WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-29 04:54:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

Ensure we pass the native_layer_name whenever constructing a subobject.

Browse Source
This commit is contained in:
Mike Auty
2018-09-16 15:59:30 +01:00
parent 569bc97bc2
commit 90d13be9a9
3 changed files with 41 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/contexts/__init__.py
+20 -4
View File
@@ -108,11 +108,21 @@ class Context(interfaces.context.ContextInterface):
module_name: str,
layer_name: str,
offset: int,
native_layer_name: typing.Optional[str] = None,
size: typing.Optional[int] = None) -> interfaces.context.ModuleInterface:
"""Creates a module object"""
if size:
return SizedModule(self, module_name, layer_name, offset, size)
return Module(self, module_name, layer_name, offset)
return SizedModule(self,
module_name = module_name,
layer_name = layer_name,
offset = offset,
size = size,
native_layer_name = native_layer_name)
return Module(self,
module_name = module_name,
layer_name = layer_name,
offset = offset,
native_layer_name = native_layer_name)
def get_module_wrapper(method: str) -> typing.Callable:
@@ -182,8 +192,14 @@ class SizedModule(Module):
layer_name: str,
offset: int,
size: int,
symbol_table_name: typing.Optional[str] = None) -> None:
super().__init__(context, module_name, layer_name, offset, symbol_table_name = symbol_table_name)
symbol_table_name: typing.Optional[str] = None,
native_layer_name: typing.Optional[str] = None) -> None:
super().__init__(context,
module_name = module_name,
layer_name = layer_name,
offset = offset,
native_layer_name = native_layer_name,
symbol_table_name = symbol_table_name)
self._size = self._check_type(size, int)
@property
volatility/framework/interfaces/context.py
+5 -1
View File
@@ -93,11 +93,15 @@ class ModuleInterface(validity.ValidityRoutines, metaclass = ABCMeta):
module_name: str,
layer_name: str,
offset: int,
symbol_table_name: typing.Optional[str] = None) -> None:
symbol_table_name: typing.Optional[str] = None,
native_layer_name: typing.Optional[str] = None) -> None:
self._context = self._check_type(context, ContextInterface)
self._module_name = self._check_type(module_name, str)
self._layer_name = self._check_type(layer_name, str)
self._offset = self._check_type(offset, int)
self._native_layer_name = None
if native_layer_name:
self._native_layer_name = self._check_type(native_layer_name, str)
self.symbol_table_name = symbol_table_name or self._module_name
super().__init__()
volatility/framework/symbols/windows/extensions/__init__.py
+16 -5
View File
@@ -455,7 +455,8 @@ class _OBJECT_HEADER(objects.Struct):
header = self._context.object(symbol_table_name + constants.BANG + "_OBJECT_HEADER_NAME_INFO",
layer_name = self.vol.layer_name,
offset = self.vol.offset - header_offset)
offset = self.vol.offset - header_offset,
native_layer_name = self.vol.native_layer_name)
return header
@@ -517,7 +518,8 @@ class _EPROCESS(generic.GenericIntelProcess, ExecutiveObject):
raise StopIteration
sym_table = self.vol.type_name.split(constants.BANG)[0]
peb = self._context.object("{}{}_PEB".format(sym_table, constants.BANG), layer_name = proc_layer_name,
peb = self._context.object("{}{}_PEB".format(sym_table, constants.BANG),
layer_name = proc_layer_name,
offset = self.Peb)
for entry in peb.Ldr.InLoadOrderModuleList.to_list(
@@ -545,7 +547,10 @@ class _EPROCESS(generic.GenericIntelProcess, ExecutiveObject):
layer_name = self.vol.layer_name
symbol_table_name = self.get_symbol_table().name
kvo = self._context.memory[layer_name].config['kernel_virtual_offset']
ntkrnlmp = self._context.module(symbol_table_name, layer_name = layer_name, offset = kvo)
ntkrnlmp = self._context.module(symbol_table_name,
layer_name = layer_name,
offset = kvo,
native_layer_name = self.vol.native_layer_name)
session = ntkrnlmp.object(type_name = "_MM_SESSION_SPACE", offset = self.Session)
if session.has_member("SessionId"):
@@ -616,12 +621,18 @@ class _LIST_ENTRY(objects.Struct, collections.abc.Iterable):
link = getattr(self, direction).dereference()
if not sentinel:
yield self._context.object(symbol_type, layer, offset = self.vol.offset - relative_offset)
yield self._context.object(symbol_type,
layer,
offset = self.vol.offset - relative_offset,
native_layer_name = layer or self.vol.native_layer_name)
seen = {self.vol.offset}
while link.vol.offset not in seen:
obj = self._context.object(symbol_type, layer, offset = link.vol.offset - relative_offset)
obj = self._context.object(symbol_type,
layer,
offset = link.vol.offset - relative_offset,
native_layer_name = layer or self.vol.native_layer_name)
yield obj
seen.add(link.vol.offset)