From be27aab8aee25eb917ade5071037d55243dc5102 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 14 Aug 2019 01:29:47 +0100 Subject: [PATCH] Refactor symbol to object_type (so it doesn't shadow builtin type). --- volatility/cli/volshell/windows.py | 4 +- volatility/framework/automagic/linux.py | 2 +- volatility/framework/contexts/__init__.py | 35 +++++++++------- volatility/framework/interfaces/context.py | 9 ++-- volatility/framework/layers/msf.py | 10 ++--- volatility/framework/layers/registry.py | 4 +- .../framework/plugins/linux/check_afinfo.py | 2 +- .../framework/plugins/linux/check_syscall.py | 2 +- volatility/framework/plugins/linux/lsmod.py | 2 +- volatility/framework/plugins/linux/pslist.py | 2 +- .../framework/plugins/mac/check_syscall.py | 4 +- .../framework/plugins/mac/check_sysctl.py | 4 +- .../framework/plugins/mac/check_trap_table.py | 2 +- volatility/framework/plugins/mac/lsmod.py | 2 +- volatility/framework/plugins/mac/pslist.py | 2 +- .../framework/plugins/mac/trustedbsd.py | 4 +- .../framework/plugins/windows/handles.py | 4 +- volatility/framework/plugins/windows/info.py | 8 ++-- .../framework/plugins/windows/modules.py | 4 +- .../framework/plugins/windows/poolscanner.py | 2 +- .../framework/plugins/windows/pslist.py | 4 +- .../plugins/windows/registry/hivelist.py | 4 +- .../plugins/windows/registry/userassist.py | 2 +- volatility/framework/plugins/windows/ssdt.py | 4 +- .../framework/plugins/windows/vadinfo.py | 2 +- .../symbols/windows/extensions/__init__.py | 2 +- .../framework/symbols/windows/pdbconv.py | 42 +++++++++---------- 27 files changed, 89 insertions(+), 79 deletions(-) diff --git a/volatility/cli/volshell/windows.py b/volatility/cli/volshell/windows.py index 2005c5813..9f0ad5479 100644 --- a/volatility/cli/volshell/windows.py +++ b/volatility/cli/volshell/windows.py @@ -44,7 +44,7 @@ class Volshell(shellplugin.Volshell): ntkrnlmp = self.context.module(self.config['nt_symbols'], layer_name = layer_name, offset = kvo) ps_aph_offset = ntkrnlmp.get_symbol("PsActiveProcessHead").address - list_entry = ntkrnlmp.object(symbol = "_LIST_ENTRY", offset = ps_aph_offset) + list_entry = ntkrnlmp.object(object_type = "_LIST_ENTRY", offset = ps_aph_offset) # This is example code to demonstrate how to use symbol_space directly, rather than through a module: # @@ -58,7 +58,7 @@ class Volshell(shellplugin.Volshell): # having been present. Strictly, the value of the requirement should be joined with the BANG character # defined in the constants file reloff = ntkrnlmp.get_type("_EPROCESS").relative_child_offset("ActiveProcessLinks") - eproc = ntkrnlmp.object(symbol = "_EPROCESS", offset = list_entry.vol.offset - reloff, absolute = True) + eproc = ntkrnlmp.object(object_type = "_EPROCESS", offset = list_entry.vol.offset - reloff, absolute = True) for proc in eproc.ActiveProcessLinks: yield proc diff --git a/volatility/framework/automagic/linux.py b/volatility/framework/automagic/linux.py index a4594dfd1..488ae4673 100644 --- a/volatility/framework/automagic/linux.py +++ b/volatility/framework/automagic/linux.py @@ -303,7 +303,7 @@ class LinuxUtilities(object): progress_callback = progress_callback): task_symbol = module.get_type('task_struct') init_task_address = offset - task_symbol.relative_child_offset('comm') - init_task = module.object(symbol = 'task_struct', offset = init_task_address, absolute = True) + init_task = module.object(object_type = 'task_struct', offset = init_task_address, absolute = True) if init_task.pid != 0: continue elif init_task.has_member('state') and init_task.state.cast('unsigned int') != 0: diff --git a/volatility/framework/contexts/__init__.py b/volatility/framework/contexts/__init__.py index 2ddc46464..ecd9977ac 100644 --- a/volatility/framework/contexts/__init__.py +++ b/volatility/framework/contexts/__init__.py @@ -90,7 +90,7 @@ class Context(interfaces.context.ContextInterface): # ## Object Factory Functions def object(self, - symbol: Union[str, interfaces.objects.Template], + object_type: Union[str, interfaces.objects.Template], layer_name: str, offset: int, native_layer_name: Optional[str] = None, @@ -101,7 +101,7 @@ class Context(interfaces.context.ContextInterface): and constructs an object using the object template on the layer at the offset. Args: - symbol: The name (or template) of the symbol type on which to construct the object. If this is a name, it should contain an explicit table name. + object_type: The name (or template) of the symbol type on which to construct the object. If this is a name, it should