From 90d13be9a9ed31c15b52ea0fac01921e82999006 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 16 Sep 2018 15:59:30 +0100 Subject: [PATCH] Ensure we pass the native_layer_name whenever constructing a subobject. --- volatility/framework/contexts/__init__.py | 24 +++++++++++++++---- volatility/framework/interfaces/context.py | 6 ++++- .../symbols/windows/extensions/__init__.py | 21 ++++++++++++---- 3 files changed, 41 insertions(+), 10 deletions(-) diff --git a/volatility/framework/contexts/__init__.py b/volatility/framework/contexts/__init__.py index c058ed3ff..bfa05e6b0 100644 --- a/volatility/framework/contexts/__init__.py +++ b/volatility/framework/contexts/__init__.py @@ -108,11 +108,21 @@ class Context(interfaces.context.ContextInterface): module_name: str, layer_name: str, offset: int, + native_layer_name: typing.Optional[str] = None, size: typing.Optional[int] = None) -> interfaces.context.ModuleInterface: """Creates a module object""" if size: - return SizedModule(self, module_name, layer_name, offset, size) - return Module(self, module_name, layer_name, offset) + return SizedModule(self, + module_name = module_name, + layer_name = layer_name, + offset = offset, + size = size, + native_layer_name = native_layer_name) + return Module(self, + module_name = module_name, + layer_name = layer_name, + offset = offset, + native_layer_name = native_layer_name) def get_module_wrapper(method: str) -> typing.Callable: @@ -182,8 +192,14 @@ class SizedModule(Module): layer_name: str, offset: int, size: int, - symbol_table_name: typing.Optional[str] = None) -> None: - super().__init__(context, module_name, layer_name, offset, symbol_table_name = symbol_table_name) + symbol_table_name: typing.Optional[str] = None, + native_layer_name: typing.Optional[str] = None) -> None: + super().__init__(context, + module_name = module_name, + layer_name = layer_name, + offset = offset, + native_layer_name = native_layer_name, + symbol_table_name = symbol_table_name) self._size = self._check_type(size, int) @property diff --git a/volatility/framework/interfaces/context.py b/volatility/framework/interfaces/context.py index 14f6b676d..b3a7ef814 100644 --- a/volatility/framework/interfaces/context.py +++ b/volatility/framework/interfaces/context.py @@ -93,11 +93,15 @@ class ModuleInterface(validity.ValidityRoutines, metaclass = ABCMeta): module_name: str, layer_name: str, offset: int, - symbol_table_name: typing.Optional[str] = None) -> None: + symbol_table_name: typing.Optional[str] = None, + native_layer_name: typing.Optional[str] = None) -> None: self._context = self._check_type(context, ContextInterface) self._module_name = self._check_type(module_name, str) self._layer_name = self._check_type(layer_name, str) self._offset = self._check_type(offset, int) + self._native_layer_name = None + if native_layer_name: + self._native_layer_name = self._check_type(native_layer_name, str) self.symbol_table_name = symbol_table_name or self._module_name super().__init__() diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index daa27efef..cd271d93f 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -455,7 +455,8 @@ class _OBJECT_HEADER(objects.Struct): header = self._context.object(symbol_table_name + constants.BANG + "_OBJECT_HEADER_NAME_INFO", layer_name = self.vol.layer_name, - offset = self.vol.offset - header_offset) + offset = self.vol.offset - header_offset, + native_layer_name = self.vol.native_layer_name) return header @@ -517,7 +518,8 @@ class _EPROCESS(generic.GenericIntelProcess, ExecutiveObject): raise StopIteration sym_table = self.vol.type_name.split(constants.BANG)[0] - peb = self._context.object("{}{}_PEB".format(sym_table, constants.BANG), layer_name = proc_layer_name, + peb = self._context.object("{}{}_PEB".format(sym_table, constants.BANG), + layer_name = proc_layer_name, offset = self.Peb) for entry in peb.Ldr.InLoadOrderModuleList.to_list( @@ -545,7 +547,10 @@ class _EPROCESS(generic.GenericIntelProcess, ExecutiveObject): layer_name = self.vol.layer_name symbol_table_name = self.get_symbol_table().name kvo = self._context.memory[layer_name].config['kernel_virtual_offset'] - ntkrnlmp = self._context.module(symbol_table_name, layer_name = layer_name, offset = kvo) + ntkrnlmp = self._context.module(symbol_table_name, + layer_name = layer_name, + offset = kvo, + native_layer_name = self.vol.native_layer_name) session = ntkrnlmp.object(type_name = "_MM_SESSION_SPACE", offset = self.Session) if session.has_member("SessionId"): @@ -616,12 +621,18 @@ class _LIST_ENTRY(objects.Struct, collections.abc.Iterable): link = getattr(self, direction).dereference() if not sentinel: - yield self._context.object(symbol_type, layer, offset = self.vol.offset - relative_offset) + yield self._context.object(symbol_type, + layer, + offset = self.vol.offset - relative_offset, + native_layer_name = layer or self.vol.native_layer_name) seen = {self.vol.offset} while link.vol.offset not in seen: - obj = self._context.object(symbol_type, layer, offset = link.vol.offset - relative_offset) + obj = self._context.object(symbol_type, + layer, + offset = link.vol.offset - relative_offset, + native_layer_name = layer or self.vol.native_layer_name) yield obj seen.add(link.vol.offset)