WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-12 04:37:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Convert all remaining plugins to use the new classmethod pslist.

Browse Source
This commit is contained in:
Mike Auty
2018-06-16 13:38:48 +01:00
parent 6ca34e6607
commit ac8401991c
13 changed files with 89 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/layers/registry.py
+4 -5
View File
@@ -47,11 +47,10 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface):
# Win10 17063 introduced the Registry process to map most hives. Check
# if it exists and update RegistryHive._base_layer
pslist_config_path = self.make_subconfig(primary=self.config['base_layer'],
nt_symbols=self.config['nt_symbols'])
plugin = pslist.PsList(self.context, pslist_config_path)
for proc in plugin.list_processes():
proc_name = proc.ImageFileName.cast("string", max_length=proc.ImageFileName.vol.count,
for proc in pslist.PsList.list_processes(self.context,
self.config['base_layer'],
self.config['nt_symbols']):
proc_name = proc.ImageFileName.cast("string", max_length = proc.ImageFileName.vol.count,
errors = 'replace')
if proc_name == "Registry" and proc.InheritedFromUniqueProcessId == 4:
proc_layer_name = proc.add_process_layer()
volatility/plugins/linux/proc.py
+3 -3
View File
@@ -54,8 +54,6 @@ class Maps(plugins.PluginInterface):
))
def run(self):
plugin = pslist.PsList(self.context, self.config_path)
return renderers.TreeGrid(
[("PID", int),
("Process", str),
@@ -67,4 +65,6 @@ class Maps(plugins.PluginInterface):
("Minor", int),
("Inode", int),
("File Path", str)],
self._generator(plugin.list_tasks()))
self._generator(pslist.PsList.list_tasks(self.context,
self.config['primary'],
self.config['vmlinux'])))
volatility/plugins/linux/pslist.py
+5 -4
View File
@@ -25,13 +25,14 @@ class PsList(interfaces_plugins.PluginInterface):
name = utility.array_to_string(task.comm)
yield (0, (pid, ppid, name))
def list_tasks(self):
@classmethod
def list_tasks(cls, context, primary_layer: str, vmlinux_table: str):
"""Lists all the tasks in the primary layer"""
layer_name = self.context.memory[self.config['primary']].config['memory_layer']
layer_name = context.memory[primary_layer].config['memory_layer']
_, aslr_shift = linux.LinuxUtilities.find_aslr(self.context, self.config["vmlinux"], layer_name)
vmlinux = self.context.module(self.config["vmlinux"], self.config["primary"], aslr_shift)
_, aslr_shift = linux.LinuxUtilities.find_aslr(context, vmlinux_table, layer_name)
vmlinux = context.module(vmlinux_table, primary_layer, aslr_shift)
init_task = vmlinux.object(symbol_name = "init_task")
for task in init_task.tasks:
volatility/plugins/windows/dlldump.py
+11 -6
View File
@@ -1,16 +1,18 @@
import logging, ntpath
import logging
import ntpath
import volatility.framework.constants as constants
import volatility.framework.interfaces.plugins as interfaces_plugins
import volatility.plugins.windows.pslist as pslist
import volatility.plugins.windows.vadinfo as vadinfo
from volatility.framework import interfaces
from volatility.framework import renderers
from volatility.framework.objects import utility
import volatility.framework.constants as constants
from volatility.framework.symbols.windows.pe import PEIntermedSymbols
vollog = logging.getLogger(__name__)
class DllDump(interfaces_plugins.PluginInterface):
"""Dumps process memory ranges as DLLs"""
@@ -59,8 +61,8 @@ class DllDump(interfaces_plugins.PluginInterface):
vad.get_start()))
dos_header = self.context.object(pe_table_name + constants.BANG +
"_IMAGE_DOS_HEADER", offset=vad.get_start(),
