From baaedf21e51b33c9c3eee772296ebfd3b9dd9869 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Thu, 12 May 2022 19:37:30 +0900 Subject: [PATCH 01/22] Add: plugin version, logger, dump options --- .../plugins/windows/registry/certificates.py | 24 ++++++++++++------- 1 file changed, 16 insertions(+), 8 deletions(-) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index 91f17fb2d..81b7d766f 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -1,16 +1,19 @@ +import logging import struct from typing import List, Iterator, Tuple -from volatility3.framework import interfaces, renderers +from volatility3.framework import constants, interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.symbols.windows.extensions.registry import RegValueTypes from volatility3.plugins.windows.registry import hivelist, printkey +vollog = logging.getLogger(__name__) class Certificates(interfaces.plugins.PluginInterface): """Lists the certificates in the registry's Certificate Store.""" _required_framework_version = (2, 0, 0) + _version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -20,7 +23,11 @@ class Certificates(interfaces.plugins.PluginInterface): architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.PluginRequirement(name = 'hivelist', plugin = hivelist.HiveList, version = (1, 0, 0)), - requirements.PluginRequirement(name = 'printkey', plugin = printkey.PrintKey, version = (1, 0, 0)) + requirements.PluginRequirement(name = 'printkey', plugin = printkey.PrintKey, version = (1, 0, 0)), + requirements.BooleanRequirement(name = 'dump', + description = "Extract listed certificates", + default = False, + optional = True) ] def parse_data(self, data: bytes) -> Tuple[str, bytes]: @@ -48,21 +55,22 @@ class Certificates(interfaces.plugins.PluginInterface): try: # Walk it node_path = hive.get_key(top_key, return_list = True) - for (depth, is_key, last_write_time, key_path, volatility, - node) in printkey.PrintKey.key_iterator(hive, node_path, recurse = True): + for (_, is_key, _, key_path, _, node) in printkey.PrintKey.key_iterator(hive, node_path, recurse = True): if not is_key and RegValueTypes(node.Type).name == "REG_BINARY": name, certificate_data = self.parse_data(node.decode_data()) unique_key_offset = key_path.casefold().index(top_key.casefold()) + len(top_key) + 1 reg_section = key_path[unique_key_offset:key_path.index("\\", unique_key_offset)] key_hash = key_path[key_path.rindex("\\") + 1:] - if not isinstance(certificate_data, interfaces.renderers.BaseAbsentValue): - with self.open("{} - {} - {}.crt".format(hex(hive.hive_offset), reg_section, - key_hash)) as file_data: - file_data.write(certificate_data) + if self.config['dump']: + if not isinstance(certificate_data, interfaces.renderers.BaseAbsentValue): + with self.open("{} - {} - {}.crt".format(hex(hive.hive_offset), reg_section, + key_hash)) as file_data: + file_data.write(certificate_data) yield (0, (top_key, reg_section, key_hash, name)) except KeyError: # Key wasn't found in this hive, carry on + vollog.log(constants.LOGLEVEL_VVVV, "Key wasn't found in this hive") pass def run(self) -> renderers.TreeGrid: From dafd62d6cee5f8366e3071adfc80e1c910d301fa Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Thu, 12 May 2022 19:52:57 +0900 Subject: [PATCH 02/22] Fix: dump options for depreated step --- .../plugins/windows/registry/certificates.py | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index 81b7d766f..f261b5e36 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -41,6 +41,12 @@ class Certificates(interfaces.plugins.PluginInterface): elif ctype == 0x100000020: certificate_data = cvalue return (name, certificate_data) + + def dump_data(self, certificate_data: bytes, hive_offset: int, reg_section: str, key_hash: str) -> str: + if not isinstance(certificate_data, interfaces.renderers.BaseAbsentValue): + dump_name = "{} - {} - {}.crt".format(hive_offset, reg_section, key_hash) + with self.open(dump_name) as file_data: + file_data.write(certificate_data) def _generator(self) -> Iterator[Tuple[int, Tuple[str, str, str, str]]]: for hive in hivelist.HiveList.list_hives(self.context, @@ -63,10 +69,11 @@ class Certificates(interfaces.plugins.PluginInterface): key_hash = key_path[key_path.rindex("\\") + 