From 8acbe8bba336cd0d7ca8d8838db0d18b5f9290ce Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 12 Dec 2018 23:39:10 +0000 Subject: [PATCH] Refactor conversion code from objects.utility to a conversion module in renderers. --- volatility/framework/objects/utility.py | 45 +---------------- volatility/framework/renderers/conversion.py | 48 +++++++++++++++++++ .../symbols/linux/extensions/bash.py | 3 +- .../symbols/windows/extensions/__init__.py | 10 ++-- .../symbols/windows/extensions/pe.py | 4 +- .../plugins/windows/registry/printkey.py | 5 +- .../plugins/windows/registry/userassist.py | 13 +++-- 7 files changed, 66 insertions(+), 62 deletions(-) create mode 100644 volatility/framework/renderers/conversion.py diff --git a/volatility/framework/objects/utility.py b/volatility/framework/objects/utility.py index 62f1857be..9c5266af8 100644 --- a/volatility/framework/objects/utility.py +++ b/volatility/framework/objects/utility.py @@ -1,7 +1,6 @@ -import datetime import typing -from volatility.framework import interfaces, objects, renderers, constants +from volatility.framework import interfaces, objects, constants def array_to_string(array: objects.Array, @@ -44,45 +43,3 @@ def array_of_pointers(array: interfaces.objects.ObjectInterface, return array.cast("array", count = count, subtype = subtype_pointer) -def wintime_to_datetime(wintime: int) -> typing.Union[ - interfaces.renderers.BaseAbsentValue, datetime.datetime]: - unix_time = wintime // 10000000 - if unix_time == 0: - return renderers.NotApplicableValue() - unix_time = unix_time - 11644473600 - try: - return datetime.datetime.utcfromtimestamp(unix_time) - except ValueError: - return renderers.UnparsableValue() - - -def unixtime_to_datetime(unixtime: int) -> typing.Union[interfaces.renderers.BaseAbsentValue, datetime.datetime]: - ret = renderers.UnparsableValue() # type: typing.Union[interfaces.renderers.BaseAbsentValue, datetime.datetime] - - if unixtime > 0: - try: - ret = datetime.datetime.utcfromtimestamp(unixtime) - except ValueError: - pass - - return ret - - -def round(addr: int, align: int, up: bool = False) -> int: - """Round an address up or down based on an alignment. - - Args: - addr: the address - align: the alignment value - up: Whether to round up or not - - Returns: - The aligned address - """ - - if addr % align == 0: - return addr - else: - if up: - return (addr + (align - (addr % align))) - return (addr - (addr % align)) diff --git a/volatility/framework/renderers/conversion.py b/volatility/framework/renderers/conversion.py new file mode 100644 index 000000000..0558e1ade --- /dev/null +++ b/volatility/framework/renderers/conversion.py @@ -0,0 +1,48 @@ +import datetime +import typing + +from volatility.framework import interfaces, renderers + + +def wintime_to_datetime(wintime: int) -> typing.Union[ + interfaces.renderers.BaseAbsentValue, datetime.datetime]: + unix_time = wintime // 10000000 + if unix_time == 0: + return renderers.NotApplicableValue() + unix_time = unix_time - 11644473600 + try: + return datetime.datetime.utcfromtimestamp(unix_time) + except ValueError: + return renderers.UnparsableValue() + + +def unixtime_to_datetime(unixtime: int) -> typing.Union[interfaces.renderers.BaseAbsentValue, datetime.datetime]: + ret = renderers.UnparsableValue() # type: typing.Union[interfaces.renderers.BaseAbsentValue, datetime.datetime] + + if unixtime > 0: + try: + ret = datetime.datetime.utcfromtimestamp(unixtime) + except ValueError: + pass + + return ret + + +def round(addr: int, align: int, up: bool = False) -> int: + """Round an address up or down based on an alignment. + + Args: + addr: the address + align: the alignment value + up: Whether to round up or not + + Returns: + The aligned address + """ + + if addr % align == 0: + return addr + else: + if up: + return (addr + (align - (addr % align))) + return (addr - (addr % align)) diff --git a/volatility/framework/symbols/linux/extensions/bash.py b/volatility/framework/symbols/linux/extensions/bash.py index 3da664a43..89f8ba84d 100644 --- a/volatility/framework/symbols/linux/extensions/bash.py +++ b/volatility/framework/symbols/linux/extensions/bash.py @@ -1,6 +1,7 @@ from volatility.framework import exceptions from volatility.framework import objects from volatility.framework.objects import utility +from volatility.framework.renderers import conversion class hist_entry(objects.Struct): @@ -41,7 +42,7 @@ class hist_entry(objects.Struct): def get_time_object(self): nsecs = self.get_time_as_integer() # Build a timestamp object from the integer - return utility.unixtime_to_datetime(nsecs) + return conversion.unixtime_to_datetime(nsecs) def get_command(self): return utility.array_to_string(self.line.dereference()) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 25dab515d..d84ff911d 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -3,9 +3,9 @@ import functools import logging import typing -import volatility.framework.objects.utility from volatility.framework import constants, exceptions, interfaces, objects, renderers, symbols from volatility.framework.layers import intel +from volatility.framework.renderers import conversion from volatility.framework.symbols import generic from volatility.framework.symbols.windows.extensions.registry import RegKeyFlags @@ -45,7 +45,7 @@ class _POOL_HEADER(objects.Struct): else: alignment = pool_header_size type_size = self._context.symbol_space.get_type(symbol_table_name + constants.BANG + type_name).size - rounded_size = objects.utility.round(type_size, alignment, up = True) + rounded_size = conversion.round(type_size, alignment, up = True) mem_object = self._context.object(symbol_table_name + constants.BANG + type_name, layer_name = self.vol.layer_name, @@ -69,7 +69,7 @@ class _KSYSTEM_TIME(objects.Struct): def get_time(self): wintime = (self.High1Time << 32) | self.LowPart - return objects.utility.wintime_to_datetime(wintime) + return conversion.wintime_to_datetime(wintime) class _MMVAD_SHORT(objects.Struct): @@ -564,10 +564,10 @@ class _EPROCESS(generic.GenericIntelProcess, ExecutiveObject): return renderers.UnreadableValue() def get_create_time(self): - return objects.utility.wintime_to_datetime(self.CreateTime.QuadPart) + return conversion.wintime_to_datetime(self.CreateTime.QuadPart) def get_exit_time(self): - return objects.utility.wintime_to_datetime(self.ExitTime.QuadPart) + return conversion.wintime_to_datetime(self.ExitTime.QuadPart) def get_wow_64_process(self): if self.has_member("Wow64Process"): diff --git a/volatility/framework/symbols/windows/extensions/pe.py b/volatility/framework/symbols/windows/extensions/pe.py index 9599bd5ce..f77a87e13 100644 --- a/volatility/framework/symbols/windows/extensions/pe.py +++ b/volatility/framework/symbols/windows/extensions/pe.py @@ -3,7 +3,7 @@ import typing from volatility.framework import constants from volatility.framework import objects, interfaces -from volatility.framework.objects import utility +from volatility.framework.renderers import conversion class _IMAGE_DOS_HEADER(objects.Struct): @@ -127,7 +127,7 @@ class _IMAGE_DOS_HEADER(objects.Struct): sect_sizes.append(sect.VirtualAddress - prevsect.VirtualAddress) prevsect = sect if prevsect is not None: - sect_sizes.append(utility.round(prevsect.Misc.VirtualSize, section_alignment, up = True)) + sect_sizes.append(conversion.round(prevsect.Misc.VirtualSize, section_alignment, up = True)) counter = 0 start_addr = nt_header.FileHeader.SizeOfOptionalHeader + \ diff --git a/volatility/plugins/windows/registry/printkey.py b/volatility/plugins/windows/registry/printkey.py index cb4c1f533..34e53e5e6 100644 --- a/volatility/plugins/windows/registry/printkey.py +++ b/volatility/plugins/windows/registry/printkey.py @@ -6,8 +6,7 @@ import volatility.framework.interfaces.plugins as plugins from volatility.framework import objects, renderers, exceptions from volatility.framework.configuration import requirements from volatility.framework.layers.registry import RegistryHive -from volatility.framework.objects import utility -from volatility.framework.renderers import TreeGrid +from volatility.framework.renderers import TreeGrid, conversion from volatility.framework.symbols.windows.extensions.registry import RegValueTypes vollog = logging.getLogger(__name__) @@ -48,7 +47,7 @@ class PrintKey(plugins.PluginInterface): return node = node_path[-1] key_path = key_path or node.get_key_path() - last_write_time = utility.wintime_to_datetime(node.LastWriteTime.QuadPart) + last_write_time = conversion.wintime_to_datetime(node.LastWriteTime.QuadPart) for key_node in node.get_subkeys(): result = (key_path.count("\\"), diff --git a/volatility/plugins/windows/registry/userassist.py b/volatility/plugins/windows/registry/userassist.py index d7891504e..0263c1125 100644 --- a/volatility/plugins/windows/registry/userassist.py +++ b/volatility/plugins/windows/registry/userassist.py @@ -5,19 +5,17 @@ import logging import os import typing -import volatility.framework.interfaces.plugins as interfaces_plugins -from volatility.framework import exceptions, renderers, constants +from volatility.framework import exceptions, renderers, constants, interfaces from volatility.framework.configuration import requirements from volatility.framework.layers.physical import BufferDataLayer from volatility.framework.layers.registry import RegistryHive -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints +from volatility.framework.renderers import format_hints, conversion from volatility.framework.symbols import intermed vollog = logging.getLogger(__name__) -class UserAssist(interfaces_plugins.PluginInterface): +class UserAssist(interfaces.plugins.PluginInterface): """Print userassist registry keys and information""" def __init__(self, *args, **kwargs): @@ -92,7 +90,7 @@ class UserAssist(interfaces_plugins.PluginInterface): item["focus"] = renderers.NotApplicableValue() item["time"] = renderers.NotApplicableValue() - item["lastupdated"] = utility.wintime_to_datetime(userassist_obj.LastUpdated.QuadPart) + item["lastupdated"] = conversion.wintime_to_datetime(userassist_obj.LastUpdated.QuadPart) return item @@ -140,7 +138,8 @@ class UserAssist(interfaces_plugins.PluginInterface): # each guid key should have a Count key in it for countkey in guidkey.get_subkeys(): countkey_path = countkey.get_key_path() - countkey_last_write_time = utility.wintime_to_datetime(countkey.LastWriteTime.QuadPart) + countkey_last_write_time = volatility.framework.renderers.conversion.wintime_to_datetime( + countkey.LastWriteTime.QuadPart) # output the parent Count key result = (0,