WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-13 05:07:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add API for mapping kernel addresses to kernel symbols or a specific kext

Browse Source
This commit is contained in:
Andrew Case
2020-04-08 18:17:34 +01:00
committed by ikelos
parent d5bdf9633d
commit b42dfd614a
6 changed files with 139 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/mac/check_syscall.py
+15 -12
View File
@@ -2,7 +2,7 @@
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
import logging
from typing import List
from typing import List, Iterator, Any
from volatility.framework import exceptions, interfaces
from volatility.framework import renderers, constants, contexts
@@ -10,6 +10,7 @@ from volatility.framework.automagic import mac
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.renderers import format_hints
from volatility.plugins.mac import lsmod
vollog = logging.getLogger(__name__)
@@ -23,13 +24,16 @@ class Check_syscall(plugins.PluginInterface):
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols")
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"),
requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0))
]
def _generator(self):
def _generator(self, mods: Iterator[Any]):
mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
nsysent = kernel.object_from_symbol(symbol_name = "nsysent")
table = kernel.object_from_symbol(symbol_name = "sysent")
@@ -48,16 +52,15 @@ class Check_syscall(plugins.PluginInterface):
if not call_addr or call_addr == 0:
continue
symbols = list(self.context.symbol_space.get_symbols_by_location(call_addr))
module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, call_addr)
if len(symbols) > 0:
sym_name = str(symbols[0].split(constants.BANG)[1]) if constants.BANG in symbols[0] else \
str(symbols[0])
else:
sym_name = "UNKNOWN"
yield (0, (format_hints.Hex(table.vol.offset), "SysCall", i, format_hints.Hex(call_addr), sym_name))
yield (0, (format_hints.Hex(table.vol.offset), "SysCall", i, format_hints.Hex(call_addr), module_name, symbol_name))
def run(self):
return renderers.TreeGrid([("Table Address", format_hints.Hex), ("Table Name", str), ("Index", int),
("Handler Address", format_hints.Hex), ("Handler Symbol", str)], self._generator())
("Handler Address", format_hints.Hex), ("Handler Module", str), ("Handler Symbol", str)],
self._generator(
lsmod.Lsmod.list_modules(self.context, self.config['primary'],
self.config['darwin'])))