From b075d8c31cfc044da9628c3a2e18316288a5a8c1 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 13 Nov 2017 01:25:35 +0000 Subject: [PATCH] Standardize on nt_symbols for standard symboltable requirements. It's longer to type, but people shouldn't be typing it directly. They should be pulling the value from the config and using that, which can default to 'nt' if necessary. --- volatility/framework/layers/registry.py | 4 ++-- volatility/plugins/windows/hivelist.py | 4 ++-- volatility/plugins/windows/modules.py | 4 ++-- volatility/plugins/windows/printkey.py | 4 ++-- volatility/plugins/windows/pslist.py | 8 ++++---- volatility/plugins/windows/volshell.py | 8 ++++---- 6 files changed, 16 insertions(+), 16 deletions(-) diff --git a/volatility/framework/layers/registry.py b/volatility/framework/layers/registry.py index 410aac652..b0112d9fe 100644 --- a/volatility/framework/layers/registry.py +++ b/volatility/framework/layers/registry.py @@ -24,7 +24,7 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface): self._base_layer = self.config["base_layer"] self._hive_offset = self.config["hive_offset"] - self._table_name = self.config["ntsymbols"] + self._table_name = self.config["nt_symbols"] self._reg_table_name = context.symbol_space.free_table_name("registry") @@ -127,7 +127,7 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface): def get_requirements(cls): return [IntRequirement(name = 'hive_offset', description = '', default = 0, optional = False), - requirements.SymbolRequirement(name = "ntsymbols", description = "Windows OS"), + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"), TranslationLayerRequirement(name = 'base_layer', optional = False)] def _translate(self, offset): diff --git a/volatility/plugins/windows/hivelist.py b/volatility/plugins/windows/hivelist.py index aea77284a..7d6464ef2 100644 --- a/volatility/plugins/windows/hivelist.py +++ b/volatility/plugins/windows/hivelist.py @@ -12,7 +12,7 @@ class HiveList(plugins.PluginInterface): return [requirements.TranslationLayerRequirement(name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt", description = "Windows OS")] + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS")] def update_configuration(self): """No operation since all values provided by config/requirements initially""" @@ -30,7 +30,7 @@ class HiveList(plugins.PluginInterface): # We only use the object factory to demonstrate how to use one kvo = self.context.memory[layer_name].config['kernel_virtual_offset'] - ntkrnlmp = self.context.module(self.config["nt"], layer_name = layer_name, offset = kvo) + ntkrnlmp = self.context.module(self.config["nt_symbols"], layer_name = layer_name, offset = kvo) list_head = ntkrnlmp.get_symbol("CmpHiveListHead").address list_entry = ntkrnlmp.object(type_name = "_LIST_ENTRY", offset = kvo + list_head) diff --git a/volatility/plugins/windows/modules.py b/volatility/plugins/windows/modules.py index d7b172211..c6d3c985d 100644 --- a/volatility/plugins/windows/modules.py +++ b/volatility/plugins/windows/modules.py @@ -13,7 +13,7 @@ class Modules(plugins.PluginInterface): return [requirements.TranslationLayerRequirement(name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt", description = "Windows OS")] + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS")] def update_configuration(self): """No operation since all values provided by config/requirements initially""" @@ -44,7 +44,7 @@ class Modules(plugins.PluginInterface): layer_name = self.config['primary'] kvo = self.context.memory[layer_name].config['kernel_virtual_offset'] - ntkrnlmp = self.context.module(self.config["nt"], layer_name = layer_name, offset = kvo) + ntkrnlmp = self.context.module(self.config["nt_symbols"], layer_name = layer_name, offset = kvo) list_head = ntkrnlmp.get_symbol("PsLoadedModuleList").address list_entry = ntkrnlmp.object(type_name = "_LIST_ENTRY", offset = kvo + list_head) diff --git a/volatility/plugins/windows/printkey.py b/volatility/plugins/windows/printkey.py index a6c6a7559..659ddae89 100644 --- a/volatility/plugins/windows/printkey.py +++ b/volatility/plugins/windows/printkey.py @@ -73,7 +73,7 @@ class PrintKey(plugins.PluginInterface): try: import volatility.plugins.windows.hivelist as hivelist plugin_config_path = self.make_subconfig(primary = self.config['primary'], - nt = self.config['ntsymbols']) + nt_symbols = self.config['nt_symbols']) plugin = hivelist.HiveList(self.context, plugin_config_path) hive_offsets = [hive.vol.offset for hive in plugin.list_hives()] except: @@ -86,7 +86,7 @@ class PrintKey(plugins.PluginInterface): # Construct the hive reg_config_path = self.make_subconfig(hive_offset = hive_offset, base_layer = self.config['primary'], - ntsymbols = self.config['ntsymbols']) + nt_symbols = self.config['nt_symbols']) hive = RegistryHive(self.context, reg_config_path, name = 'hive' + hex(hive_offset), os = 'Windows') self.context.memory.add_layer(hive) diff --git a/volatility/plugins/windows/pslist.py b/volatility/plugins/windows/pslist.py index 6b9a6ba9b..00a269fb8 100644 --- a/volatility/plugins/windows/pslist.py +++ b/volatility/plugins/windows/pslist.py @@ -11,7 +11,7 @@ class PsList(plugins.PluginInterface): return [requirements.TranslationLayerRequirement(name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt", description = "Windows OS"), + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"), requirements.IntRequirement(name = 'pid', description = "Process ID", optional = True)] @@ -32,7 +32,7 @@ class PsList(plugins.PluginInterface): # We only use the object factory to demonstrate how to use one kvo = self.context.memory[layer_name].config['kernel_virtual_offset'] - ntkrnlmp = self.context.module(self.config['nt'], layer_name = layer_name, offset = kvo) + ntkrnlmp = self.context.module(self.config['nt_symbols'], layer_name = layer_name, offset = kvo) ps_aph_offset = ntkrnlmp.get_symbol("PsActiveProcessHead").address list_entry = ntkrnlmp.object(type_name = "_LIST_ENTRY", offset = kvo + ps_aph_offset) @@ -41,11 +41,11 @@ class PsList(plugins.PluginInterface): # # ``` # reloff = self.context.symbol_space.get_type( - # self.config['nt'] + constants.BANG + "_EPROCESS").relative_child_offset( + # self.config['nt_symbols'] + constants.BANG + "_EPROCESS").relative_child_offset( # "ActiveProcessLinks") # ``` # - # Note: "nt!_EPROCESS" could have been used, but would rely on the "nt" symbol table not already + # Note: "nt_symbols!_EPROCESS" could have been used, but would rely on the "nt_symbols" symbol table not already # having been present. Strictly, the value of the requirement should be joined with the BANG character # defined in the constants file reloff = ntkrnlmp.get_type("_EPROCESS").relative_child_offset("ActiveProcessLinks") diff --git a/volatility/plugins/windows/volshell.py b/volatility/plugins/windows/volshell.py index c7f121094..902c76cea 100644 --- a/volatility/plugins/windows/volshell.py +++ b/volatility/plugins/windows/volshell.py @@ -11,7 +11,7 @@ class Volshell(plugins.PluginInterface): @classmethod def get_requirements(cls): return (volshell.Volshell.get_requirements() + - [requirements.SymbolRequirement(name = "nt", description = "Windows OS"), + [requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"), requirements.IntRequirement(name = 'pid', description = "Process ID", optional = True)]) @@ -25,7 +25,7 @@ class Volshell(plugins.PluginInterface): # We only use the object factory to demonstrate how to use one layer_name = self.config['primary'] kvo = self.context.memory[layer_name].config['kernel_virtual_offset'] - ntkrnlmp = self.context.module(self.config['nt'], layer_name = layer_name, offset = kvo) + ntkrnlmp = self.context.module(self.config['nt_symbols'], layer_name = layer_name, offset = kvo) ps_aph_offset = ntkrnlmp.get_symbol("PsActiveProcessHead").address list_entry = ntkrnlmp.object(type_name = "_LIST_ENTRY", offset = kvo + ps_aph_offset) @@ -34,7 +34,7 @@ class Volshell(plugins.PluginInterface): # # ``` # reloff = self.context.symbol_space.get_type( - # self.config['nt'] + constants.BANG + "_EPROCESS").relative_child_offset( + # self.config['nt_symbols'] + constants.BANG + "_EPROCESS").relative_child_offset( # "ActiveProcessLinks") # ``` # @@ -54,7 +54,7 @@ class Volshell(plugins.PluginInterface): # Provide some OS-agnostic convenience elements for ease layer_name = self.config['primary'] kvo = self.context.memory[layer_name].config['kernel_virtual_offset'] - nt = self.context.module(self.config['nt'], layer_name = layer_name, offset = kvo) + nt = self.context.module(self.config['nt_symbols'], layer_name = layer_name, offset = kvo) ps = lambda: list(self.list_processes())