WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-07 18:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Mac: Update all plugins to ModuleRequirement

Browse Source
This commit is contained in:
Mike Auty
2021-07-22 22:42:06 +01:00
parent 1480aca453
commit cd2f40bc34
22 changed files with 202 additions and 261 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/mac/bash.py
+7 -9
View File
@@ -20,16 +20,13 @@ from volatility3.plugins.mac import pslist
class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
"""Recovers bash command history from memory."""
_required_framework_version = (1, 0, 0)
_required_framework_version = (1, 2, 0)
@classmethod
def get_requirements(cls):
return [
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)),
requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS'),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (3, 0, 0)),
requirements.ListRequirement(name = 'pid',
description = 'Filter on specific process IDs',
element_type = int,
@@ -37,7 +34,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
]
def _generator(self, tasks):
is_32bit = not symbols.symbol_table_is_64bit(self.context, self.config["darwin"])
is_32bit = not symbols.symbol_table_is_64bit(self.context, self.config["darwin.symbol_table_name"])
if is_32bit:
pack_format = "I"
bash_json_file = "bash32"
@@ -96,7 +93,6 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
("Command", str)],
self._generator(
list_tasks(self.context,
self.config['primary'],
self.config['darwin'],
filter_func = filter_func)))
@@ -105,7 +101,9 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
list_tasks = pslist.PsList.get_list_tasks(self.config.get('pslist_method', pslist.PsList.pslist_methods[0]))
for row in self._generator(
list_tasks(self.context, self.config['primary'], self.config['darwin'], filter_func = filter_func)):
list_tasks(self.context,
self.config['darwin'],
filter_func = filter_func)):
_depth, row_data = row
description = f"{row_data[0]} ({row_data[1]}): \"{row_data[3]}\""
yield (description, timeliner.TimeLinerType.CREATED, row_data[2])
volatility3/framework/plugins/mac/check_syscall.py
+10 -11
View File
@@ -5,7 +5,7 @@ import logging
from typing import List
from volatility3.framework import exceptions, interfaces
from volatility3.framework import renderers, contexts
from volatility3.framework import renderers
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.renderers import format_hints
@@ -18,25 +18,23 @@ vollog = logging.getLogger(__name__)
class Check_syscall(plugins.PluginInterface):
"""Check system call table for hooks."""
_required_framework_version = (1, 0, 0)
_required_framework_version = (1, 2, 0)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
return [
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"),
requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
architectures = ["Intel32", "Intel64"]),
requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)),
requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0))
requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (2, 0, 0))
]
def _generator(self):
kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
kernel = self.context.modules[self.config['darwin']]
mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin'])
mods = lsmod.Lsmod.list_modules(self.context, self.config['darwin'])
handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, kernel.layer_name, kernel, mods)
nsysent = kernel.object_from_symbol(symbol_name = "nsysent")
table = kernel.object_from_symbol(symbol_name = "sysent")
@@ -55,7 +53,8 @@ class Check_syscall(plugins.PluginInterface):
if not call_addr or call_addr == 0:
continue
module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, call_addr)
module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers,
call_addr, self.config['darwin'])
yield (0, (format_hints.Hex(table.vol.offset), "SysCall", i, format_hints.Hex(call_addr), module_name,
symbol_name))
volatility3/framework/plugins/mac/check_sysctl.py
+9 -11
View File
@@ -6,7 +6,7 @@ from typing import List
import volatility3
from volatility3.framework import exceptions, interfaces
from volatility3.framework import renderers, contexts
from volatility3.framework import renderers
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.objects import utility
@@ -20,17 +20,14 @@ vollog = logging.getLogger(__name__)
class Check_sysctl(plugins.PluginInterface):
"""Check sysctl handlers for hooks."""
_required_framework_version = (1, 0, 0)
_required_framework_version = (1, 2, 0)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
return [
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"),
requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS'),
requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)),
requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0))
requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (2, 0, 0))
]
def _parse_global_variable_sysctls(self, kernel, name):
@@ -115,11 +112,11 @@ class Check_sysctl(plugins.PluginInterface):
break
def _generator(self):
kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
kernel = self.context.modules[self.config['darwin']]
mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin'])
mods = lsmod.Lsmod.list_modules(self.context, self.config['darwin'])
handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, kernel.layer_name, kernel, mods)
sysctl_list = kernel.object_from_symbol(symbol_name = "sysctl__children")
@@ -129,7 +126,8 @@ class Check_sysctl(plugins.PluginInterface):
except exceptions.InvalidAddressException:
continue
module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, check_addr)
module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, check_addr,
self.config['darwin'])
yield (0, (name, sysctl.oid_number, sysctl.get_perms(), format_hints.Hex(check_addr), val, module_name,
symbol_name))
volatility3/framework/plugins/mac/check_trap_table.py
+9 -11
View File
@@ -6,7 +6,7 @@ import logging
from typing import List
from volatility3.framework import exceptions, interfaces
from volatility3.framework import renderers, contexts
from volatility3.framework import renderers
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.renderers import format_hints
@@ -19,25 +19,22 @@ vollog = logging.getLogger(__name__)
class Check_trap_table(plugins.PluginInterface):
"""Check mach trap table for hooks."""