1:] if self.config['dump']: - if not isinstance(certificate_data, interfaces.renderers.BaseAbsentValue): - with self.open("{} - {} - {}.crt".format(hex(hive.hive_offset), reg_section, - key_hash)) as file_data: - file_data.write(certificate_data) + self.dump_data(certificate_data, hive.hive_offset, reg_section, key_hash) + else: + vollog.warning("Certificates plugin is no longer support automatically dumped, please use the dump option.") + self.dump_data(certificate_data, hive.hive_offset, reg_section, key_hash) + yield (0, (top_key, reg_section, key_hash, name)) except KeyError: # Key wasn't found in this hive, carry on From f63f869506186d0396625d6232f9657ca1dad717 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Thu, 12 May 2022 20:23:42 +0900 Subject: [PATCH 03/22] Remove: return type of dump method --- volatility3/plugins/windows/registry/certificates.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index f261b5e36..ee9cba6d3 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -42,7 +42,7 @@ class Certificates(interfaces.plugins.PluginInterface): certificate_data = cvalue return (name, certificate_data) - def dump_data(self, certificate_data: bytes, hive_offset: int, reg_section: str, key_hash: str) -> str: + def dump_data(self, certificate_data: bytes, hive_offset: int, reg_section: str, key_hash: str): if not isinstance(certificate_data, interfaces.renderers.BaseAbsentValue): dump_name = "{} - {} - {}.crt".format(hive_offset, reg_section, key_hash) with self.open(dump_name) as file_data: From 0e8958b8416350ac9c22961674532e62b72050ec Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Mon, 16 May 2022 15:11:07 +0900 Subject: [PATCH 04/22] Fix: classmethod, variable name, exceptions, etc --- .../plugins/windows/registry/certificates.py | 33 +++++++++++-------- 1 file changed, 20 insertions(+), 13 deletions(-) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index ee9cba6d3..a27b3545a 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -1,8 +1,8 @@ import logging import struct -from typing import List, Iterator, Tuple +from typing import List, Iterator, Tuple, Type -from volatility3.framework import constants, interfaces, renderers +from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.symbols.windows.extensions.registry import RegValueTypes from volatility3.plugins.windows.registry import hivelist, printkey @@ -13,7 +13,6 @@ class Certificates(interfaces.plugins.PluginInterface): """Lists the certificates in the registry's Certificate Store.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -42,11 +41,20 @@ class Certificates(interfaces.plugins.PluginInterface): certificate_data = cvalue return (name, certificate_data) - def dump_data(self, certificate_data: bytes, hive_offset: int, reg_section: str, key_hash: str): - if not isinstance(certificate_data, interfaces.renderers.BaseAbsentValue): - dump_name = "{} - {} - {}.crt".format(hive_offset, reg_section, key_hash) - with self.open(dump_name) as file_data: - file_data.write(certificate_data) + @classmethod + def dump_certificate(cls, certificate_data: bytes, hive_offset: int, + reg_section: str, key_hash: str, + open_method: Type[interfaces.plugins.FileHandlerInterface]) -> \ + interfaces.plugins.FileHandlerInterface: + try: + if not isinstance(certificate_data, interfaces.renderers.BaseAbsentValue): + dump_name = "{} - {} - {}.crt".format(hive_offset, reg_section, key_hash) + with open_method(dump_name) as file_data: + file_data.write(certificate_data) + except exceptions.InvalidAddressException: + vollog.debug(f"Unable to certificate file at {hive_offset:#x}") + return None + def _generator(self) -> Iterator[Tuple[int, Tuple[str, str, str, str]]]: for hive in hivelist.HiveList.list_hives(self.context, @@ -61,7 +69,7 @@ class Certificates(interfaces.plugins.PluginInterface): try: # Walk it node_path = hive.get_key(top_key, return_list = True) - for (_, is_key, _, key_path, _, node) in printkey.PrintKey.key_iterator(hive, node_path, recurse = True): + for (_depth, is_key, _last_write_time, key_path, _volatility, node) in printkey.PrintKey.key_iterator(hive, node_path, recurse = True): if not is_key and RegValueTypes(node.Type).name == "REG_BINARY": name, certificate_data = self.parse_data(node.decode_data()) unique_key_offset = key_path.casefold().index(top_key.casefold()) + len(top_key) + 1 @@ -69,10 +77,9 @@ class Certificates(interfaces.plugins.PluginInterface): key_hash = key_path[key_path.rindex("\\") + 1:] if self.config['dump']: - self.dump_data(certificate_data, hive.hive_offset, reg_section, key_hash) - else: - vollog.warning("Certificates plugin is no longer support automatically dumped, please use the dump option.") - self.dump_data(certificate_data, hive.hive_offset, reg_section, key_hash) + file_handle = self.dump_certificate(certificate_data, hive.hive_offset, reg_section, key_hash, self.open) + if file_handle: + file_handle.close() yield (0, (top_key, reg_section, key_hash, name)) except KeyError: From 5770d35a4afd718760ddeeb1c21606e6b5bd1e2e Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Tue, 17 May 2022 00:18:06 +0900 Subject: [PATCH 05/22] Add: return file handle --- volatility3/plugins/windows/registry/certificates.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index a27b3545a..b079844e7 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -49,8 +49,9 @@ class Certificates(interfaces.plugins.PluginInterface): try: if not isinstance(certificate_data, interfaces.renderers.BaseAbsentValue): dump_name = "{} - {} - {}.crt".format(hive_offset, reg_section, key_hash) - with open_method(dump_name) as file_data: - file_data.write(certificate_data) + file_handle = open_method(dump_name) + file_handle.write(certificate_data) + return file_handle except exceptions.InvalidAddressException: vollog.debug(f"Unable to certificate file at {hive_offset:#x}") return None From 3846268bf7a8b3731a80a61959ca1aee227a112d Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Tue, 17 May 2022 00:19:39 +0900 Subject: [PATCH 06/22] Add: optional return type --- volatility3/plugins/windows/registry/certificates.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index b079844e7..d2fb61f02 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -1,6 +1,6 @@ import logging import struct -from typing import List, Iterator, Tuple, Type +from typing import List, Iterator, Optional, Tuple, Type from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements @@ -45,7 +45,7 @@ class Certificates(interfaces.plugins.PluginInterface): def dump_certificate(cls, certificate_data: bytes, hive_offset: int, reg_section: str, key_hash: str, open_method: Type[interfaces.plugins.FileHandlerInterface]) -> \ - interfaces.plugins.FileHandlerInterface: + Optional[interfaces.plugins.FileHandlerInterface]: try: if not isinstance(certificate_data, interfaces.renderers.BaseAbsentValue): dump_name = "{} - {} - {}.crt".format(hive_offset, reg_section, key_hash) From 6d7095fa3bf01aa4f2a9fceb1887cf28ed463e58 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Sat, 2 Jul 2022 19:30:00 +0900 Subject: [PATCH 07/22] Add: exceptions code --- .../plugins/windows/registry/certificates.py | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index d2fb61f02..e2fe662fc 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -17,10 +17,8 @@ class Certificates(interfaces.plugins.PluginInterface): @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ - requirements.TranslationLayerRequirement(name = 'primary', - description = 'Memory layer for the kernel', + requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.PluginRequirement(name = 'hivelist', plugin = hivelist.HiveList, version = (1, 0, 0)), requirements.PluginRequirement(name = 'printkey', plugin = printkey.PrintKey, version = (1, 0, 0)), requirements.BooleanRequirement(name = 'dump', @@ -58,10 +56,12 @@ class Certificates(interfaces.plugins.PluginInterface): def _generator(self) -> Iterator[Tuple[int, Tuple[str, str, str, str]]]: + kernel = self.context.modules[self.config['kernel']] + for hive in hivelist.HiveList.list_hives(self.context, base_config_path = self.config_path, - layer_name = self.config['primary'], - symbol_table = self.config['nt_symbols']): + layer_name = kernel.layer_name, + symbol_table = kernel.symbol_table_name): for top_key in [ "Microsoft\\SystemCertificates", @@ -87,6 +87,12 @@ class Certificates(interfaces.plugins.PluginInterface): # Key wasn't found in this hive, carry on