layer_name=proc_layer_name)
"_IMAGE_DOS_HEADER", offset = vad.get_start(),
layer_name = proc_layer_name)
for offset, data in dos_header.reconstruct():
filedata.data.seek(offset)
@@ -76,9 +78,12 @@ class DllDump(interfaces_plugins.PluginInterface):
result_text))
def run(self):
plugin = pslist.PsList(self.context, self.config_path)
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int),
("Process", str),
("Result", str)],
self._generator(plugin.list_processes()))
self._generator(pslist.PsList.list_processes(self.context,
self.config['primary'],
self.config['nt_symbols'],
filter = filter)))
volatility/plugins/windows/dlllist.py
+5 -2
View File
@@ -34,7 +34,7 @@ class DllList(interfaces_plugins.PluginInterface):
def run(self):
plugin = pslist.PsList(self.context, self.config_path)
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int),
("Process", str),
@@ -42,4 +42,7 @@ class DllList(interfaces_plugins.PluginInterface):
("Size", format_hints.Hex),
("Name", str),
("Path", str)],
self._generator(plugin.list_processes()))
self._generator(pslist.PsList.list_processes(self.context,
self.config['primary'],
self.config['nt_symbols'],
filter = filter)))
volatility/plugins/windows/handles.py
+5 -2
View File
@@ -304,7 +304,7 @@ class Handles(interfaces_plugins.PluginInterface):
def run(self):
plugin = pslist.PsList(self.context, self.config_path)
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int),
("Process", str),
@@ -312,4 +312,7 @@ class Handles(interfaces_plugins.PluginInterface):
("Type", str),
("GrantedAccess", format_hints.Hex),
("Name", str)],
self._generator(plugin.list_processes()))
self._generator(pslist.PsList.list_processes(self.context,
self.config['primary'],
self.config['nt_symbols'],
filter = filter)))
volatility/plugins/windows/malfind.py
+3 -1
View File
@@ -103,6 +103,7 @@ class Malfind(interfaces_plugins.PluginInterface):
disasm))
def run(self):
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int),
("Process", str),
@@ -116,4 +117,5 @@ class Malfind(interfaces_plugins.PluginInterface):
("Disasm", interfaces_renderers.Disassembly)],
self._generator(pslist.PsList.list_processes(self.context,
self.config['primary'],
self.config['nt_symbols'])))
self.config['nt_symbols'],
filter = filter)))
volatility/plugins/windows/moddump.py
+14 -10
View File
@@ -1,15 +1,17 @@
import logging
import volatility.framework.interfaces.plugins as interfaces_plugins
import volatility.plugins.windows.modules as modules
import volatility.plugins.windows.pslist as pslist
import volatility.framework.renderers as renderers
import volatility.framework.constants as constants
import volatility.framework.exceptions as exceptions
import volatility.framework.interfaces.plugins as interfaces_plugins
import volatility.framework.renderers as renderers
import volatility.plugins.windows.modules as modules
import volatility.plugins.windows.pslist as pslist
from volatility.framework.renderers import format_hints
from volatility.framework.symbols.windows.pe import PEIntermedSymbols
vollog = logging.getLogger(__name__)
class ModDump(interfaces_plugins.PluginInterface):
"""Dumps kernel modules"""
@@ -31,17 +33,19 @@ class ModDump(interfaces_plugins.PluginInterface):
layers = [layer_name]
seen_ids = []
plugin = pslist.PsList(self.context, self.config_path)
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
for proc in plugin.list_processes():
for proc in pslist.PsList.list_processes(self.context,
self.config['primary'],
self.config['nt_symbols']):
proc_layer_name = proc.add_process_layer()
try:
# create the session space object in the process' own layer.
# not all processes have a valid session pointer.
session_space = self.context.object(self.config["nt_symbols"] + constants.BANG + "_MM_SESSION_SPACE",
layer_name=layer_name,
offset=proc.Session)
layer_name = layer_name,
offset = proc.Session)
if session_space.SessionId in seen_ids:
continue
@@ -93,8 +97,8 @@ class ModDump(interfaces_plugins.PluginInterface):
else:
try:
dos_header = self.context.object(pe_table_name + constants.BANG +
"_IMAGE_DOS_HEADER", offset=mod.DllBase,
layer_name=session_layer_name)
"_IMAGE_DOS_HEADER", offset = mod.DllBase,
layer_name = session_layer_name)
filedata = interfaces_plugins.FileInterface(
"module.{0:#x}.dmp".format(mod.DllBase))
volatility/plugins/windows/procdump.py
+14 -9
View File
@@ -1,14 +1,16 @@
import logging
import volatility.framework.interfaces.plugins as interfaces_plugins
import volatility.plugins.windows.pslist as pslist
import volatility.framework.renderers as renderers
import volatility.framework.constants as constants
import volatility.framework.exceptions as exceptions
import volatility.framework.interfaces.plugins as interfaces_plugins
import volatility.framework.renderers as renderers
import volatility.plugins.windows.pslist as pslist
from volatility.framework.objects import utility
from volatility.framework.symbols.windows.pe import PEIntermedSymbols
vollog = logging.getLogger(__name__)
class ProcDump(interfaces_plugins.PluginInterface):
"""Dumps process executable images"""
@@ -31,12 +33,12 @@ class ProcDump(interfaces_plugins.PluginInterface):
try:
peb = self._context.object(self.config["nt_symbols"] + constants.BANG + "_PEB",
layer_name=proc_layer_name,
offset=proc.Peb)
layer_name = proc_layer_name,
offset = proc.Peb)
dos_header = self.context.object(pe_table_name + constants.BANG +
"_IMAGE_DOS_HEADER", offset=peb.ImageBaseAddress,
layer_name=proc_layer_name)
"_IMAGE_DOS_HEADER", offset = peb.ImageBaseAddress,
layer_name = proc_layer_name)
filedata = interfaces_plugins.FileInterface(
"pid.{0}.{1:#x}.dmp".format(proc.UniqueProcessId, peb.ImageBaseAddress))
@@ -62,9 +64,12 @@ class ProcDump(interfaces_plugins.PluginInterface):
result_text))
def run(self):
plugin = pslist.PsList(self.context, self.config_path)
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int),
("Process", str),
("Result", str)],
self._generator(plugin.list_processes()))
self._generator(pslist.PsList.list_processes(self.context,
self.config['primary'],
self.config['nt_symbols'],
filter = filter)))
volatility/plugins/windows/pslist.py
+12 -6
View File
@@ -1,4 +1,5 @@
import datetime
import typing
import volatility.framework.interfaces.plugins as plugins
from volatility.framework import renderers
@@ -27,14 +28,19 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface):
default = cls.PHYSICAL_DEFAULT,
optional = True)]
@classmethod
def create_filter(cls, pid_list: typing.List[int] = None):
filter = lambda _: False
if [x for x in pid_list if x is not None]:
filter = lambda x: x not in pid_list
return filter
def _generator(self):
filter = lambda _: False
if self.config.get('pid', None):
filter = lambda x: x != self.config['pid']
for proc in self.list_processes(self.context, self.config['primary'], self.config['nt_symbols'],
filter = filter):
for proc in self.list_processes(self.context,
self.config['primary'],
self.config['nt_symbols'],
filter = self.create_filter([self.config.get('pid', None)])):
if not self.config.get('physical', self.PHYSICAL_DEFAULT):
offset = proc.vol.offset
volatility/plugins/windows/strings.py
+3 -3
View File
@@ -72,9 +72,9 @@ class Strings(interfaces.plugins.PluginInterface):
# TODO: Include kernel modules
plugin = pslist.PsList(self.context, self.config_path)
for process in plugin.list_processes():
for process in pslist.PsList.list_processes(self.context,
self.config['primary'],
self.config['nt_symbols']):
proc_layer_name = process.add_process_layer()
proc_layer = self.context.memory[proc_layer_name]
if isinstance(proc_layer, interfaces.layers.TranslationLayerInterface):
volatility/plugins/windows/vaddump.py
+5 -2
View File
@@ -56,9 +56,12 @@ class VadDump(interfaces_plugins.PluginInterface):
result_text))
def run(self):
plugin = pslist.PsList(self.context, self.config_path)
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int),
("Process", str),
("Result", str)],
self._generator(plugin.list_processes()))
self._generator(pslist.PsList.list_processes(self.context,
self.config['primary'],
self.config['nt_symbols'],
filter = filter)))
volatility/plugins/windows/vadinfo.py
+5 -2
View File
@@ -91,7 +91,7 @@ class VadInfo(interfaces_plugins.PluginInterface):
def run(self):
plugin = pslist.PsList(self.context, self.config_path)
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int),
("Process", str),
@@ -104,4 +104,7 @@ class VadInfo(interfaces_plugins.PluginInterface):
("PrivateMemory", int),
("Parent", format_hints.Hex),
("File", str)],
self._generator(plugin.list_processes()))
self._generator(pslist.PsList.list_processes(self.context,
self.config['primary'],
self.config['nt_symbols'],
filter = filter)))