_required_framework_version = (1, 0, 0)
_required_framework_version = (1, 2, 0)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
return [
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"),
requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)),
requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS'),
requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (2, 0, 0)),
requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)),
]
def _generator(self):
kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
kernel = self.context.modules[self.config['darwin']]
mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin'])
mods = lsmod.Lsmod.list_modules(self.context, self.config['darwin'])
handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, kernel.layer_name, kernel, mods)
table = kernel.object_from_symbol(symbol_name = "mach_trap_table")
@@ -50,7 +47,8 @@ class Check_trap_table(plugins.PluginInterface):
if not call_addr or call_addr == 0:
continue
module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, call_addr)
module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, call_addr,
self.config['darwin'])
yield (0, (format_hints.Hex(table.vol.offset), "TrapTable", i, format_hints.Hex(call_addr), module_name,
symbol_name))
volatility3/framework/plugins/mac/ifconfig.py
+4 -7
View File
@@ -1,7 +1,7 @@
# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
from volatility3.framework import exceptions, renderers, contexts
from volatility3.framework import exceptions, renderers
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.objects import utility
@@ -11,20 +11,17 @@ from volatility3.framework.symbols import mac
class Ifconfig(plugins.PluginInterface):
"""Lists loaded kernel modules"""
_required_framework_version = (1, 0, 0)
_required_framework_version = (1, 2, 0)
@classmethod
def get_requirements(cls):
return [
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"),
requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS'),
requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0))
]
def _generator(self):
kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
kernel = self.context.modules[self.config['darwin']]
try:
list_head = kernel.object_from_symbol(symbol_name = "ifnet_head")
volatility3/framework/plugins/mac/kauth_listeners.py
+12 -14
View File
@@ -2,7 +2,7 @@
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
from volatility3.framework import renderers, interfaces, contexts
from volatility3.framework import renderers, interfaces
from volatility3.framework.configuration import requirements
from volatility3.framework.objects import utility
from volatility3.framework.renderers import format_hints
@@ -13,34 +13,31 @@ from volatility3.plugins.mac import lsmod, kauth_scopes
class Kauth_listeners(interfaces.plugins.PluginInterface):
""" Lists kauth listeners and their status """
_required_framework_version = (1, 0, 0)
_required_framework_version = (1, 2, 0)
@classmethod
def get_requirements(cls):
return [
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel"),
requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
architectures = ["Intel32", "Intel64"]),
requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 1, 0)),
requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)),
requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (2, 0, 0)),
requirements.PluginRequirement(name = 'kauth_scopes',
plugin = kauth_scopes.Kauth_scopes,
version = (1, 0, 0))
version = (2, 0, 0))
]
def _generator(self):
"""
Enumerates the listeners for each kauth scope
"""
kernel = contexts.Module(self.context, self.config['darwin'], self.config['primary'], 0)
kernel = self.context.modules[self.config['darwin']]
mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin'])
mods = lsmod.Lsmod.list_modules(self.context, self.config['darwin'])
handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, kernel.layer_name, kernel, mods)
for scope in kauth_scopes.Kauth_scopes.list_kauth_scopes(self.context, self.config['primary'],
self.config['darwin']):
for scope in kauth_scopes.Kauth_scopes.list_kauth_scopes(self.context, self.config['darwin']):
scope_name = utility.pointer_to_string(scope.ks_identifier, 128)
@@ -49,7 +46,8 @@ class Kauth_listeners(interfaces.plugins.PluginInterface):
if callback == 0:
continue
module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, callback)
module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, callback,
self.config['darwin'])
yield (0, (scope_name, format_hints.Hex(listener.kll_idata), format_hints.Hex(callback), module_name,
symbol_name))
volatility3/framework/plugins/mac/kauth_scopes.py
+19 -19
View File
@@ -1,39 +1,38 @@
# This file is opyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
import logging
from typing import Iterable, Callable, Tuple
from volatility3.framework import renderers, interfaces, contexts
from volatility3.framework import renderers, interfaces
from volatility3.framework.configuration import requirements
from volatility3.framework.objects import utility