contain an explicit table name. layer_name: The name of the layer on which to construct the object offset: The offset within the layer at which the data used to create the object lives @@ -109,13 +109,13 @@ class Context(interfaces.context.ContextInterface): Returns: A fully constructed object """ - if not isinstance(symbol, interfaces.objects.Template): + if not isinstance(object_type, interfaces.objects.Template): try: - object_template = self._symbol_space.get_type(symbol) + object_template = self._symbol_space.get_type(object_type) except exceptions.SymbolError: - object_template = self._symbol_space.get_enumeration(symbol) + object_template = self._symbol_space.get_enumeration(object_type) else: - object_template = symbol + object_template = object_type # Ensure that if a pre-constructed type is provided we just instantiate it arguments.update(object_template.vol) @@ -170,7 +170,7 @@ def get_module_wrapper(method: str) -> Callable: class Module(interfaces.context.ModuleInterface): def object(self, - symbol: str, + object_type: str, offset: int = None, native_layer_name: Optional[str] = None, absolute: bool = False, @@ -178,12 +178,12 @@ class Module(interfaces.context.ModuleInterface): """Returns an object created using the symbol_table_name and layer_name of the Module Args: - symbol: Name of the type/symbol/enumeration (within the module) to construct + object_type: Name of the type/symbol/enumeration (within the module) to construct offset: The location of the object, ignored when symbol_type is SYMBOL native_layer_name: Name of the layer in which constructed objects are made (for pointers) """ - if constants.BANG not in symbol: - symbol = self.symbol_table_name + constants.BANG + symbol + if constants.BANG not in object_type: + object_type = self.symbol_table_name + constants.BANG + object_type else: raise ValueError("Cannot reference another module when constructing an object") @@ -197,21 +197,24 @@ class Module(interfaces.context.ModuleInterface): if 'layer_name' in kwargs: del kwargs['layer_name'] return self._context.object( - symbol = symbol, + object_type = object_type, layer_name = self._layer_name, offset = offset, native_layer_name = native_layer_name or self._native_layer_name, **kwargs) - def object_from_symbol(self, symbol: str, native_layer_name: Optional[str] = None, absolute: bool = False, + def object_from_symbol(self, + object_type: str, + native_layer_name: Optional[str] = None, + absolute: bool = False, **kwargs) -> 'interfaces.objects.ObjectInterface': - if constants.BANG not in symbol: - symbol = self.symbol_table_name + constants.BANG + symbol + if constants.BANG not in object_type: + object_type = self.symbol_table_name + constants.BANG + object_type else: raise ValueError("Cannot reference another module when constructing an object") # Only set the offset if type is Symbol and we were given a name, not a template - symbol_val = self._context.symbol_space.get_symbol(symbol) + symbol_val = self._context.symbol_space.get_symbol(object_type) offset = symbol_val.address if not absolute: @@ -226,7 +229,7 @@ class Module(interfaces.context.ModuleInterface): # Since type may be a template, we don't just call our own module method return self._context.object( - symbol = symbol_val.type, + object_type = symbol_val.type, layer_name = self._layer_name, offset = offset, native_layer_name = native_layer_name or self._native_layer_name, diff --git a/volatility/framework/interfaces/context.py b/volatility/framework/interfaces/context.py index 1a5688498..2cf93ed39 100644 --- a/volatility/framework/interfaces/context.py +++ b/volatility/framework/interfaces/context.py @@ -74,7 +74,7 @@ class ContextInterface(object, metaclass = ABCMeta): @abstractmethod def object(self, - symbol: Union[str, 'interfaces.objects.Template'], + object_type: Union[str, 'interfaces.objects.Template'], layer_name: str, offset: int, native_layer_name: str = None, @@ -147,7 +147,7 @@ class ModuleInterface(metaclass = ABCMeta): @abstractmethod def object(self, - symbol: str, + object_type: str, offset: int = None, native_layer_name: Optional[str] = None, absolute: bool = False, @@ -155,7 +155,10 @@ class ModuleInterface(metaclass = ABCMeta): """Returns an object created using the symbol_table_name and layer_name of the Module""" @abstractmethod - def object_from_symbol(self, symbol: str, native_layer_name: Optional[str] = None, absolute: bool = False, + def object_from_symbol(self, + object_type: str, + native_layer_name: Optional[str] = None, + absolute: bool = False, **kwargs) -> 