vollog.log(constants.LOGLEVEL_VVVV, "Key wasn't found in this hive") pass + except exceptions.SwappedInvalidAddressException as exp: + vollog.log(constants.LOGLEVEL_VVVV, f"Required memory at {exp.invalid_address:#x} is inaccessible (swapped)") + pass + except exceptions.PagedInvalidAddressException as exp: + vollog.log(constants.LOGLEVEL_VVVV, f"Required memory at {exp.invalid_address:#x} is not valid (process exited?)") + pass def run(self) -> renderers.TreeGrid: return renderers.TreeGrid([("Certificate path", str), ("Certificate section", str), ("Certificate ID", str), From c40aecdfdacfde5ac17b658b581aa85595272b85 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Sat, 2 Jul 2022 19:38:12 +0900 Subject: [PATCH 08/22] Remove: invalid exceptions code --- volatility3/plugins/windows/registry/certificates.py | 3 --- 1 file changed, 3 deletions(-) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index e2fe662fc..e873fd1d6 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -90,9 +90,6 @@ class Certificates(interfaces.plugins.PluginInterface): except exceptions.SwappedInvalidAddressException as exp: vollog.log(constants.LOGLEVEL_VVVV, f"Required memory at {exp.invalid_address:#x} is inaccessible (swapped)") pass - except exceptions.PagedInvalidAddressException as exp: - vollog.log(constants.LOGLEVEL_VVVV, f"Required memory at {exp.invalid_address:#x} is not valid (process exited?)") - pass def run(self) -> renderers.TreeGrid: return renderers.TreeGrid([("Certificate path", str), ("Certificate section", str), ("Certificate ID", str), From ec78fe7d8dd015c8ebfc366a5937cebe2bf92b3e Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Mon, 4 Jul 2022 15:49:03 +0900 Subject: [PATCH 09/22] Fix: try/except/pass to contextlib.supress by #782 --- volatility3/plugins/windows/registry/certificates.py | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index e873fd1d6..429db96a6 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -1,3 +1,4 @@ +import contextlib import logging import struct from typing import List, Iterator, Optional, Tuple, Type @@ -67,7 +68,7 @@ class Certificates(interfaces.plugins.PluginInterface): "Microsoft\\SystemCertificates", "Software\\Microsoft\\SystemCertificates", ]: - try: + with contextlib.suppress(KeyError, exceptions.SwappedInvalidAddressException): # Walk it node_path = hive.get_key(top_key, return_list = True) for (_depth, is_key, _last_write_time, key_path, _volatility, node) in printkey.PrintKey.key_iterator(hive, node_path, recurse = True): @@ -83,13 +84,6 @@ class Certificates(interfaces.plugins.PluginInterface): file_handle.close() yield (0, (top_key, reg_section, key_hash, name)) - except KeyError: - # Key wasn't found in this hive, carry on - vollog.log(constants.LOGLEVEL_VVVV, "Key wasn't found in this hive") - pass - except exceptions.SwappedInvalidAddressException as exp: - vollog.log(constants.LOGLEVEL_VVVV, f"Required memory at {exp.invalid_address:#x} is inaccessible (swapped)") - pass def run(self) -> renderers.TreeGrid: return renderers.TreeGrid([("Certificate path", str), ("Certificate section", str), ("Certificate ID", str), From 837e1ef39df3f5db6422d541b163b47d8226bb83 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Sun, 7 Aug 2022 15:58:07 +0900 Subject: [PATCH 10/22] Fix: error handling for netstat plugin --- volatility3/framework/plugins/windows/netstat.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/netstat.py b/volatility3/framework/plugins/windows/netstat.py index 486957565..3051b950e 100644 --- a/volatility3/framework/plugins/windows/netstat.py +++ b/volatility3/framework/plugins/windows/netstat.py @@ -433,7 +433,8 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): self.context, interfaces.configuration.path_join(self.config_path, 'tcpip'), kernel.layer_name, "tcpip.pdb", tcpip_module.DllBase, tcpip_module.SizeOfImage) except exceptions.VolatilityException: - vollog.warning("Unable to locate symbols for the memory image's tcpip module") + vollog.error("Unable to locate symbols for the memory image's tcpip module") + raise for netw_obj in self.list_sockets(self.context, kernel.layer_name, kernel.symbol_table_name, netscan_symbol_table, tcpip_module.DllBase, tcpip_symbol_table): From a04cb4e031f0a0092aec57ff72c371485893dd66 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Sun, 7 Aug 2022 16:13:29 +0900 Subject: [PATCH 11/22] Fix: return syntax --- volatility3/framework/plugins/windows/netstat.