from volatility3.framework.renderers import format_hints
from volatility3.framework.symbols import mac
from volatility3.plugins.mac import lsmod
vollog = logging.getLogger(__name__)
class Kauth_scopes(interfaces.plugins.PluginInterface):
""" Lists kauth scopes and their status """
_version = (1, 0, 0)
_required_framework_version = (1, 0, 0)
_version = (2, 0, 0)
_required_framework_version = (1, 2, 0)
@classmethod
def get_requirements(cls):
return [
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel"),
requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
architectures = ["Intel32", "Intel64"]),
requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 1, 0)),
requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0))
requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (2, 0, 0))
]
@classmethod
def list_kauth_scopes(cls,
context: interfaces.context.ContextInterface,
layer_name: str,
darwin_symbols: str,
kernel_module_name: str,
filter_func: Callable[[int], bool] = lambda _: False) -> \
Iterable[Tuple[interfaces.objects.ObjectInterface,
interfaces.objects.ObjectInterface,
@@ -42,28 +41,29 @@ class Kauth_scopes(interfaces.plugins.PluginInterface):
Enumerates the registered kauth scopes and yields each object
Uses smear-safe enumeration API
"""
kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
kernel = context.modules[kernel_module_name]
scopes = kernel.object_from_symbol("kauth_scopes")
for scope in mac.MacUtilities.walk_tailq(scopes, "ks_link"):
yield scope
if not filter_func(scope):
yield scope
def _generator(self):
kernel = contexts.Module(self.context, self.config['darwin'], self.config['primary'], 0)
kernel = self.context.modules[self.config['darwin']]
mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin'])
mods = lsmod.Lsmod.list_modules(self.context, self.config['darwin'])
handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, kernel.layer_name, kernel, mods)
for scope in self.list_kauth_scopes(self.context, self.config['primary'], self.config['darwin']):
for scope in self.list_kauth_scopes(self.context, self.config['darwin']):
callback = scope.ks_callback
if callback == 0:
continue
module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, callback)
module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, callback,
self.config['darwin'])
identifier = utility.pointer_to_string(scope.ks_identifier, 128)
volatility3/framework/plugins/mac/kevents.py
+9 -12
View File
@@ -4,7 +4,7 @@
from typing import Iterable, Callable, Tuple
from volatility3.framework import renderers, interfaces, exceptions, contexts
from volatility3.framework import renderers, interfaces, exceptions
from volatility3.framework.configuration import requirements
from volatility3.framework.objects import utility
from volatility3.framework.symbols import mac
@@ -14,7 +14,8 @@ from volatility3.plugins.mac import pslist
class Kevents(interfaces.plugins.PluginInterface):
""" Lists event handlers registered by processes """
_required_framework_version = (1, 0, 0)
_required_framework_version = (1, 2, 0)
_version = (1, 0, 0)
event_types = {
1: "EVFILT_READ",
@@ -47,11 +48,9 @@ class Kevents(interfaces.plugins.PluginInterface):
@classmethod
def get_requirements(cls):
return [
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel"),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)),
requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
architectures = ["Intel32", "Intel64"]),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (3, 0, 0)),
requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 2, 0)),
requirements.ListRequirement(name = 'pid',
description = 'Filter on specific process IDs',
@@ -120,8 +119,7 @@ class Kevents(interfaces.plugins.PluginInterface):
@classmethod
def list_kernel_events(cls,
context: interfaces.context.ContextInterface,
layer_name: str,
darwin_symbols: str,
kernel_module_name: str,
filter_func: Callable[[int], bool] = lambda _: False) -> \
Iterable[Tuple[interfaces.objects.ObjectInterface,
interfaces.objects.ObjectInterface,
@@ -135,11 +133,11 @@ class Kevents(interfaces.plugins.PluginInterface):
2) The process ID of the process that registered the filter
3) The object of the associated kernel event filter
"""
kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
kernel = context.modules[kernel_module_name]
list_tasks = pslist.PsList.get_list_tasks(pslist.PsList.pslist_methods[0])
for task in list_tasks(context, layer_name, darwin_symbols, filter_func):
for task in list_tasks(context, kernel_module_name, filter_func):
task_name = utility.array_to_string(task.p_comm)
pid = task.p_pid
@@ -150,7 +148,6 @@ class Kevents(interfaces.plugins.PluginInterface):
filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None))
for task_name, pid, kn in self.list_kernel_events(self.context,
self.config['primary'],
self.config['darwin'],
filter_func = filter_func):
volatility3/framework/plugins/mac/list_files.py
+9 -13
View File
@@ -18,16 +18,14 @@ vollog = logging.getLogger(__name__)
class List_Files(plugins.PluginInterface):
"""Lists all open file descriptors for all processes."""