'interfaces.objects.ObjectInterface': """Returns an object created usnig the symbol_table_name and layer_name of the Module""" diff --git a/volatility/framework/layers/msf.py b/volatility/framework/layers/msf.py index 99e04ce27..a9f0d5620 100644 --- a/volatility/framework/layers/msf.py +++ b/volatility/framework/layers/msf.py @@ -63,7 +63,7 @@ class PdbMultiStreamFormat(interfaces.layers.TranslationLayerInterface): root_table_num_pages = math.ceil(self._header.StreamInfo.StreamInfoSize / self._header.PageSize) root_index_size = math.ceil((root_table_num_pages * entry_size) / self._header.PageSize) root_index = module.object( - symbol = "array", + object_type = "array", offset = self._header.vol.size, count = root_index_size, subtype = module.get_type("unsigned long")) @@ -72,14 +72,14 @@ class PdbMultiStreamFormat(interfaces.layers.TranslationLayerInterface): module = self.context.module(self.pdb_symbol_table, root_index_layer_name, offset = 0) root_pages = module.object( - symbol = "array", offset = 0, count = root_table_num_pages, subtype = module.get_type("unsigned long")) + object_type = "array", offset = 0, count = root_table_num_pages, subtype = module.get_type("unsigned long")) root_layer_name = self.create_stream_from_pages("root", self._header.StreamInfo.StreamInfoSize, [x for x in root_pages]) module = self.context.module(self.pdb_symbol_table, root_layer_name, offset = 0) - num_streams = module.object(symbol = "unsigned long", offset = 0) + num_streams = module.object(object_type = "unsigned long", offset = 0) stream_sizes = module.object( - symbol = "array", offset = entry_size, count = num_streams, subtype = module.get_type("unsigned long")) + object_type = "array", offset = entry_size, count = num_streams, subtype = module.get_type("unsigned long")) current_offset = (num_streams + 1) * entry_size @@ -89,7 +89,7 @@ class PdbMultiStreamFormat(interfaces.layers.TranslationLayerInterface): self._streams[stream] = None else: stream_page_list = module.object( - symbol = "array", + object_type = "array", offset = current_offset, count = list_size, subtype = module.get_type("unsigned long")) diff --git a/volatility/framework/layers/registry.py b/volatility/framework/layers/registry.py index 8802c5cf6..503ad5dd4 100644 --- a/volatility/framework/layers/registry.py +++ b/volatility/framework/layers/registry.py @@ -119,7 +119,9 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface): """Returns the appropriate Cell value for a cell offset""" # This would be an _HCELL containing CELL_DATA, but to save time we skip the size of the HCELL cell = self._context.object( - symbol = self._table_name + constants.BANG + "_CELL_DATA", offset = cell_offset + 4, layer_name = self.name) + object_type = self._table_name + constants.BANG + "_CELL_DATA", + offset = cell_offset + 4, + layer_name = self.name) return cell def get_node(self, cell_offset: int) -> 'objects.Struct': diff --git a/volatility/framework/plugins/linux/check_afinfo.py b/volatility/framework/plugins/linux/check_afinfo.py index 946588556..4fde65554 100644 --- a/volatility/framework/plugins/linux/check_afinfo.py +++ b/volatility/framework/plugins/linux/check_afinfo.py @@ -98,7 +98,7 @@ class Check_afinfo(plugins.PluginInterface): except exceptions.SymbolError: continue - global_var = vmlinux.object(symbol = struct_type, offset = global_var.address) + global_var = vmlinux.object(object_type = struct_type, offset = global_var.address) for name, member, address in self._check_afinfo(global_var_name, global_var, op_members, seq_members): yield 0, (name, member, format_hints.Hex(address)) diff --git a/volatility/framework/plugins/linux/check_syscall.py b/volatility/framework/plugins/linux/check_syscall.py index 94ea1953f..9c37580f4 100644 --- a/volatility/framework/plugins/linux/check_syscall.py +++ b/volatility/framework/plugins/linux/check_syscall.py @@ -176,7 +176,7 @@ class Check_syscall(plugins.PluginInterface): for (table_name, (tableaddr, tblsz)) in tables: table = vmlinux.object( - symbol = "array", subtype = vmlinux.get_type("pointer"), offset = tableaddr, count = tblsz) + object_type = "array", subtype = vmlinux.get_type("pointer"), offset = tableaddr, count = tblsz) for (i, call_addr) in enumerate(table): if not call_addr: diff --git a/volatility/framework/plugins/linux/lsmod.py b/volatility/framework/plugins/linux/lsmod.py index 7ba314936..96501c106 100644 --- a/volatility/framework/plugins/linux/lsmod.py +++ b/volatility/framework/plugins/linux/lsmod.py @@ -50,7 +50,7 @@ class