From 918653e39802e2349f7aa1dd0b2e26de8f134b8d Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 8 Dec 2018 17:55:13 +0000 Subject: [PATCH] Convert aslr_mask_symbol_table to more parameterized form. --- volatility/framework/automagic/linux.py | 20 +++++---- volatility/plugins/linux/check_afinfo.py | 51 ++++++++++++----------- volatility/plugins/linux/check_syscall.py | 7 ++-- volatility/plugins/linux/lsof.py | 2 +- 4 files changed, 42 insertions(+), 38 deletions(-) diff --git a/volatility/framework/automagic/linux.py b/volatility/framework/automagic/linux.py index f902db268..89b1d1ffb 100644 --- a/volatility/framework/automagic/linux.py +++ b/volatility/framework/automagic/linux.py @@ -2,7 +2,7 @@ import logging import typing import volatility.framework.objects.utility -from volatility.framework import interfaces, constants, validity, exceptions +from volatility.framework import interfaces, constants, validity, exceptions, layers from volatility.framework import symbols, objects from volatility.framework.automagic import linux_symbol_cache from volatility.framework.configuration import requirements @@ -324,19 +324,21 @@ class LinuxUtilities(object): @classmethod def aslr_mask_symbol_table(cls, - config, context: interfaces.context.ContextInterface, + symbol_table: str, + layer_name: str, aslr_shift = 0): - # FIXME: Change signature not to use config, but explicitly ask for symbol/layer names + + sym_table = context.symbol_space[symbol_table] + sym_layer = context.memory[layer_name] if aslr_shift == 0: - aslr_layer = config['primary.memory_layer'] - _, aslr_shift = LinuxUtilities.find_aslr(context, config["vmlinux"], aslr_layer) + if not isinstance(sym_layer, layers.intel.Intel): + raise TypeError("Layer name {} is not an intel space") + aslr_layer = sym_layer.config['memory_layer'] + _, aslr_shift = LinuxUtilities.find_aslr(context, symbol_table, aslr_layer) - sym_table_name = config["vmlinux"] - sym_layer_name = config["primary"] - symbols.utility.mask_symbol_table(context.symbol_space[sym_table_name], - context.memory[sym_layer_name].address_mask, aslr_shift) + symbols.utility.mask_symbol_table(sym_table, sym_layer.address_mask, aslr_shift) @classmethod def find_aslr(cls, diff --git a/volatility/plugins/linux/check_afinfo.py b/volatility/plugins/linux/check_afinfo.py index 337a1a325..ee218590c 100644 --- a/volatility/plugins/linux/check_afinfo.py +++ b/volatility/plugins/linux/check_afinfo.py @@ -3,19 +3,19 @@ typically found in Linux's /proc file system. """ import logging -from volatility.framework import renderers, constants +from volatility.framework import exceptions +from volatility.framework import renderers from volatility.framework.automagic import linux +from volatility.framework.configuration import requirements from volatility.framework.interfaces import plugins from volatility.framework.renderers import format_hints -from volatility.framework.objects import utility -from volatility.framework import exceptions -from volatility.framework.configuration import requirements vollog = logging.getLogger(__name__) -class check_afinfo(plugins.PluginInterface): + +class Check_afinfo(plugins.PluginInterface): """Verifies the operation function pointers of network protocols""" - + @classmethod def get_requirements(cls): return [requirements.TranslationLayerRequirement(name = 'primary', @@ -34,14 +34,14 @@ class check_afinfo(plugins.PluginInterface): for check in members: # redhat-specific garbage if check.startswith("__UNIQUE_ID_rh_kabi_hide"): - continue + continue if check == "write": addr = var_ops.member(attr = 'write') else: addr = getattr(var_ops, check) - if addr and addr != 0 and self._is_known_address(addr) == False: + if addr and addr != 0 and not self._is_known_address(addr): yield check, addr def _check_afinfo(self, var_name, var, op_members, seq_members): @@ -51,27 +51,30 @@ class check_afinfo(plugins.PluginInterface): # newer kernels if var.has_member("seq_ops"): for hooked_member, hook_address in self._check_members(var.seq_ops, var_name, seq_members): - yield var_name, hooked_member, hook_address - - # this is the most commonly hooked member by rootkits, so a force a check on it - elif self._is_known_address(var.seq_show) == False: + yield var_name, hooked_member, hook_address + + # this is the most commonly hooked member by rootkits, so a force a check on it + elif not self._is_known_address(var.seq_show): yield var_name, "show", var.seq_show - def _generator(self): + def _generator(self): _, aslr_shift = linux.LinuxUtilities.find_aslr(self.context, self.config['vmlinux'], self.config['primary']) vmlinux = self.context.module(self.config['vmlinux'], self.config['primary'], aslr_shift) - - linux.LinuxUtilities.aslr_mask_symbol_table(self.config, self.context, aslr_shift) - op_members = vmlinux.get_type('file_operations').members + linux.LinuxUtilities.aslr_mask_symbol_table(self.context, + self.config['primary'], + self.config['vmlinux'], + aslr_shift) + + op_members = vmlinux.get_type('file_operations').members seq_members = vmlinux.get_type('seq_operations').members tcp = ("tcp_seq_afinfo", ["tcp6_seq_afinfo", "tcp4_seq_afinfo"]) udp = ("udp_seq_afinfo", ["udplite6_seq_afinfo", "udp6_seq_afinfo", "udplite4_seq_afinfo", "udp4_seq_afinfo"]) protocols = [tcp, udp] - - for (struct_type, global_vars) in protocols: - for global_var_name in global_vars: + + for (struct_type, global_vars) in protocols: + for global_var_name in global_vars: # this will lookup fail for the IPv6 protocols on kernels without IPv6 support try: global_var = vmlinux.get_symbol(global_var_name) @@ -86,9 +89,7 @@ class check_afinfo(plugins.PluginInterface): def run(self): return renderers.TreeGrid( - [("Symbol Name", str), - ("Member", str), - ("Handler Address", format_hints.Hex)], - self._generator()) - - + [("Symbol Name", str), + ("Member", str), + ("Handler Address", format_hints.Hex)], + self._generator()) diff --git a/volatility/plugins/linux/check_syscall.py b/volatility/plugins/linux/check_syscall.py index 5bfba8f16..fa597d337 100644 --- a/volatility/plugins/linux/check_syscall.py +++ b/volatility/plugins/linux/check_syscall.py @@ -126,15 +126,16 @@ class Check_syscall(plugins.PluginInterface): _, aslr_shift = linux.LinuxUtilities.find_aslr(self.context, self.config['vmlinux'], self.config['primary']) vmlinux = self.context.module(self.config['vmlinux'], self.config['primary'], aslr_shift) - linux.LinuxUtilities.aslr_mask_symbol_table(self.config, self.context, aslr_shift) + linux.LinuxUtilities.aslr_mask_symbol_table(self.context, + self.config['vmlinux'], + self.config['primary'], + aslr_shift) ptr_sz = vmlinux.get_type("pointer").size if ptr_sz == 4: table_name = "32bit" - array_type = "long unsigned int" else: table_name = "64bit" - array_type = "long long unsigned int" try: table_info = self._get_table_info(vmlinux, "sys_call_table", ptr_sz) diff --git a/volatility/plugins/linux/lsof.py b/volatility/plugins/linux/lsof.py index 4e5396017..eccc97570 100644 --- a/volatility/plugins/linux/lsof.py +++ b/volatility/plugins/linux/lsof.py @@ -34,7 +34,7 @@ class Lsof(plugins.PluginInterface): yield (0, (pid, name, fd_num, full_path)) def run(self): - linux.LinuxUtilities.aslr_mask_symbol_table(self.config, self.context) + linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary']) filter = pslist.PsList.create_filter([self.config.get('pid', None)])