_required_framework_version = (1, 0, 0)
_required_framework_version = (1, 2, 0)
@classmethod
def get_requirements(cls):
return [
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Kernel Address Space',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "darwin", description = "Mac Kernel"),
requirements.PluginRequirement(name = 'mount', plugin = mount.Mount, version = (1, 0, 0)),
requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
architectures = ["Intel32", "Intel64"]),
requirements.PluginRequirement(name = 'mount', plugin = mount.Mount, version = (2, 0, 0)),
]
@classmethod
@@ -114,14 +112,13 @@ class List_Files(plugins.PluginInterface):
@classmethod
def _walk_mounts(cls,
context: interfaces.context.ContextInterface,
layer_name: str,
darwin_symbols: str) -> \
kernel_module_name: str) -> \
Iterable[interfaces.objects.ObjectInterface]:
loop_vnodes = {}
# iterate each vnode source from each mount
list_mounts = mount.Mount.list_mounts(context, layer_name, darwin_symbols)
list_mounts = mount.Mount.list_mounts(context, kernel_module_name)
for mnt in list_mounts:
cls._walk_vnodelist(mnt.mnt_vnodelist, loop_vnodes)
cls._walk_vnodelist(mnt.mnt_workerqueue, loop_vnodes)
@@ -157,11 +154,10 @@ class List_Files(plugins.PluginInterface):
@classmethod
def list_files(cls,
context: interfaces.context.ContextInterface,
layer_name: str,
darwin_symbols: str) -> \
kernel_module_name: str) -> \
Iterable[interfaces.objects.ObjectInterface]:
vnodes = cls._walk_mounts(context, layer_name, darwin_symbols)
vnodes = cls._walk_mounts(context, kernel_module_name)
for voff, (vnode_name, parent_offset, vnode) in vnodes.items():
full_path = cls._build_path(vnodes, vnode_name, parent_offset)
@@ -169,7 +165,7 @@ class List_Files(plugins.PluginInterface):
yield vnode, full_path
def _generator(self):
for vnode, full_path in self.list_files(self.context, self.config['primary'], self.config['darwin']):
for vnode, full_path in self.list_files(self.context, self.config['darwin']):
yield (0, (format_hints.Hex(vnode), full_path))
volatility3/framework/plugins/mac/lsmod.py
+9 -11
View File
@@ -5,7 +5,7 @@
found in Mac's lsmod command."""
from typing import Set
from volatility3.framework import renderers, interfaces, contexts, exceptions
from volatility3.framework import renderers, interfaces, exceptions
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.objects import utility
@@ -15,21 +15,19 @@ from volatility3.framework.renderers import format_hints
class Lsmod(plugins.PluginInterface):
"""Lists loaded kernel modules."""
_required_framework_version = (1, 0, 0)
_required_framework_version = (1, 2, 0)
_version = (1, 0, 0)
_version = (2, 0, 0)
@classmethod
def get_requirements(cls):
return [
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel")
requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
architectures = ["Intel32", "Intel64"]),
]
@classmethod
def list_modules(cls, context: interfaces.context.ContextInterface, layer_name: str, darwin_symbols: str):
def list_modules(cls, context: interfaces.context.ContextInterface, darwin_module_name: str):
"""Lists all the modules in the primary layer.
Args:
@@ -40,8 +38,8 @@ class Lsmod(plugins.PluginInterface):
Returns:
A list of modules from the `layer_name` layer
"""
kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
kernel_layer = context.layers[layer_name]
kernel = context.modules[darwin_module_name]
kernel_layer = context.layers[kernel.layer_name]
kmod_ptr = kernel.object_from_symbol(symbol_name = "kmod")
@@ -78,7 +76,7 @@ class Lsmod(plugins.PluginInterface):
return
def _generator(self):
for module in self.list_modules(self.context, self.config['primary'], self.config['darwin']):
for module in self.list_modules(self.context, self.config['darwin']):
mod_name = utility.array_to_string(module.name)
mod_size = module.size
volatility3/framework/plugins/mac/lsof.py
+6 -8
View File
@@ -16,17 +16,15 @@ vollog = logging.getLogger(__name__)
class Lsof(plugins.PluginInterface):
"""Lists all open file descriptors for all processes."""
