WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-11 12:17:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Convert aslr_mask_symbol_table to more parameterized form.

Browse Source
This commit is contained in:
Mike Auty
2018-12-08 17:55:13 +00:00
parent 378820bf23
commit 918653e398
4 changed files with 42 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/automagic/linux.py
+11 -9
View File
@@ -2,7 +2,7 @@ import logging
import typing
import volatility.framework.objects.utility
from volatility.framework import interfaces, constants, validity, exceptions
from volatility.framework import interfaces, constants, validity, exceptions, layers
from volatility.framework import symbols, objects
from volatility.framework.automagic import linux_symbol_cache
from volatility.framework.configuration import requirements
@@ -324,19 +324,21 @@ class LinuxUtilities(object):
@classmethod
def aslr_mask_symbol_table(cls,
config,
context: interfaces.context.ContextInterface,
symbol_table: str,
layer_name: str,
aslr_shift = 0):
# FIXME: Change signature not to use config, but explicitly ask for symbol/layer names
sym_table = context.symbol_space[symbol_table]
sym_layer = context.memory[layer_name]
if aslr_shift == 0:
aslr_layer = config['primary.memory_layer']
_, aslr_shift = LinuxUtilities.find_aslr(context, config["vmlinux"], aslr_layer)
if not isinstance(sym_layer, layers.intel.Intel):
raise TypeError("Layer name {} is not an intel space")
aslr_layer = sym_layer.config['memory_layer']
_, aslr_shift = LinuxUtilities.find_aslr(context, symbol_table, aslr_layer)
sym_table_name = config["vmlinux"]
sym_layer_name = config["primary"]
symbols.utility.mask_symbol_table(context.symbol_space[sym_table_name],
context.memory[sym_layer_name].address_mask, aslr_shift)
symbols.utility.mask_symbol_table(sym_table, sym_layer.address_mask, aslr_shift)
@classmethod
def find_aslr(cls,
volatility/plugins/linux/check_afinfo.py
+26 -25
View File
@@ -3,19 +3,19 @@ typically found in Linux's /proc file system.
"""
import logging
from volatility.framework import renderers, constants
from volatility.framework import exceptions
from volatility.framework import renderers
from volatility.framework.automagic import linux
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.renderers import format_hints
from volatility.framework.objects import utility
from volatility.framework import exceptions
from volatility.framework.configuration import requirements
vollog = logging.getLogger(__name__)
class check_afinfo(plugins.PluginInterface):
class Check_afinfo(plugins.PluginInterface):
"""Verifies the operation function pointers of network protocols"""
@classmethod
def get_requirements(cls):
return [requirements.TranslationLayerRequirement(name = 'primary',
@@ -34,14 +34,14 @@ class check_afinfo(plugins.PluginInterface):
for check in members:
# redhat-specific garbage
if check.startswith("__UNIQUE_ID_rh_kabi_hide"):
continue
continue
if check == "write":
addr = var_ops.member(attr = 'write')
else:
addr = getattr(var_ops, check)
if addr and addr != 0 and self._is_known_address(addr) == False:
if addr and addr != 0 and not self._is_known_address(addr):
yield check, addr
def _check_afinfo(self, var_name, var, op_members, seq_members):
@@ -51,27 +51,30 @@ class check_afinfo(plugins.PluginInterface):
# newer kernels
if var.has_member("seq_ops"):
for hooked_member, hook_address in self._check_members(var.seq_ops, var_name, seq_members):
yield var_name, hooked_member, hook_address
# this is the most commonly hooked member by rootkits, so a force a check on it
elif self._is_known_address(var.seq_show) == False:
yield var_name, hooked_member, hook_address
# this is the most commonly hooked member by rootkits, so a force a check on it
elif not self._is_known_address(var.seq_show):
yield var_name, "show", var.seq_show
def _generator(self):
def _generator(self):
_, aslr_shift = linux.LinuxUtilities.find_aslr(self.context, self.config['vmlinux'], self.config['primary'])
vmlinux = self.context.module(self.config['vmlinux'], self.config['primary'], aslr_shift)
linux.LinuxUtilities.aslr_mask_symbol_table(self.config, self.context, aslr_shift)
op_members = vmlinux.get_type('file_operations').members
linux.LinuxUtilities.aslr_mask_symbol_table(self.context,
self.config['primary'],
self.config['vmlinux'],
aslr_shift)
op_members = vmlinux.get_type('file_operations').members
seq_members = vmlinux.get_type('seq_operations').members
tcp = ("tcp_seq_afinfo", ["tcp6_seq_afinfo", "tcp4_seq_afinfo"])
udp = ("udp_seq_afinfo", ["udplite6_seq_afinfo", "udp6_seq_afinfo", "udplite4_seq_afinfo", "udp4_seq_afinfo"])
protocols = [tcp, udp]
for (struct_type, global_vars) in protocols:
for global_var_name in global_vars:
for (struct_type, global_vars) in protocols:
for global_var_name in global_vars:
# this will lookup fail for the IPv6 protocols on kernels without IPv6 support
try:
global_var = vmlinux.get_symbol(global_var_name)
@@ -86,9 +89,7 @@ class check_afinfo(plugins.PluginInterface):
def run(self):
return renderers.TreeGrid(
[("Symbol Name", str),
("Member", str),
("Handler Address", format_hints.Hex)],
self._generator())
[("Symbol Name", str),
("Member", str),
("Handler Address", format_hints.Hex)],
self._generator())
volatility/plugins/linux/check_syscall.py
+4 -3
View File
@@ -126,15 +126,16 @@ class Check_syscall(plugins.PluginInterface):
_, aslr_shift = linux.LinuxUtilities.find_aslr(self.context, self.config['vmlinux'], self.config['primary'])
vmlinux = self.context.module(self.config['vmlinux'], self.config['primary'], aslr_shift)
linux.LinuxUtilities.aslr_mask_symbol_table(self.config, self.context, aslr_shift)
linux.LinuxUtilities.aslr_mask_symbol_table(self.context,
self.config['vmlinux'],
self.config['primary'],
aslr_shift)
ptr_sz = vmlinux.get_type("pointer").size
if ptr_sz == 4:
table_name = "32bit"
array_type = "long unsigned int"
else:
table_name = "64bit"
array_type = "long long unsigned int"
try:
table_info = self._get_table_info(vmlinux, "sys_call_table", ptr_sz)
volatility/plugins/linux/lsof.py
+1 -1
View File
@@ -34,7 +34,7 @@ class Lsof(plugins.PluginInterface):
yield (0, (pid, name, fd_num, full_path))
def run(self):
linux.LinuxUtilities.aslr_mask_symbol_table(self.config, self.context)
linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary'])
filter = pslist.PsList.create_filter([self.config.get('pid', None)])