Lsmod(plugins.PluginInterface): vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0) - modules = vmlinux.object_from_symbol(symbol = "modules").cast("list_head") + modules = vmlinux.object_from_symbol(object_type = "modules").cast("list_head") table_name = modules.vol.type_name.split(constants.BANG)[0] diff --git a/volatility/framework/plugins/linux/pslist.py b/volatility/framework/plugins/linux/pslist.py index 292a69329..fd28e5b7e 100644 --- a/volatility/framework/plugins/linux/pslist.py +++ b/volatility/framework/plugins/linux/pslist.py @@ -77,7 +77,7 @@ class PsList(interfaces_plugins.PluginInterface): vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0) - init_task = vmlinux.object_from_symbol(symbol = "init_task") + init_task = vmlinux.object_from_symbol(object_type = "init_task") for task in init_task.tasks: if not filter_func(task): diff --git a/volatility/framework/plugins/mac/check_syscall.py b/volatility/framework/plugins/mac/check_syscall.py index d480a44f8..815bbcace 100644 --- a/volatility/framework/plugins/mac/check_syscall.py +++ b/volatility/framework/plugins/mac/check_syscall.py @@ -27,8 +27,8 @@ class Check_syscall(plugins.PluginInterface): kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0) - nsysent = kernel.object_from_symbol(symbol = "nsysent") - table = kernel.object_from_symbol(symbol = "sysent") + nsysent = kernel.object_from_symbol(object_type = "nsysent") + table = kernel.object_from_symbol(object_type = "sysent") # smear help num_ents = min(nsysent, table.count) diff --git a/volatility/framework/plugins/mac/check_sysctl.py b/volatility/framework/plugins/mac/check_sysctl.py index 013cea971..f66527dc3 100644 --- a/volatility/framework/plugins/mac/check_sysctl.py +++ b/volatility/framework/plugins/mac/check_sysctl.py @@ -36,7 +36,7 @@ class Check_sysctl(plugins.PluginInterface): var_name = known_sysctls[name] try: - var_array = kernel.object(symbol = var_name) + var_array = kernel.object(object_type = var_name) except exceptions.SymbolError: var_array = None @@ -110,7 +110,7 @@ class Check_sysctl(plugins.PluginInterface): kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0) - sysctl_list = kernel.object_from_symbol(symbol = "sysctl__children") + sysctl_list = kernel.object_from_symbol(object_type = "sysctl__children") for sysctl, name, val in self._process_sysctl_list(kernel, sysctl_list): check_addr = sysctl.oid_handler diff --git a/volatility/framework/plugins/mac/check_trap_table.py b/volatility/framework/plugins/mac/check_trap_table.py index 97a62359f..6b391bb1b 100644 --- a/volatility/framework/plugins/mac/check_trap_table.py +++ b/volatility/framework/plugins/mac/check_trap_table.py @@ -27,7 +27,7 @@ class Check_trap_table(plugins.PluginInterface): kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0) - table = kernel.object_from_symbol(symbol = "mach_trap_table") + table = kernel.object_from_symbol(object_type = "mach_trap_table") for i, ent in enumerate(table): try: diff --git a/volatility/framework/plugins/mac/lsmod.py b/volatility/framework/plugins/mac/lsmod.py index 814f240a7..66f7dca78 100644 --- a/volatility/framework/plugins/mac/lsmod.py +++ b/volatility/framework/plugins/mac/lsmod.py @@ -47,7 +47,7 @@ class Lsmod(plugins.PluginInterface): kernel = contexts.Module(context, darwin_symbols, layer_name, 0) - kmod_ptr = kernel.object_from_symbol(symbol = "kmod") + kmod_ptr = kernel.object_from_symbol(object_type = "kmod") # TODO - use smear-proof list walking API after dev release kmod = kmod_ptr.dereference().cast("kmod_info") diff --git a/volatility/framework/plugins/mac/pslist.py b/volatility/framework/plugins/mac/pslist.py index 476eaf8dc..f36f1f3b9 100644 --- a/volatility/framework/plugins/mac/pslist.py +++ b/volatility/framework/plugins/mac/pslist.py @@ -80,7 +80,7 @@ class PsList(interfaces_plugins.PluginInterface): kernel = contexts.Module(context, darwin_symbols, layer_name, 0) - proc = kernel.object_from_symbol(symbol = "allproc").lh_first + proc = kernel.object_from_symbol(object_type = "allproc").lh_first seen = {} while proc is not None and proc.vol.offset != 0: diff --git a/volatility/framework/plugins/mac/trustedbsd.py b/volatility/framework/plugins/mac/trustedbsd.py index 2b609a9a6..dc69df303 100644 --- a/volatility/framework/plugins/mac/trustedbsd.py +++ b/volatility/framework/plugins/mac/trustedbsd.py @@ -49,10 +49,10 @@ class Check_syscall(plugins.PluginInterface): kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0) - policy_list = kernel.object_from_symbol(symbol = "_mac_policy_list").cast("mac_policy_list") + policy_list = kernel.object_from_symbol(object_type = "_mac_policy_list").cast("mac_policy_list") entries = kernel.object( - symbol = "array", + object_type = "array", offset = policy_list.entries.dereference().vol.offset, subtype = kernel.get_type('mac_policy_list_element'), count = policy_list.staticmax + 1) diff --git a/volatility/framework/plugins/windows/handles.py b/volatility/framework/plugins/windows/handles.py index d68435c28..180d1fe50 100644 --- a/volatility/framework/plugins/windows/handles.py +++ b/volatility/framework/plugins/windows/handles.py @@ -162,7 +162,7 @@ class Handles(interfaces_plugins.PluginInterface): table_addr = ntkrnlmp.get_symbol("ObpObjectTypes").address ptrs = ntkrnlmp.object( - symbol = "array", offset = table_addr, subtype = ntkrnlmp.get_type("pointer"), count = 100) + object_type = "array", offset = table_addr, subtype = ntkrnlmp.get_type("pointer"), count = 100) for i, ptr in enumerate(ptrs): #type: ignore # the first entry in the table is always null. break the @@ -214,7 +214,7 @@ class Handles(interfaces_plugins.PluginInterface): if not self.context.layers[virtual].is_valid(offset): return - table = ntkrnlmp.object(symbol = "array", offset = offset, subtype = subtype, count = int(count)) + table = ntkrnlmp.object(object_type = "array", offset = offset, subtype = subtype, count = int(count)) layer_object = self.context.layers[virtual] masked_offset = (offset & layer_object.maximum_address) diff --git a/volatility/framework/plugins/windows/info.py b/volatility/framework/plugins/windows/info.py index fca45026e..9d9e9b88c 100644 --- a/volatility/framework/plugins/windows/info.py +++ b/volatility/framework/plugins/windows/info.py @@ -105,7 +105,8 @@ class Info(plugins.PluginInterface): vers_offset = ntkrnlmp.get_symbol("KdVersionBlock").address - vers = ntkrnlmp.object(symbol = "_DBGKD_GET_VERSION64", layer_name = virtual_layer_name, offset = vers_offset) + vers = ntkrnlmp.object( + object_type = "_DBGKD_GET_VERSION64", layer_name = virtual_layer_name, offset = vers_offset) yield (0, ("KdVersionBlock", hex(vers.vol.offset))) yield (0, ("Major/Minor", "{0}.{1}".format(vers.MajorVersion, vers.MinorVersion))) @@ -113,7 +114,8 @@ class Info(plugins.PluginInterface): cpu_count_offset = ntkrnlmp.get_symbol("KeNumberProcessors").address - cpu_count = ntkrnlmp.object(symbol = "unsigned int", layer_name = virtual_layer_name, offset = cpu_count_offset) + cpu_count = ntkrnlmp.object( + object_type = "unsigned int", layer_name = virtual_layer_name, offset = cpu_count_offset) yield (0, ("KeNumberProcessors", str(cpu_count))) @@ -124,7 +126,7 @@ class Info(plugins.PluginInterface): kuser_addr = 0xFFFFF78000000000 kuser = ntkrnlmp.object( - symbol = "_KUSER_SHARED_DATA", layer_name = virtual_layer_name, offset = kuser_addr, absolute = True) + object_type = "_KUSER_SHARED_DATA", layer_name = virtual_layer_name, offset = kuser_addr, absolute = True) yield (0, ("SystemTime", str(kuser.SystemTime.get_time()))) yield (0, ("NtSystemRoot", diff --git a/volatility/framework/plugins/windows/modules.py b/volatility/framework/plugins/windows/modules.py index b0ed1f4e0..a8c93d321 100644 --- a/volatility/framework/plugins/windows/modules.py +++ b/volatility/framework/plugins/windows/modules.py @@ -75,9 +75,9 @@ class Modules(interfaces.plugins.PluginInterface): type_name = ldr_entry_type.type_name.split(constants.BANG)[1] list_head = ntkrnlmp.get_symbol("PsLoadedModuleList").address - list_entry = ntkrnlmp.object(symbol = "_LIST_ENTRY", offset = list_head) + list_entry = ntkrnlmp.object(object_type = "_LIST_ENTRY", offset = list_head) reloff = ldr_entry_type.relative_child_offset("InLoadOrderLinks") - module = ntkrnlmp.object(symbol = type_name, offset = list_entry.vol.offset - reloff, absolute = True) + module = ntkrnlmp.object(object_type = type_name, offset = list_entry.vol.offset - reloff, absolute = True) for mod in module.InLoadOrderLinks: yield mod diff --git a/volatility/framework/plugins/windows/poolscanner.py b/volatility/framework/plugins/windows/poolscanner.py index d2d342910..52ec3cf1e 100644 --- a/volatility/framework/plugins/windows/poolscanner.py +++ b/volatility/framework/plugins/windows/poolscanner.py @@ -88,7 +88,7 @@ class PoolHeaderScanner(interfaces.layers.ScannerInterface): def __call__(self, data: bytes, data_offset: int): for offset, pattern in self._subscanner(data, data_offset): header = self._module.object( - symbol = "_POOL_HEADER", offset = offset - self._header_offset, absolute = True) + object_type = "_POOL_HEADER", offset = offset - self._header_offset, absolute = True) constraint = self._constraint_lookup[pattern] try: # Size check diff --git a/volatility/framework/plugins/windows/pslist.py b/volatility/framework/plugins/windows/pslist.py index 6b2500974..8ed738328 100644 --- a/volatility/framework/plugins/windows/pslist.py +++ b/volatility/framework/plugins/windows/pslist.py @@ -87,7 +87,7 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface): ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo) ps_aph_offset = ntkrnlmp.get_symbol("PsActiveProcessHead").address - list_entry = ntkrnlmp.object(symbol = "_LIST_ENTRY", offset = ps_aph_offset) + list_entry = ntkrnlmp.object(object_type = "_LIST_ENTRY", offset = ps_aph_offset) # This is example code to demonstrate how to use symbol_space directly, rather than through a module: # @@ -101,7 +101,7 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface): # having been present. Strictly, the value of the requirement should be joined with the BANG character # defined in the constants file reloff = ntkrnlmp.get_type("_EPROCESS").relative_child_offset("ActiveProcessLinks") - eproc = ntkrnlmp.object(symbol = "_EPROCESS", offset = list_entry.vol.offset - reloff, absolute = True) + eproc = ntkrnlmp.object(object_type = "_EPROCESS", offset = list_entry.vol.offset - reloff, absolute = True) for proc in eproc.ActiveProcessLinks: if not filter_func(proc): diff --git a/volatility/framework/plugins/windows/registry/hivelist.py b/volatility/framework/plugins/windows/registry/hivelist.py index d97b3c6ab..d3903b360 100644 --- a/volatility/framework/plugins/windows/registry/hivelist.py +++ b/volatility/framework/plugins/windows/registry/hivelist.py @@ -63,9 +63,9 @@ class HiveList(plugins.PluginInterface): ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo) list_head = ntkrnlmp.get_symbol("CmpHiveListHead").address - list_entry = ntkrnlmp.object(symbol = "_LIST_ENTRY", offset = list_head) + list_entry = ntkrnlmp.object(object_type = "_LIST_ENTRY", offset = list_head) reloff = ntkrnlmp.get_type("_CMHIVE").relative_child_offset("HiveList") - cmhive = ntkrnlmp.object(symbol = "_CMHIVE", offset = list_entry.vol.offset - reloff, absolute = True) + cmhive = ntkrnlmp.object(object_type = "_CMHIVE", offset = list_entry.vol.offset - reloff, absolute = True) # Run through the list fowards seen = set() diff --git a/volatility/framework/plugins/windows/registry/userassist.py b/volatility/framework/plugins/windows/registry/userassist.py index 06c510892..92d69ed96 100644 --- a/volatility/framework/plugins/windows/registry/userassist.py +++ b/volatility/framework/plugins/windows/registry/userassist.py @@ -86,7 +86,7 @@ class UserAssist(interfaces.plugins.PluginInterface): buffer = BufferDataLayer(self.context, self._config_path, userassist_layer_name, userassist_data) self.context.add_layer(buffer) userassist_obj = self.context.object( - symbol = self._reg_table_name + constants.BANG + self._userassist_type_name, + object_type = self._reg_table_name + constants.BANG + self._userassist_type_name, layer_name = userassist_layer_name, offset = 0) diff --git a/volatility/framework/plugins/windows/ssdt.py b/volatility/framework/plugins/windows/ssdt.py index 53cbbf045..2b939c680 100644 --- a/volatility/framework/plugins/windows/ssdt.py +++ b/volatility/framework/plugins/windows/ssdt.py @@ -85,7 +85,7 @@ class SSDT(plugins.PluginInterface): ## we could also find nt!KeServiceDescriptorTable (NT) and KeServiceDescriptorTableShadow (NT, Win32K) service_table_address = ntkrnlmp.get_symbol("KiServiceTable").address service_limit_address = ntkrnlmp.get_symbol("KiServiceLimit").address - service_limit = ntkrnlmp.object(symbol = "int", offset = service_limit_address) + service_limit = ntkrnlmp.object(object_type = "int", offset = service_limit_address) # on 32-bit systems the table indexes are 32-bits and contain pointers (unsigned) # on 64-bit systems the indexes are also 32-bits but they're offsets from the @@ -107,7 +107,7 @@ class SSDT(plugins.PluginInterface): find_address = passthrough functions = ntkrnlmp.object( - symbol = "array", + object_type = "array", offset = service_table_address, subtype = ntkrnlmp.get_type(array_subtype), count = service_limit) diff --git a/volatility/framework/plugins/windows/vadinfo.py b/volatility/framework/plugins/windows/vadinfo.py index d88ec0b93..e83543281 100644 --- a/volatility/framework/plugins/windows/vadinfo.py +++ b/volatility/framework/plugins/windows/vadinfo.py @@ -78,7 +78,7 @@ class VadInfo(interfaces.plugins.PluginInterface): kvo = context.layers[virtual_layer].config["kernel_virtual_offset"] ntkrnlmp = context.module(nt_symbols, layer_name = virtual_layer, offset = kvo) addr = ntkrnlmp.get_symbol("MmProtectToValue").address - values = ntkrnlmp.object(symbol = "array", offset = addr, subtype = ntkrnlmp.get_type("int"), count = 32) + values = ntkrnlmp.object(object_type = "array", offset = addr, subtype = ntkrnlmp.get_type("int"), count = 32) return values # type: ignore @classmethod diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 5ea03aa76..f1274f1c8 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -700,7 +700,7 @@ class _EPROCESS(generic.GenericIntelProcess, ExecutiveObject): layer_name = self.vol.native_layer_name, offset = kvo, native_layer_name = self.vol.native_layer_name) - session = ntkrnlmp.object(symbol = "_MM_SESSION_SPACE", offset = self.Session, absolute = True) + session = ntkrnlmp.object(object_type = "_MM_SESSION_SPACE", offset = self.Session, absolute = True) if session.has_member("SessionId"): return session.SessionId diff --git a/volatility/framework/symbols/windows/pdbconv.py b/volatility/framework/symbols/windows/pdbconv.py index 1bfb9febb..ff35717e4 100644 --- a/volatility/framework/symbols/windows/pdbconv.py +++ b/volatility/framework/symbols/windows/pdbconv.py @@ -353,7 +353,7 @@ class PdbReader: if not tpi_layer: raise ValueError("No TPI stream available") module = self._context.module(module_name = tpi_layer.pdb_symbol_table, layer_name = tpi_layer.name, offset = 0) - header = module.object(symbol = "TPI_HEADER", offset = 0) + header = module.object(object_type = "TPI_HEADER", offset = 0) # Check the header if not (56 <= header.header_size < 1024): @@ -375,7 +375,7 @@ class PdbReader: type_index = 1 while tpi_layer.maximum_address - offset > 0: self._progress_callback(offset * 100 / tpi_layer.maximum_address, "Reading TPI layer") - length = module.object(symbol = length_type, offset = offset) + length = module.object(object_type = length_type, offset = offset) if not isinstance(length, int): raise ValueError("Non-integer length provided") offset += length_len @@ -401,7 +401,7 @@ class PdbReader: if not dbi_layer: raise ValueError("No DBI stream available") module = self._context.module(module_name = dbi_layer.pdb_symbol_table, layer_name = dbi_layer.name, offset = 0) - self._dbiheader = module.object(symbol = "DBI_HEADER", offset = 0) + self._dbiheader = module.object(object_type = "DBI_HEADER", offset = 0) if not self._dbiheader: raise ValueError("DBI Header could not be read") @@ -410,7 +410,7 @@ class PdbReader: dbg_hdr_offset = (self._dbiheader.vol.size + self._dbiheader.module_size + self._dbiheader.secconSize + self._dbiheader.secmapSize + self._dbiheader.filinfSize + self._dbiheader.tsmapSize + self._dbiheader.ecinfoSize) - self._dbidbgheader = module.object(symbol = "DBI_DBG_HEADER", offset = dbg_hdr_offset) + self._dbidbgheader = module.object(object_type = "DBI_DBG_HEADER", offset = dbg_hdr_offset) self._sections = [] self._omap_mapping = [] @@ -465,8 +465,8 @@ class PdbReader: while offset < max_address: self._progress_callback(offset * 100 / max_address, "Reading Symbol layer") - sym = module.object(symbol = "GLOBAL_SYMBOL", offset = offset) - leaf_type = module.object(symbol = "unsigned short", offset = sym.leaf_type.vol.offset) + sym = module.object(object_type = "GLOBAL_SYMBOL", offset = offset) + leaf_type = module.object(object_type = "unsigned short", offset = sym.leaf_type.vol.offset) name = None address = None if sym.segment < len(self._sections): @@ -500,7 +500,7 @@ class PdbReader: raise ValueError("No PDB Info Stream available") module = self._context.module( module_name = pdb_info_layer.pdb_symbol_table, layer_name = pdb_info_layer.name, offset = 0) - pdb_info = module.object(symbol = "PDB_INFORMATION", offset = 0) + pdb_info = module.object(object_type = "PDB_INFORMATION", offset = 0) self.metadata['windows']['pdb'] = { "GUID": self.convert_bytes_to_guid(pdb_info.GUID), @@ -726,7 +726,7 @@ class PdbReader: leaf_type.LF_CLASS, leaf_type.LF_CLASS_ST, leaf_type.LF_STRUCTURE, leaf_type.LF_STRUCTURE_ST, leaf_type.LF_INTERFACE ]: - structure = module.object(symbol = "LF_STRUCTURE", offset = offset + consumed) + structure = module.object(object_type = "LF_STRUCTURE", offset = offset + consumed) name_offset = structure.name.vol.offset - structure.vol.offset name, value, excess = self.determine_extended_value(leaf_type, structure.size, module, remaining - name_offset) @@ -735,7 +735,7 @@ class PdbReader: consumed += remaining result = leaf_type, name, structure