_required_framework_version = (1, 0, 0)
_required_framework_version = (1, 2, 0)
@classmethod
def get_requirements(cls):
return [
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Kernel Address Space',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "darwin", description = "Mac Kernel"),
requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
architectures = ["Intel32", "Intel64"]),
requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (3, 0, 0)),
requirements.ListRequirement(name = 'pid',
description = 'Filter on specific process IDs',
element_type = int,
@@ -37,7 +35,8 @@ class Lsof(plugins.PluginInterface):
for task in tasks:
pid = task.p_pid
for _, filepath, fd in mac.MacUtilities.files_descriptors_for_process(self.context, self.config['darwin'],
for _, filepath, fd in mac.MacUtilities.files_descriptors_for_process(self.context, self.config[
'darwin.symbol_table_name'],
task):
if filepath and len(filepath) > 0:
yield (0, (pid, fd, filepath))
@@ -49,6 +48,5 @@ class Lsof(plugins.PluginInterface):
return renderers.TreeGrid([("PID", int), ("File Descriptor", int), ("File Path", str)],
self._generator(
list_tasks(self.context,
self.config['primary'],
self.config['darwin'],
filter_func = filter_func)))
volatility3/framework/plugins/mac/malfind.py
+6 -10
View File
@@ -2,7 +2,6 @@
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
from volatility3.framework import constants
from volatility3.framework import interfaces
from volatility3.framework import renderers
from volatility3.framework.configuration import requirements
@@ -14,16 +13,14 @@ from volatility3.plugins.mac import pslist
class Malfind(interfaces.plugins.PluginInterface):
"""Lists process memory ranges that potentially contain injected code."""
_required_framework_version = (1, 0, 0)
_required_framework_version = (1, 2, 0)
@classmethod
def get_requirements(cls):
return [
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel"),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)),
requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
architectures = ["Intel32", "Intel64"]),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (3, 0, 0)),
requirements.ListRequirement(name = 'pid',
description = 'Filter on specific process IDs',
element_type = int,
@@ -41,13 +38,13 @@ class Malfind(interfaces.plugins.PluginInterface):
proc_layer = self.context.layers[proc_layer_name]
for vma in task.get_map_iter():
if not vma.is_suspicious(self.context, self.config['darwin']):
if not vma.is_suspicious(self.context, self.context.modules[self.config['darwin']].symbol_table_name):
data = proc_layer.read(vma.links.start, 64, pad = True)
yield vma, data
def _generator(self, tasks):
# determine if we're on a 32 or 64 bit kernel
if self.context.symbol_space.get_type(self.config["darwin"] + constants.BANG + "pointer").size == 4:
if self.context.modules[self.config['darwin']].get_type("pointer").size == 4:
is_32bit_arch = True
else:
is_32bit_arch = False
@@ -75,6 +72,5 @@ class Malfind(interfaces.plugins.PluginInterface):
("Disasm", interfaces.renderers.Disassembly)],
self._generator(
list_tasks(self.context,
self.config['primary'],
self.config['darwin'],
filter_func = filter_func)))
volatility3/framework/plugins/mac/mount.py
+8 -10
View File
@@ -3,7 +3,7 @@
#
"""A module containing a collection of plugins that produce data typically
found in Mac's mount command."""
from volatility3.framework import renderers, interfaces, contexts
from volatility3.framework import renderers, interfaces
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.objects import utility
@@ -14,22 +14,20 @@ class Mount(plugins.PluginInterface):
"""A module containing a collection of plugins that produce data typically
foundin Mac's mount command"""
_required_framework_version = (1, 0, 0)
_required_framework_version = (1, 2, 0)
_version = (1, 0, 0)
_version = (2, 0, 0)
@classmethod
def get_requirements(cls):
return [
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
architectures = ["Intel32", "Intel64"]),
requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)),
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols")
]
@classmethod
def list_mounts(cls, context: interfaces.context.ContextInterface, layer_name: str, darwin_symbols: str):
def list_mounts(cls, context: interfaces.context.ContextInterface, kernel_module_name: str):
"""Lists all the mount structures in the primary layer.
