WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-13 21:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Format fixes

Browse Source
This commit is contained in:
atcuno
2024-06-19 14:54:20 -05:00
parent c4e7e50180
commit 91184c7d92
3 changed files with 51 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/svcdiff.py
+16 -7
View File
@@ -48,27 +48,36 @@ class SvcDiff(svclist.SvcList, svcscan.SvcScan):
"""
kernel = self.context.modules[self.config["kernel"]]
if not symbols.symbol_table_is_64bit(self.context, kernel.symbol_table_name) or \
not versions.is_win10_15063_or_later(context=self.context, symbol_table=kernel.symbol_table_name):
vollog.info("This plugin only supports Windows 10 version 15063+ 64bit Windows memory samples")
if not symbols.symbol_table_is_64bit(
self.context, kernel.symbol_table_name
) or not versions.is_win10_15063_or_later(
context=self.context, symbol_table=kernel.symbol_table_name
):
vollog.info(
"This plugin only supports Windows 10 version 15063+ 64bit Windows memory samples"
)
return
from_scan = set()
from_list = set()
records = {}
service_table_name, service_binary_dll_map, filter_func = self.get_prereq_info()
# collect unique service names from scanning
for service in self.service_scan(service_table_name, service_binary_dll_map, filter_func):
for service in self.service_scan(
service_table_name, service_binary_dll_map, filter_func
):
from_scan.add(service[6])
records[service[6]] = service
# collect services from listing walking
for service in self.service_list(service_table_name, service_binary_dll_map, filter_func):
for service in self.service_list(
service_table_name, service_binary_dll_map, filter_func
):
from_list.add(service[6])
# report services found from scanning but not list walking
for hidden_service in from_scan-from_list:
for hidden_service in from_scan - from_list:
yield (0, records[hidden_service])
volatility3/framework/plugins/windows/svclist.py
+25 -11
View File
@@ -6,7 +6,7 @@ import logging
from typing import List
from volatility3.framework import interfaces, exceptions, symbols
from volatility3.framework import interfaces, exceptions, symbols
from volatility3.framework.configuration import requirements
from volatility3.framework.symbols.windows import versions
from volatility3.plugins.windows import svcscan, pslist
@@ -38,7 +38,9 @@ class SvcList(svcscan.SvcScan):
vad_root = proc.get_vad_root()
for vad in vad_root.traverse():
filename = vad.get_file_name()
if isinstance(filename, str) and filename.lower().endswith("\\services.exe"):
if isinstance(filename, str) and filename.lower().endswith(
"\\services.exe"
):
return [(vad.get_start(), vad.get_size())]
return None
@@ -46,9 +48,14 @@ class SvcList(svcscan.SvcScan):
def service_list(self, service_table_name, service_binary_dll_map, filter_func):
kernel = self.context.modules[self.config["kernel"]]
if not symbols.symbol_table_is_64bit(self.context, kernel.symbol_table_name) or \
not versions.is_win10_15063_or_later(context=self.context, symbol_table=kernel.symbol_table_name):
vollog.info("This plugin only supports Windows 10 version 15063+ 64bit Windows memory samples")
if not symbols.symbol_table_is_64bit(
self.context, kernel.symbol_table_name
) or not versions.is_win10_15063_or_later(
context=self.context, symbol_table=kernel.symbol_table_name
):
vollog.info(
"This plugin only supports Windows 10 version 15063+ 64bit Windows memory samples"
)
return
for proc in pslist.PsList.list_processes(
@@ -60,27 +67,34 @@ class SvcList(svcscan.SvcScan):
try:
layer_name = proc.add_process_layer()
except exceptions.InvalidAddressException:
vollog.warning("Unable to access memory of services.exe running with PID: {}".format(proc.UniqueProcessId))
vollog.warning(
"Unable to access memory of services.exe running with PID: {}".format(
proc.UniqueProcessId
)
)
continue
layer = self.context.layers[layer_name]
exe_range = self._get_exe_range(proc)
if not exe_range:
vollog.warning("Could not find the application executable VAD for services.exe. Unable to proceed.")
vollog.warning(
"Could not find the application executable VAD for services.exe. Unable to proceed."
)
continue
for offset in layer.scan(
context=self.context,
scanner=scanners.BytesScanner(needle = b"Sc27"),
scanner=scanners.BytesScanner(needle=b"Sc27"),
sections=exe_range,
):
for record in self.enumerate_vista_or_later_header(
service_table_name, service_binary_dll_map, layer_name, offset
):
for record in self.enumerate_vista_or_later_header(service_table_name, service_binary_dll_map, layer_name, offset):
yield record
def _generator(self):
service_table_name, service_binary_dll_map, filter_func = self.get_prereq_info()
for record in self.service_list(service_table_name, service_binary_dll_map, filter_func):
yield (0, record)
volatility3/framework/plugins/windows/svcscan.py
+10 -8
View File
@@ -233,11 +233,7 @@ class SvcScan(interfaces.plugins.PluginInterface):
}
def enumerate_vista_or_later_header(
self,
service_table_name,
service_binary_dll_map,
proc_layer_name,
offset
self, service_table_name, service_binary_dll_map, proc_layer_name, offset
):
if offset % 8:
return
@@ -324,13 +320,17 @@ class SvcScan(interfaces.plugins.PluginInterface):
)
yield self.get_record_tuple(service_record, service_info)
else:
for service_record in self.enumerate_vista_or_later_header(service_table_name, service_binary_dll_map, proc_layer_name, offset):
for service_record in self.enumerate_vista_or_later_header(
service_table_name,
service_binary_dll_map,
proc_layer_name,
offset
):
if service_record in seen:
break
seen.append(service_record)
yield service_record
def get_prereq_info(self):
"""
Data structures and information needed to analyze service information
@@ -356,7 +356,9 @@ class SvcScan(interfaces.plugins.PluginInterface):
def _generator(self):
service_table_name, service_binary_dll_map, filter_func = self.get_prereq_info()
for record in self.service_scan(service_table_name, service_binary_dll_map, filter_func):
for record in self.service_scan(
service_table_name, service_binary_dll_map, filter_func
):
yield (0, record)
def run(self):