTION OR DISTRIBUTION -# OF, OR PREPARATION OF SUBSEQUENT WORKS, DERIVATIVE WORKS OR DERIVED WORKS BASED -# ON, THE LICENSED WORK CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS LICENSE AND ITS -# TERMS, WHETHER OR NOT SUCH RECIPIENT READS THE TERMS OF THE LICENSE. "LICENSED -# WORK,” “RECIPIENT" AND “DISTRIBUTOR" ARE DEFINED IN THE LICENSE. A COPY OF THE -# LICENSE IS LOCATED IN THE TEXT FILE ENTITLED "LICENSE.txt" ACCOMPANYING THE -# CONTENTS OF THIS FILE. IF A COPY OF THE LICENSE DOES NOT ACCOMPANY THIS FILE, A -# COPY OF THE LICENSE MAY ALSO BE OBTAINED AT THE FOLLOWING WEB SITE: -# https://www.volatilityfoundation.org/license/vcpl_v1.0 -# -# Software distributed under the License is distributed on an "AS IS" basis, -# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License for the -# specific language governing rights and limitations under the License. -# - -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows.extensions import kdbg - - -class KdbgIntermedSymbols(intermed.IntermediateSymbolTable): - - def __init__(self, *args, **kwargs): - super().__init__(*args, **kwargs, class_types = {'_KDDEBUGGER_DATA64': kdbg._KDDEBUGGER_DATA64}) diff --git a/volatility/framework/symbols/windows/pe.py b/volatility/framework/symbols/windows/pe.py deleted file mode 100644 index 7337add50..000000000 --- a/volatility/framework/symbols/windows/pe.py +++ /dev/null @@ -1,36 +0,0 @@ -# This file was contributed to the Volatility Framework Version 3. -# Copyright (C) 2018 Volatility Foundation. -# -# THE LICENSED WORK IS PROVIDED UNDER THE TERMS OF THE Volatility Contributors -# Public License V1.0("LICENSE") AS FIRST COMPLETED BY: Volatility Foundation, -# Inc. ANY USE, PUBLIC DISPLAY, PUBLIC PERFORMANCE, REPRODUCTION OR DISTRIBUTION -# OF, OR PREPARATION OF SUBSEQUENT WORKS, DERIVATIVE WORKS OR DERIVED WORKS BASED -# ON, THE LICENSED WORK CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS LICENSE AND ITS -# TERMS, WHETHER OR NOT SUCH RECIPIENT READS THE TERMS OF THE LICENSE. "LICENSED -# WORK,” “RECIPIENT" AND “DISTRIBUTOR" ARE DEFINED IN THE LICENSE. A COPY OF THE -# LICENSE IS LOCATED IN THE TEXT FILE ENTITLED "LICENSE.txt" ACCOMPANYING THE -# CONTENTS OF THIS FILE. IF A COPY OF THE LICENSE DOES NOT ACCOMPANY THIS FILE, A -# COPY OF THE LICENSE MAY ALSO BE OBTAINED AT THE FOLLOWING WEB SITE: -# https://www.volatilityfoundation.org/license/vcpl_v1.0 -# -# Software distributed under the License is distributed on an "AS IS" basis, -# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License for the -# specific language governing rights and limitations under the License. -# - -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows.extensions import pe - - -class PEIntermedSymbols(intermed.IntermediateSymbolTable): - - def __init__(self, *args, **kwargs): - super().__init__( - *args, - **kwargs, - class_types = { - '_IMAGE_DOS_HEADER': pe._IMAGE_DOS_HEADER, - # the 32- and 64-bit extensions behave the same way, but the underlying structure is different - '_IMAGE_NT_HEADERS': pe._IMAGE_NT_HEADERS, - '_IMAGE_NT_HEADERS64': pe._IMAGE_NT_HEADERS - })