elif leaf_type in [leaf_type.LF_MEMBER, leaf_type.LF_MEMBER_ST]: - member = module.object(symbol = "LF_MEMBER", offset = offset + consumed) + member = module.object(object_type = "LF_MEMBER", offset = offset + consumed) name_offset = member.name.vol.offset - member.vol.offset name, value, excess = self.determine_extended_value(leaf_type, member.offset, module, remaining - name_offset) @@ -744,7 +744,7 @@ class PdbReader: result = leaf_type, name, member consumed += member.vol.size + len(name) + 1 + excess elif leaf_type in [leaf_type.LF_ARRAY, leaf_type.LF_ARRAY_ST, leaf_type.LF_STRIDED_ARRAY]: - array = module.object(symbol = "LF_ARRAY", offset = offset + consumed) + array = module.object(object_type = "LF_ARRAY", offset = offset + consumed) name_offset = array.name.vol.offset - array.vol.offset name, value, excess = self.determine_extended_value(leaf_type, array.size, module, remaining - name_offset) array.size = value @@ -752,7 +752,7 @@ class PdbReader: result = leaf_type, name, array consumed += remaining elif leaf_type in [leaf_type.LF_ENUMERATE]: - enum = module.object(symbol = 'LF_ENUMERATE', offset = offset + consumed) + enum = module.object(object_type = 'LF_ENUMERATE', offset = offset + consumed) name_offset = enum.name.vol.offset - enum.vol.offset name, value, excess = self.determine_extended_value(leaf_type, enum.value, module, remaining - name_offset) enum.value = value @@ -760,20 +760,20 @@ class PdbReader: result = leaf_type, name, enum consumed += enum.vol.size + len(name) + 1 + excess elif leaf_type in [leaf_type.LF_ARGLIST, leaf_type.LF_ENUM]: - enum = module.object(symbol = "LF_ENUM", offset = offset + consumed) + enum = module.object(object_type = "LF_ENUM", offset = offset + consumed) name_offset = enum.name.vol.offset - enum.vol.offset name = self.parse_string(enum.name, leaf_type < leaf_type.LF_ST_MAX, size = remaining - name_offset) enum.name = name result = leaf_type, name, enum consumed += remaining elif leaf_type in [leaf_type.LF_UNION]: - union = module.object(symbol = "LF_UNION", offset = offset + consumed) + union = module.object(object_type = "LF_UNION", offset = offset + consumed) name_offset = union.name.vol.offset - union.vol.offset name = self.parse_string(union.name, leaf_type < leaf_type.LF_ST_MAX, size = remaining - name_offset) result = leaf_type, name, union consumed += remaining elif leaf_type in [leaf_type.LF_MODIFIER, leaf_type.LF_POINTER, leaf_type.LF_PROCEDURE]: - obj = module.object(symbol = leaf_type.lookup(), offset = offset + consumed) + obj = module.object(object_type = leaf_type.lookup(), offset = offset + consumed) result = leaf_type, None, obj consumed += remaining elif leaf_type in [leaf_type.LF_FIELDLIST]: @@ -789,7 +789,7 @@ class PdbReader: fields.append(subfield) result = leaf_type, None, fields elif leaf_type in [leaf_type.LF_BITFIELD]: - bitfield = module.object(symbol = "LF_BITFIELD", offset = offset + consumed) + bitfield = module.object(object_type = "LF_BITFIELD", offset = offset + consumed) result = leaf_type, None, bitfield consumed += remaining else: @@ -873,20 +873,20 @@ class PdbReader: # Set the offset at just after the previous size type offset = value.vol.offset + value.vol.data_format.length if sub_leaf_type in [leaf_type.LF_CHAR]: - value = module.object(symbol = 'char', offset = offset) + value = module.object(object_type = 'char', offset = offset) elif sub_leaf_type in [leaf_type.LF_SHORT]: - value = module.object(symbol = 'short', offset = offset) + value = module.object(object_type = 'short', offset = offset) elif sub_leaf_type in [leaf_type.LF_USHORT]: - value = module.object(symbol = 'unsigned short', offset = offset) + value = module.object(object_type = 'unsigned short', offset = offset) elif sub_leaf_type in [leaf_type.LF_LONG]: - value = module.object(symbol = 'long', offset = offset) + value = module.object(object_type = 'long', offset = offset) elif sub_leaf_type in [leaf_type.LF_ULONG]: - value = module.object(symbol = 'unsigned long', offset = offset) + value = module.object(object_type = 'unsigned long', offset = offset) else: raise TypeError("Unexpected extended value type") excess = value.vol.data_format.length # Updated the consume/offset counters - name = module.object(symbol = "string", offset = value.vol.offset + value.vol.data_format.length) + name = module.object(object_type = "string", offset = value.vol.offset + value.vol.data_format.length) name_str = self.parse_string(name, leaf_type < leaf_type.LF_ST_MAX, size = length - excess) return name_str, value, excess