Args:
@@ -40,7 +38,7 @@ class Mount(plugins.PluginInterface):
Returns:
A list of mount structures from the `layer_name` layer
"""
kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
kernel = context.modules[kernel_module_name]
list_head = kernel.object_from_symbol(symbol_name = "mountlist")
@@ -48,7 +46,7 @@ class Mount(plugins.PluginInterface):
yield mount
def _generator(self):
for mount in self.list_mounts(self.context, self.config['primary'], self.config['darwin']):
for mount in self.list_mounts(self.context, self.config['darwin']):
vfs = mount.mnt_vfsstat
device_name = utility.array_to_string(vfs.f_mntonname)
mount_point = utility.array_to_string(vfs.f_mntfromname)
volatility3/framework/plugins/mac/netstat.py
+8 -11
View File
@@ -19,16 +19,14 @@ vollog = logging.getLogger(__name__)
class Netstat(plugins.PluginInterface):
"""Lists all network connections for all processes."""
_required_framework_version = (1, 0, 0)
_required_framework_version = (1, 2, 0)
@classmethod
def get_requirements(cls):
return [
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Kernel Address Space',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "darwin", description = "Mac Kernel"),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)),
requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
architectures = ["Intel32", "Intel64"]),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (3, 0, 0)),
requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)),
requirements.ListRequirement(name = 'pid',
description = 'Filter on specific process IDs',
@@ -39,8 +37,7 @@ class Netstat(plugins.PluginInterface):
@classmethod
def list_sockets(cls,
context: interfaces.context.ContextInterface,
layer_name: str,
darwin_symbols: str,
kernel_module_name: str,
filter_func: Callable[[int], bool] = lambda _: False) -> \
Iterable[Tuple[interfaces.objects.ObjectInterface,
interfaces.objects.ObjectInterface,
@@ -56,12 +53,13 @@ class Netstat(plugins.PluginInterface):
"""
# This is hardcoded, since a change in the default method would change the expected results
list_tasks = pslist.PsList.get_list_tasks(pslist.PsList.pslist_methods[0])
for task in list_tasks(context, layer_name, darwin_symbols, filter_func):
for task in list_tasks(context, kernel_module_name, filter_func):
task_name = utility.array_to_string(task.p_comm)
pid = task.p_pid
for filp, _, _ in mac.MacUtilities.files_descriptors_for_process(context, darwin_symbols, task):
for filp, _, _ in mac.MacUtilities.files_descriptors_for_process(context, context.modules[
kernel_module_name].symbol_table_name, task):
try:
ftype = filp.f_fglob.get_fg_type()
except exceptions.InvalidAddressException:
@@ -81,7 +79,6 @@ class Netstat(plugins.PluginInterface):
filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None))
for task_name, pid, socket in self.list_sockets(self.context,
self.config['primary'],
self.config['darwin'],
filter_func = filter_func):
volatility3/framework/plugins/mac/proc_maps.py
+5 -8
View File
@@ -12,16 +12,14 @@ from volatility3.plugins.mac import pslist
class Maps(interfaces.plugins.PluginInterface):
"""Lists process memory ranges that potentially contain injected code."""
_required_framework_version = (1, 0, 0)
_required_framework_version = (1, 2, 0)
@classmethod
def get_requirements(cls):
return [
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel"),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)),
requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
architectures = ["Intel32", "Intel64"]),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (3, 0, 0)),
requirements.ListRequirement(name = 'pid',
description = 'Filter on specific process IDs',
element_type = int,
@@ -34,7 +32,7 @@ class Maps(interfaces.plugins.PluginInterface):
process_pid = task.p_pid
for vma in task.get_map_iter():
path = vma.get_path(self.context, self.config['darwin'])
path = vma.get_path(self.context, self.context.modules[self.config['darwin']].symbol_table_name)
if path == "":
path = vma.get_special_path()
@@ -49,6 +47,5 @@ class Maps(interfaces.plugins.PluginInterface):
("End", format_hints.Hex), ("Protection", str), ("Map Name", str)],
self._generator(
list_tasks(self.context,
self.config['primary'],
self.config['darwin'],
filter_func = filter_func)))
volatility3/framework/plugins/mac/psaux.py
+4 -7
View File
@@ -14,16 +14,14 @@ from volatility3.plugins.mac import pslist
class Psaux(plugins.PluginInterface):
"""Recovers program command line arguments."""