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/netstat.py b/volatility3/framework/plugins/windows/netstat.py index 3051b950e..4d6ec5f62 100644 --- a/volatility3/framework/plugins/windows/netstat.py +++ b/volatility3/framework/plugins/windows/netstat.py @@ -434,7 +434,7 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): kernel.layer_name, "tcpip.pdb", tcpip_module.DllBase, tcpip_module.SizeOfImage) except exceptions.VolatilityException: vollog.error("Unable to locate symbols for the memory image's tcpip module") - raise + return for netw_obj in self.list_sockets(self.context, kernel.layer_name, kernel.symbol_table_name, netscan_symbol_table, tcpip_module.DllBase, tcpip_symbol_table): From 4f77be32a541563b35279dc7bfda7ee6a52ca853 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Sun, 7 Aug 2022 16:30:14 +0900 Subject: [PATCH 12/22] Remove: dump file namespace --- volatility3/plugins/windows/registry/certificates.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index 429db96a6..8ef5abcdd 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -47,7 +47,7 @@ class Certificates(interfaces.plugins.PluginInterface): Optional[interfaces.plugins.FileHandlerInterface]: try: if not isinstance(certificate_data, interfaces.renderers.BaseAbsentValue): - dump_name = "{} - {} - {}.crt".format(hive_offset, reg_section, key_hash) + dump_name = "{}-{}-{}.crt".format(hive_offset, reg_section, key_hash) file_handle = open_method(dump_name) file_handle.write(certificate_data) return file_handle From 0c8d4f75ae63a2396deceef229e1c4d2e26135f3 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Sun, 7 Aug 2022 16:57:43 +0900 Subject: [PATCH 13/22] Fix: wide exceptions --- volatility3/plugins/windows/registry/certificates.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index 8ef5abcdd..6029c0a5c 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -68,7 +68,7 @@ class Certificates(interfaces.plugins.PluginInterface): "Microsoft\\SystemCertificates", "Software\\Microsoft\\SystemCertificates", ]: - with contextlib.suppress(KeyError, exceptions.SwappedInvalidAddressException): + with contextlib.suppress(KeyError, exceptions.InvalidAddressException): # Walk it node_path = hive.get_key(top_key, return_list = True) for (_depth, is_key, _last_write_time, key_path, _volatility, node) in printkey.PrintKey.key_iterator(hive, node_path, recurse = True): From 8bbcb51bcb3c27c7871dc6629d50570dc866e6bd Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Thu, 25 Aug 2022 01:47:19 +0900 Subject: [PATCH 14/22] Remove: return syntax --- volatility3/framework/plugins/windows/netstat.py | 1 - 1 file changed, 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/netstat.py b/volatility3/framework/plugins/windows/netstat.py index 4d6ec5f62..93ac3af93 100644 --- a/volatility3/framework/plugins/windows/netstat.py +++ b/volatility3/framework/plugins/windows/netstat.py @@ -434,7 +434,6 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): kernel.layer_name, "tcpip.pdb", tcpip_module.DllBase, tcpip_module.SizeOfImage) except exceptions.VolatilityException: vollog.error("Unable to locate symbols for the memory image's tcpip module") - return for netw_obj in self.list_sockets(self.context, kernel.layer_name, kernel.symbol_table_name, netscan_symbol_table, tcpip_module.DllBase, tcpip_symbol_table): From e8b4944f9a61e0c833354d8765174576069f48c4 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Sat, 27 Aug 2022 01:06:06 +0900 Subject: [PATCH 15/22] Fix: typo for simple-plugin.rst --- doc/source/simple-plugin.