WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-31 12:19:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

major updates and new plugins

Browse Source
This commit is contained in:
Andrew Case
2018-11-08 00:19:17 +00:00
committed by ikelos
parent 63e9cd4604
commit 98e472e211
10 changed files with 561 additions and 214 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/plugins/linux/lsof.py
+18 -29
View File
@@ -3,12 +3,15 @@ typically found in Linux's /proc file system.
"""
import logging
from volatility.framework import interfaces
from volatility.framework.interfaces import plugins
from volatility.framework import renderers
from volatility.framework import constants
from volatility.framework.automagic import linux
from volatility.framework.renderers import format_hints
from volatility.framework.objects import utility
from volatility.framework.symbols import utility as symbols_utility
from volatility.plugins.linux import pslist
vollog = logging.getLogger(__name__)
@@ -21,43 +24,29 @@ class Lsof(plugins.PluginInterface):
# Since we're calling the plugin, make sure we have the plugin's requirements
return pslist.PsList.get_requirements() + []
# yields list of data, e.g.: calculate
def _generator(self, tasks):
layer_name = self.config['primary.memory_layer']
_, aslr_shift = linux.LinuxUtilities.find_aslr(self.context, self.config["vmlinux"], layer_name)
vmlinux = self.context.module(self.config["vmlinux"], self.config["primary"], aslr_shift)
pointer_template = self.context.symbol_space[self.config['vmlinux']].get_type('pointer')
for task in tasks:
fd_table = task.files.get_fds()
if fd_table == 0:
continue
name = str(task.comm)
pid = int(task.pid)
max_fds = task.files.get_max_fds()
proc_name = utility.array_to_string(task.comm)
# corruption check
if max_fds > 500000:
continue
fds = vmlinux.object(type_name="array", offset = fd_table.vol.offset, subtype = pointer_template, count = max_fds)
for (i, fd_ptr) in enumerate(fds):
if fd_ptr:
filp = fd_ptr.dereference().cast(self.config["vmlinux"] + constants.BANG + 'file')
full_path = task.path_for_file(filp, layer_name)
yield (0, (task.pid, proc_name, i, full_path))
for fd_num, _, full_path in linux.LinuxUtilities.files_descriptors_for_process(self.config, self.context, task):
yield (0, (pid, name, fd_num, full_path))
def run(self):
plugin = pslist.PsList(self.context, "plugins.Lsof")
linux.LinuxUtilities.aslr_mask_symbol_table(self.config, self.context)
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
plugin = pslist.PsList.list_tasks
return renderers.TreeGrid(
[("PID", int),
("Process", str),
("FD", int),
("Path", str)],
self._generator(plugin.list_tasks()))
self._generator(plugin(self.context,
self.config['primary'],
self.config['vmlinux'],
filter = filter)))