_required_framework_version = (1, 0, 0)
_required_framework_version = (1, 2, 0)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
return [
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)),
requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
architectures = ["Intel32", "Intel64"]),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (3, 0, 0)),
requirements.ListRequirement(name = 'pid',
description = 'Filter on specific process IDs',
element_type = int,
@@ -98,6 +96,5 @@ class Psaux(plugins.PluginInterface):
return renderers.TreeGrid([("PID", int), ("Process", str), ("Argc", int), ("Arguments", str)],
self._generator(
list_tasks(self.context,
self.config['primary'],
self.config['darwin'],
filter_func = filter_func)))
volatility3/framework/plugins/mac/pslist.py
+23 -39
View File
@@ -5,7 +5,7 @@
import logging
from typing import Callable, Iterable, List, Dict
from volatility3.framework import renderers, interfaces, contexts, exceptions
from volatility3.framework import renderers, interfaces, exceptions
from volatility3.framework.configuration import requirements
from volatility3.framework.objects import utility
from volatility3.framework.symbols import mac
@@ -16,17 +16,14 @@ vollog = logging.getLogger(__name__)
class PsList(interfaces.plugins.PluginInterface):
"""Lists the processes present in a particular mac memory image."""
_required_framework_version = (1, 0, 0)
_version = (2, 0, 0)
_required_framework_version = (1, 2, 0)
_version = (3, 0, 0)
pslist_methods = ['tasks', 'allproc', 'process_group', 'sessions', 'pid_hash_table']
@classmethod
def get_requirements(cls):
return [
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"),
requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS'),
requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 1, 0)),
requirements.ChoiceRequirement(name = 'pslist_method',
description = 'Method to determine for processes',
@@ -41,8 +38,8 @@ class PsList(interfaces.plugins.PluginInterface):
@classmethod
def get_list_tasks(
cls, method: str
) -> Callable[[interfaces.context.ContextInterface, str, str, Callable[[int], bool]],
cls, method: str
) -> Callable[[interfaces.context.ContextInterface, str, Callable[[int], bool]],
Iterable[interfaces.objects.ObjectInterface]]:
"""Returns the list_tasks method based on the selector
@@ -91,7 +88,6 @@ class PsList(interfaces.plugins.PluginInterface):
list_tasks = self.get_list_tasks(self.config.get('pslist_method', self.pslist_methods[0]))
for task in list_tasks(self.context,
self.config['primary'],
self.config['darwin'],
filter_func = self.create_pid_filter(self.config.get('pid', None))):
pid = task.p_pid
@@ -102,25 +98,23 @@ class PsList(interfaces.plugins.PluginInterface):
@classmethod
def list_tasks_allproc(cls,
context: interfaces.context.ContextInterface,
layer_name: str,
darwin_symbols: str,
kernel_module_name: str,
filter_func: Callable[[int], bool] = lambda _: False) -> \
Iterable[interfaces.objects.ObjectInterface]:
"""Lists all the processes in the primary layer based on the allproc method
Args:
context: The context to retrieve required elements (layers, symbol tables) from
layer_name: The name of the layer on which to operate
darwin_symbols: The name of the table containing the kernel symbols
kernel_module_name: The name of the the kernel module on which to operate
filter_func: A function which takes a process object and returns True if the process should be ignored/filtered
Returns:
The list of process objects from the processes linked list after filtering
"""
kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
kernel = context.modules[kernel_module_name]
kernel_layer = context.layers[layer_name]
kernel_layer = context.layers[kernel.layer_name]
proc = kernel.object_from_symbol(symbol_name = "allproc").lh_first
@@ -143,25 +137,22 @@ class PsList(interfaces.plugins.PluginInterface):
@classmethod
def list_tasks_tasks(cls,
context: interfaces.context.ContextInterface,
layer_name: str,
darwin_symbols: str,
kernel_module_name: str,
filter_func: Callable[[int], bool] = lambda _: False) -> \
Iterable[interfaces.objects.ObjectInterface]:
"""Lists all the tasks in the primary layer based on the tasks queue
Args:
context: The context to retrieve required elements (layers, symbol tables) from
layer_name: The name of the layer on which to operate
darwin_symbols: The name of the table containing the kernel symbols
kernel_module_name: The name of the the kernel module on which to operate
filter_func: A function which takes a task object and returns True if the task should be ignored/filtered
Returns:
The list of task objects from the `layer_name` layer's `tasks` list after filtering
"""
kernel = context.modules[kernel_module_name]
kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
kernel_layer = context.layers[layer_name]
kernel_layer = context.layers[kernel.layer_name]
queue_entry = kernel.object_from_symbol(symbol_name = "tasks")
@@ -184,22 +175,20 @@ class PsList(interfaces.plugins.PluginInterface):
@classmethod
def list_tasks_sessions(cls,
context: interfaces.context.ContextInterface,
layer_name: str,
darwin_symbols: str,
kernel_module_name: str,
filter_func: Callable[[int], bool] = lambda _: False) -> \