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/source/simple-plugin.rst b/doc/source/simple-plugin.rst index e2143f1b7..c4908caf3 100644 --- a/doc/source/simple-plugin.rst +++ b/doc/source/simple-plugin.rst @@ -9,7 +9,7 @@ of a normal plugin, and reuses other plugins appropriately. .. note:: This document will not include the complete code necessary for a - working plugin (such as imports, etc) since it's designed to focus on the necessary componets for writing a plugin. + working plugin (such as imports, etc) since it's designed to focus on the necessary components for writing a plugin. For complete and functioning plugins, the ``framework/plugins`` directory should be consulted. Inherit from PluginInterface From 1f1355711d08e5e62b27156e5d186e3ed59366b2 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 30 Aug 2022 10:54:26 +0100 Subject: [PATCH 16/22] Windows: Fix faulty pdbutil API Commit 5bc517aa appears to have been a broken merge that removed some of the changes made to the pdbutil API unintentionally. This was kindly pointed out in PR #822 by @digitalisx. --- .../framework/symbols/windows/pdbutil.py | 48 ++++++++++++++++--- 1 file changed, 41 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py index 430ad6a30..137d5f4a2 100644 --- a/volatility3/framework/symbols/windows/pdbutil.py +++ b/volatility3/framework/symbols/windows/pdbutil.py @@ -13,7 +13,7 @@ from typing import Any, Dict, Generator, List, Optional, Tuple, Union from urllib import parse, request from volatility3 import symbols -from volatility3.framework import constants, exceptions, interfaces +from volatility3.framework import constants, contexts, exceptions, interfaces from volatility3.framework.automagic import symbol_cache from volatility3.framework.configuration import requirements from volatility3.framework.configuration.requirements import SymbolTableRequirement @@ -344,12 +344,46 @@ class PDBUtility(interfaces.configuration.VersionableInterface): vollog.debug(f"Found {guid['pdb_name']}: {guid['GUID']}-{guid['age']}") - return cls.load_windows_symbol_table(context, - guid["GUID"], - guid["age"], - guid["pdb_name"], - "volatility3.framework.symbols.intermed.IntermediateSymbolTable", - config_path = config_path) + module_name = guid["pdb_name"].strip('.pdb') + + symbol_table_name = cls.load_windows_symbol_table(context, + guid["GUID"], + guid["age"], + guid["pdb_name"], + "volatility3.framework.symbols.intermed.IntermediateSymbolTable", + config_path = config_path) + + new_module_name = None + if create_module: + new_module = contexts.Module.create(context, module_name, layer_name, offset = guid['mz_offset'], + symbol_table_name = symbol_table_name) + new_module_name = new_module.name + + return new_module_name, symbol_table_name + + @classmethod + def module_from_pdb(cls, context: interfaces.context.ContextInterface, config_path: str, layer_name: str, + pdb_name: str, module_offset: int = None, module_size: int = None) -> str: + """Creates a module in the specified layer_name based on a pdb name. + + Searches the memory section of the loaded module for its PDB GUID + and loads the associated symbol table into the symbol space. + + Args: + context: The context to retrieve required elements (layers, symbol tables) from + config_path: The config path where to find symbol files + layer_name: The name of the layer on which to operate + module_offset: This memory dump's module image offset + module_size: The size of the module for this dump + + Returns: + The name of the constructed and loaded symbol table + """ + + module_name, _ = cls._modtable_from_pdb(context, config_path, layer_name, pdb_name, module_offset, + module_size, create_module = True) + + return module_name class PdbSignatureScanner(interfaces.layers.ScannerInterface): From 4ed534bc8411408194399dc9698cd688a8d6cf44 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Fri, 2 Sep 2022 15:48:46 +0900 Subject: [PATCH 17/22] Fix: typo for yapf style file --- .style.yapf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.style.yapf b/.style.yapf index 8159be910..3f154e07b 100644 --- a/.style.yapf +++ b/.style.yapf @@ -107,7 +107,7 @@ each_dict_entry_on_separate_line=True i18n_comment= # The i18n function call names. The presence of this function stops -# reformattting on that line, because the string it has cannot be moved +# reformatting on that line, because the string it has cannot be moved # away from the i18n comment. i18n_function_call= From a49e7cfeca434e622d68f14d3d9fd567c7d450e6 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Sun, 4 Sep 2022 02:43:05 +0900 Subject: [PATCH 18/22] Fix: duplicate comments --- volatility3/framework/plugins/windows/cachedump.