WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 03:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add API for mapping kernel addresses to kernel symbols or a specific kext

Browse Source
This commit is contained in:
Andrew Case
2020-04-08 18:17:34 +01:00
committed by ikelos
parent d5bdf9633d
commit b42dfd614a
6 changed files with 139 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/mac/check_sysctl.py
+18 -18
View File
@@ -2,7 +2,7 @@
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
import logging
from typing import List
from typing import List, Iterator, Any
import volatility
from volatility.framework import exceptions, interfaces
@@ -12,6 +12,7 @@ from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.renderers import format_hints
from volatility.framework.objects import utility
from volatility.plugins.mac import lsmod
vollog = logging.getLogger(__name__)
@@ -25,7 +26,8 @@ class Check_sysctl(plugins.PluginInterface):
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols")
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"),
requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0))
]
def _parse_global_variable_sysctls(self, kernel, name):
@@ -109,30 +111,28 @@ class Check_sysctl(plugins.PluginInterface):
except exceptions.InvalidAddressException:
break
def _generator(self):
def _generator(self, mods: Iterator[Any]):
mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
sysctl_list = kernel.object_from_symbol(symbol_name = "sysctl__children")
for sysctl, name, val in self._process_sysctl_list(kernel, sysctl_list):
check_addr = sysctl.oid_handler
try:
check_addr = sysctl.oid_handler
except exceptions.InvalidAddressException:
continue
if check_addr == 0:
sym_name = "<No Handler>"
else:
symbols = list(self.context.symbol_space.get_symbols_by_location(check_addr))
module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, check_addr)
if len(symbols) > 0:
sym_name = str(symbols[0].split(constants.BANG)[1]) if constants.BANG in symbols[0] else \
str(symbols[0])
else:
sym_name = "UNKNOWN"
yield (0, (name, sysctl.oid_number, sysctl.get_perms(), format_hints.Hex(check_addr), val, sym_name))
yield (0, (name, sysctl.oid_number, sysctl.get_perms(), format_hints.Hex(check_addr), val, module_name, symbol_name))
def run(self):
return renderers.TreeGrid([("Name", str), ("Number", int), ("Perms", str),
("Handler Address", format_hints.Hex), ("Value", str), ("Handler Symbol", str)],
self._generator())
return renderers.TreeGrid([("Name", str), ("Number", int), ("Perms", str), ("Handler Address", format_hints.Hex),
("Value", str), ("Handler Module", str), ("Handler Symbol", str)],
self._generator(
lsmod.Lsmod.list_modules(self.context, self.config['primary'],
self.config['darwin'])))