WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-22 17:44:52 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add API for mapping kernel addresses to kernel symbols or a specific kext

Browse Source
This commit is contained in:
Andrew Case
2020-04-08 18:17:34 +01:00
committed by ikelos
parent d5bdf9633d
commit b42dfd614a
6 changed files with 139 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/mac/check_trap_table.py
+19 -13
View File
@@ -3,7 +3,7 @@
#
import logging
from typing import List
from typing import List, Iterator, Any
from volatility.framework import exceptions, interfaces
from volatility.framework import renderers, constants, contexts
@@ -11,6 +11,7 @@ from volatility.framework.automagic import mac
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.renderers import format_hints
from volatility.plugins.mac import lsmod
vollog = logging.getLogger(__name__)
@@ -24,35 +25,40 @@ class Check_trap_table(plugins.PluginInterface):
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols")
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"),
requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0))
]
def _generator(self):
def _generator(self, mods: Iterator[Any]):
mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
table = kernel.object_from_symbol(symbol_name = "mach_trap_table")
for i, ent in enumerate(table):
try:
call_addr = ent.mach_trap_function.dereference().vol.offset
except exceptions.InvalidPagedAddressException:
except exceptions.InvalidAddressException:
continue
if not call_addr or call_addr == 0:
continue
symbols = list(self.context.symbol_space.get_symbols_by_location(call_addr))
module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, call_addr)
if len(symbols) > 0:
sym_name = str(symbols[0].split(constants.BANG)[1]) if constants.BANG in symbols[0] else \
str(symbols[0])
else:
sym_name = "UNKNOWN"
yield (0, (format_hints.Hex(table.vol.offset), "TrapTable", i, format_hints.Hex(call_addr), sym_name))
yield (0, (format_hints.Hex(table.vol.offset), "TrapTable", i, format_hints.Hex(call_addr), module_name, symbol_name))
def run(self):
return renderers.TreeGrid([("Table Address", format_hints.Hex), ("Table Name", str), ("Index", int),
("Handler Address", format_hints.Hex), ("Handler Symbol", str)], self._generator())
("Handler Address", format_hints.Hex), ("Handler Module", str), ("Handler Symbol", str)],
self._generator(
lsmod.Lsmod.list_modules(self.context, self.config['primary'],
self.config['darwin'])))