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py index ddfa856b9..f77c6257b 100644 --- a/volatility3/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -46,7 +46,7 @@ class Cachedump(interfaces.plugins.PluginInterface): rc4 = ARC4.new(rc4key) data = rc4.encrypt(edata) # lgtm [py/weak-cryptographic-algorithm] else: - # based on Based on code from http://lab.mediaservice.net/code/cachedump.rb + # Based on code from http://lab.mediaservice.net/code/cachedump.rb aes = AES.new(nlkm[16:32], AES.MODE_CBC, ch) data = b"" for i in range(0, len(edata), 16): From 3da028c7346d34cea11198dd897cf817d1e8f621 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Sun, 4 Sep 2022 02:54:26 +0900 Subject: [PATCH 19/22] Remove: unused module --- volatility3/framework/plugins/windows/ldrmodules.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/ldrmodules.py b/volatility3/framework/plugins/windows/ldrmodules.py index 284d1afc2..ba8d049a6 100644 --- a/volatility3/framework/plugins/windows/ldrmodules.py +++ b/volatility3/framework/plugins/windows/ldrmodules.py @@ -1,5 +1,4 @@ -from volatility3.framework import interfaces, constants -from volatility3.framework import renderers, interfaces, exceptions +from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import intermed From 9e578e66da923121c44b8940aa1c0c691352f616 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Sun, 4 Sep 2022 02:59:26 +0900 Subject: [PATCH 20/22] Remove: duplicate paragraph --- LICENSE.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/LICENSE.txt b/LICENSE.txt index 96f222187..2a37fd0ed 100644 --- a/LICENSE.txt +++ b/LICENSE.txt @@ -31,7 +31,7 @@ If you make any Additions available to others, such as by providing copies of th - You are responsible to ensure you have rights in Additions necessary to comply with this section. Contributing -If you contribute (or offer to contribute) any materials to Volatility Foundation for the software, such as by submitting a pull request to the repository for the software or related content run by Volatility Foundation, you agree to contribute them under the under the BSD 2-Clause Plus Patent License (in the case of software) or the Creative Commons Zero Public Domain Dedication (in the case of content), unless you clearly mark them "Not a Contribution." +If you contribute (or offer to contribute) any materials to Volatility Foundation for the software, such as by submitting a pull request to the repository for the software or related content run by Volatility Foundation, you agree to contribute them under the BSD 2-Clause Plus Patent License (in the case of software) or the Creative Commons Zero Public Domain Dedication (in the case of content), unless you clearly mark them "Not a Contribution." Trademarks This license grants you no rights to any trademarks or service marks. From 626e352b18c9288b70dcf1cebb615a8b03379989 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Sun, 4 Sep 2022 03:15:28 +0900 Subject: [PATCH 21/22] Add: api changes description for 2.3.1 version --- API_CHANGES.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/API_CHANGES.md b/API_CHANGES.md index 4d8733286..f74f754f9 100644 --- a/API_CHANGES.md +++ b/API_CHANGES.md @@ -4,6 +4,10 @@ API Changes When an addition to the existing API is made, the minor version is bumped. When an API feature or function is removed or changed, the major version is bumped. +2.3.1 +===== +Update in the windows `_EPROCESS.owning_process` method for support Windows Vista and later versions. + 2.3.0 ===== Add in `child_template` to template class From 97638ffc0dd05c587d031303f431f646ca3752f8 Mon Sep 17 00:00:00 2001 From: Paul Kermann Date: Mon, 12 Sep 2022 16:35:31 +0300 Subject: [PATCH 22/22] fix lineterminator --- volatility3/cli/text_renderer.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index ecb5179e0..623153fae 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -224,7 +224,7 @@ class CSVRenderer(CLIRenderer): # Ignore the type because namedtuples don't realize they have accessible attributes header_list.append(f"{column.name}") - writer = csv.DictWriter(outfd, header_list) + writer = csv.DictWriter(outfd, header_list, lineterminator='\n') writer.writeheader() def visitor(node: interfaces.renderers.TreeNode, accumulator):