From 984615ebba4a1cb0fb731bfd9d0c14a3d378a2f8 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Thu, 27 Dec 2018 16:07:06 -0600 Subject: [PATCH] fix plugins for new API --- volatility/framework/plugins/linux/elfs.py | 2 +- volatility/framework/plugins/linux/malfind.py | 2 +- volatility/framework/plugins/linux/proc.py | 2 +- volatility/framework/plugins/linux/pslist.py | 11 ++++++++--- .../framework/symbols/linux/extensions/__init__.py | 13 ++++++------- 5 files changed, 17 insertions(+), 13 deletions(-) diff --git a/volatility/framework/plugins/linux/elfs.py b/volatility/framework/plugins/linux/elfs.py index ecd924022..936f03d45 100644 --- a/volatility/framework/plugins/linux/elfs.py +++ b/volatility/framework/plugins/linux/elfs.py @@ -57,7 +57,7 @@ class Elfs(plugins.PluginInterface): if not (hdr[0] == 0x7f and hdr[1] == 0x45 and hdr[2] == 0x4c and hdr[3] == 0x46): continue - path = vma.get_name(task) + path = vma.get_name(self.context, task) yield (0, (task.pid, name, format_hints.Hex(vma.vm_start), format_hints.Hex(vma.vm_end), path)) diff --git a/volatility/framework/plugins/linux/malfind.py b/volatility/framework/plugins/linux/malfind.py index 5b599086b..04f9ea6bf 100644 --- a/volatility/framework/plugins/linux/malfind.py +++ b/volatility/framework/plugins/linux/malfind.py @@ -53,7 +53,7 @@ class Malfind(interfaces_plugins.PluginInterface): proc_layer = self.context.memory[proc_layer_name] for vma in task.mm.get_mmap_iter(): - if vma.is_suspicious() and vma.get_name(task) != "[vdso]": + if vma.is_suspicious() and vma.get_name(self.context, task) != "[vdso]": data = proc_layer.read(vma.vm_start, 64, pad = True) yield vma, data diff --git a/volatility/framework/plugins/linux/proc.py b/volatility/framework/plugins/linux/proc.py index cbd24b692..d9f7c7306 100644 --- a/volatility/framework/plugins/linux/proc.py +++ b/volatility/framework/plugins/linux/proc.py @@ -63,7 +63,7 @@ class Maps(plugins.PluginInterface): minor = inode_object.i_sb.minor inode = inode_object.i_ino - path = vma.get_name(task) + path = vma.get_name(self.context, task) yield (0, (task.pid, name, format_hints.Hex(vma.vm_start), format_hints.Hex(vma.vm_end), flags, format_hints.Hex(page_offset), major, minor, inode, path)) diff --git a/volatility/framework/plugins/linux/pslist.py b/volatility/framework/plugins/linux/pslist.py index 9af1f7318..edad5949e 100644 --- a/volatility/framework/plugins/linux/pslist.py +++ b/volatility/framework/plugins/linux/pslist.py @@ -21,7 +21,7 @@ from typing import Callable, Iterable, List import volatility.framework.interfaces.plugins as interfaces_plugins -from volatility.framework import renderers, interfaces +from volatility.framework import renderers, interfaces, contexts from volatility.framework.automagic import linux from volatility.framework.configuration import requirements from volatility.framework.objects import utility @@ -72,9 +72,14 @@ class PsList(interfaces_plugins.PluginInterface): vmlinux_symbols: str, filter: Callable[[int], bool] = lambda _: False) -> Iterable[interfaces.objects.ObjectInterface]: """Lists all the tasks in the primary layer""" + linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name) - _, aslr_shift = linux.LinuxUtilities.find_aslr(context, vmlinux_symbols, layer_name) - vmlinux = context.module(vmlinux_symbols, layer_name, aslr_shift) + vmlinux = contexts.Module(context, + vmlinux_symbols, + layer_name, + 0, + absolute_symbol_addresses = True) + init_task = vmlinux.object(symbol_name = "init_task") for task in init_task.tasks: diff --git a/volatility/framework/symbols/linux/extensions/__init__.py b/volatility/framework/symbols/linux/extensions/__init__.py index 1ae44ec0f..f079ebe29 100644 --- a/volatility/framework/symbols/linux/extensions/__init__.py +++ b/volatility/framework/symbols/linux/extensions/__init__.py @@ -214,9 +214,9 @@ class vm_area_struct(objects.Struct): return self.vm_pgoff << constants.linux.PAGE_SHIFT - def get_name(self, task): + def get_name(self, context, task): if self.vm_file != 0: - fname = linux.LinuxUtilities.path_for_file(task, self.vm_file) + fname = linux.LinuxUtilities.path_for_file(context, task, self.vm_file) elif self.vm_start <= task.mm.start_brk and self.vm_end >= task.mm.brk: fname = "[heap]" elif self.vm_start <= task.mm.start_stack and self.vm_end >= task.mm.start_stack: @@ -230,19 +230,18 @@ class vm_area_struct(objects.Struct): # used by malfind def is_suspicious(self): - ret = True + ret = False flags_str = self.get_protection() - if flags_str.find("VM_READ|VM_WRITE|VM_EXEC") != -1: + if flags_str == "rwx": ret = True - elif flags_str == "VM_READ|VM_EXEC" and self.vm_file != 0: + elif flags_str == "r-x" and self.vm_file.dereference().vol.offset == 0: ret = True - + return ret - class qstr(objects.Struct): def name_as_str(self) -> str: