WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-13 21:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Standardize on nt_symbols for standard symboltable requirements.

Browse Source 
It's longer to type, but people shouldn't be typing it directly.
They should be pulling the value from the config and using that, which
can default to 'nt' if necessary.
This commit is contained in:
Mike Auty
2017-11-13 01:27:22 +00:00
parent 330832e546
commit b075d8c31c
6 changed files with 16 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/layers/registry.py
+2 -2
View File
@@ -24,7 +24,7 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface):
self._base_layer = self.config["base_layer"]
self._hive_offset = self.config["hive_offset"]
self._table_name = self.config["ntsymbols"]
self._table_name = self.config["nt_symbols"]
self._reg_table_name = context.symbol_space.free_table_name("registry")
@@ -127,7 +127,7 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface):
def get_requirements(cls):
return [IntRequirement(name = 'hive_offset', description = '', default = 0, optional = False),
requirements.SymbolRequirement(name = "ntsymbols", description = "Windows OS"),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"),
TranslationLayerRequirement(name = 'base_layer', optional = False)]
def _translate(self, offset):
volatility/plugins/windows/hivelist.py
+2 -2
View File
@@ -12,7 +12,7 @@ class HiveList(plugins.PluginInterface):
return [requirements.TranslationLayerRequirement(name = 'primary',
description = 'Kernel Address Space',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt", description = "Windows OS")]
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS")]
def update_configuration(self):
"""No operation since all values provided by config/requirements initially"""
@@ -30,7 +30,7 @@ class HiveList(plugins.PluginInterface):
# We only use the object factory to demonstrate how to use one
kvo = self.context.memory[layer_name].config['kernel_virtual_offset']
ntkrnlmp = self.context.module(self.config["nt"], layer_name = layer_name, offset = kvo)
ntkrnlmp = self.context.module(self.config["nt_symbols"], layer_name = layer_name, offset = kvo)
list_head = ntkrnlmp.get_symbol("CmpHiveListHead").address
list_entry = ntkrnlmp.object(type_name = "_LIST_ENTRY", offset = kvo + list_head)
volatility/plugins/windows/modules.py
+2 -2
View File
@@ -13,7 +13,7 @@ class Modules(plugins.PluginInterface):
return [requirements.TranslationLayerRequirement(name = 'primary',
description = 'Kernel Address Space',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt", description = "Windows OS")]
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS")]
def update_configuration(self):
"""No operation since all values provided by config/requirements initially"""
@@ -44,7 +44,7 @@ class Modules(plugins.PluginInterface):
layer_name = self.config['primary']
kvo = self.context.memory[layer_name].config['kernel_virtual_offset']
ntkrnlmp = self.context.module(self.config["nt"], layer_name = layer_name, offset = kvo)
ntkrnlmp = self.context.module(self.config["nt_symbols"], layer_name = layer_name, offset = kvo)
list_head = ntkrnlmp.get_symbol("PsLoadedModuleList").address
list_entry = ntkrnlmp.object(type_name = "_LIST_ENTRY", offset = kvo + list_head)
volatility/plugins/windows/printkey.py
+2 -2
View File
@@ -73,7 +73,7 @@ class PrintKey(plugins.PluginInterface):
try:
import volatility.plugins.windows.hivelist as hivelist
plugin_config_path = self.make_subconfig(primary = self.config['primary'],
nt = self.config['ntsymbols'])
nt_symbols = self.config['nt_symbols'])
plugin = hivelist.HiveList(self.context, plugin_config_path)
hive_offsets = [hive.vol.offset for hive in plugin.list_hives()]
except:
@@ -86,7 +86,7 @@ class PrintKey(plugins.PluginInterface):
# Construct the hive
reg_config_path = self.make_subconfig(hive_offset = hive_offset,
base_layer = self.config['primary'],
ntsymbols = self.config['ntsymbols'])
nt_symbols = self.config['nt_symbols'])
hive = RegistryHive(self.context, reg_config_path, name = 'hive' + hex(hive_offset), os = 'Windows')
self.context.memory.add_layer(hive)
volatility/plugins/windows/pslist.py
+4 -4
View File
@@ -11,7 +11,7 @@ class PsList(plugins.PluginInterface):
return [requirements.TranslationLayerRequirement(name = 'primary',
description = 'Kernel Address Space',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt", description = "Windows OS"),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"),
requirements.IntRequirement(name = 'pid',
description = "Process ID",
optional = True)]
@@ -32,7 +32,7 @@ class PsList(plugins.PluginInterface):
# We only use the object factory to demonstrate how to use one
kvo = self.context.memory[layer_name].config['kernel_virtual_offset']
ntkrnlmp = self.context.module(self.config['nt'], layer_name = layer_name, offset = kvo)
ntkrnlmp = self.context.module(self.config['nt_symbols'], layer_name = layer_name, offset = kvo)
ps_aph_offset = ntkrnlmp.get_symbol("PsActiveProcessHead").address
list_entry = ntkrnlmp.object(type_name = "_LIST_ENTRY", offset = kvo + ps_aph_offset)
@@ -41,11 +41,11 @@ class PsList(plugins.PluginInterface):
#
# ```
# reloff = self.context.symbol_space.get_type(
# self.config['nt'] + constants.BANG + "_EPROCESS").relative_child_offset(
# self.config['nt_symbols'] + constants.BANG + "_EPROCESS").relative_child_offset(
# "ActiveProcessLinks")
# ```
#
# Note: "nt!_EPROCESS" could have been used, but would rely on the "nt" symbol table not already
# Note: "nt_symbols!_EPROCESS" could have been used, but would rely on the "nt_symbols" symbol table not already
# having been present. Strictly, the value of the requirement should be joined with the BANG character
# defined in the constants file
reloff = ntkrnlmp.get_type("_EPROCESS").relative_child_offset("ActiveProcessLinks")
volatility/plugins/windows/volshell.py
+4 -4
View File
@@ -11,7 +11,7 @@ class Volshell(plugins.PluginInterface):
@classmethod
def get_requirements(cls):
return (volshell.Volshell.get_requirements() +
[requirements.SymbolRequirement(name = "nt", description = "Windows OS"),
[requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"),
requirements.IntRequirement(name = 'pid',
description = "Process ID",
optional = True)])
@@ -25,7 +25,7 @@ class Volshell(plugins.PluginInterface):
# We only use the object factory to demonstrate how to use one
layer_name = self.config['primary']
kvo = self.context.memory[layer_name].config['kernel_virtual_offset']
ntkrnlmp = self.context.module(self.config['nt'], layer_name = layer_name, offset = kvo)
ntkrnlmp = self.context.module(self.config['nt_symbols'], layer_name = layer_name, offset = kvo)
ps_aph_offset = ntkrnlmp.get_symbol("PsActiveProcessHead").address
list_entry = ntkrnlmp.object(type_name = "_LIST_ENTRY", offset = kvo + ps_aph_offset)
@@ -34,7 +34,7 @@ class Volshell(plugins.PluginInterface):
#
# ```
# reloff = self.context.symbol_space.get_type(
# self.config['nt'] + constants.BANG + "_EPROCESS").relative_child_offset(
# self.config['nt_symbols'] + constants.BANG + "_EPROCESS").relative_child_offset(
# "ActiveProcessLinks")
# ```
#
@@ -54,7 +54,7 @@ class Volshell(plugins.PluginInterface):
# Provide some OS-agnostic convenience elements for ease
layer_name = self.config['primary']
kvo = self.context.memory[layer_name].config['kernel_virtual_offset']
nt = self.context.module(self.config['nt'], layer_name = layer_name, offset = kvo)
nt = self.context.module(self.config['nt_symbols'], layer_name = layer_name, offset = kvo)
ps = lambda: list(self.list_processes())