Iterable[interfaces.objects.ObjectInterface]:
"""Lists all the tasks in the primary layer using sessions
Args:
context: The context to retrieve required elements (layers, symbol tables) from
layer_name: The name of the layer on which to operate
darwin_symbols: The name of the table containing the kernel symbols
kernel_module_name: The name of the the kernel module on which to operate
filter_func: A function which takes a task object and returns True if the task should be ignored/filtered
Returns:
The list of task objects from the `layer_name` layer's `tasks` list after filtering
"""
kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
kernel = context.modules[kernel_module_name]
table_size = kernel.object_from_symbol(symbol_name = "sesshash")
@@ -218,23 +207,20 @@ class PsList(interfaces.plugins.PluginInterface):
@classmethod
def list_tasks_process_group(cls,
context: interfaces.context.ContextInterface,
layer_name: str,
darwin_symbols: str,
kernel_module_name: str,
filter_func: Callable[[int], bool] = lambda _: False) -> \
Iterable[interfaces.objects.ObjectInterface]:
"""Lists all the tasks in the primary layer using process groups
Args:
context: The context to retrieve required elements (layers, symbol tables) from
layer_name: The name of the layer on which to operate
darwin_symbols: The name of the table containing the kernel symbols
kernel_module_name: The name of the the kernel module on which to operate
filter_func: A function which takes a task object and returns True if the task should be ignored/filtered
Returns:
The list of task objects from the `layer_name` layer's `tasks` list after filtering
"""
kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
kernel = context.modules[kernel_module_name]
table_size = kernel.object_from_symbol(symbol_name = "pgrphash")
@@ -254,23 +240,21 @@ class PsList(interfaces.plugins.PluginInterface):
@classmethod
def list_tasks_pid_hash_table(cls,
context: interfaces.context.ContextInterface,
layer_name: str,
darwin_symbols: str,
kernel_module_name: str,
filter_func: Callable[[int], bool] = lambda _: False) -> \
Iterable[interfaces.objects.ObjectInterface]:
"""Lists all the tasks in the primary layer using the pid hash table
Args:
context: The context to retrieve required elements (layers, symbol tables) from
layer_name: The name of the layer on which to operate
darwin_symbols: The name of the table containing the kernel symbols
kernel_module_name: The name of the the kernel module on which to operate
filter_func: A function which takes a task object and returns True if the task should be ignored/filtered
Returns:
The list of task objects from the `layer_name` layer's `tasks` list after filtering
"""
kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
kernel = context.modules[kernel_module_name]
table_size = kernel.object_from_symbol(symbol_name = "pidhash")
volatility3/framework/plugins/mac/pstree.py
+5 -7
View File
@@ -13,7 +13,7 @@ class PsTree(plugins.PluginInterface):
"""Plugin for listing processes in a tree based on their parent process
ID."""
_required_framework_version = (1, 0, 0)
_required_framework_version = (1, 2, 0)
def __init__(self, *args, **kwargs):
super().__init__(*args, **kwargs)
@@ -24,11 +24,9 @@ class PsTree(plugins.PluginInterface):
@classmethod
def get_requirements(cls):
return [
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0))
requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
architectures = ["Intel32", "Intel64"]),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (3, 0, 0))
]
def _find_level(self, pid):
@@ -50,7 +48,7 @@ class PsTree(plugins.PluginInterface):
"""Generates the tree list of processes"""
list_tasks = pslist.PsList.get_list_tasks(self.config.get('pslist_method', pslist.PsList.pslist_methods[0]))
for proc in list_tasks(self.context, self.config['primary'], self.config['darwin']):
for proc in list_tasks(self.context, self.config['darwin']):
self._processes[proc.p_pid] = proc
# Build the child/level maps
volatility3/framework/plugins/mac/socket_filters.py
+8 -10
View File
@@ -5,7 +5,7 @@ import logging
from typing import List
from volatility3.framework import exceptions, interfaces
from volatility3.framework import renderers, contexts
from volatility3.framework import renderers
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.objects import utility
@@ -19,25 +19,23 @@ vollog = logging.getLogger(__name__)
class Socket_filters(plugins.PluginInterface):
"""Enumerates kernel socket filters."""
_required_framework_version = (1, 0, 0)
_required_framework_version = (1, 2, 0)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
return [
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"),
requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
architectures = ["Intel32", "Intel64"]),
requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)),
requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0))
requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (2, 0, 0))
]
def _generator(self):
kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
kernel = self.context.modules[self.config['darwin']]
mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin'])
mods = lsmod.Lsmod.list_modules(self.context, self.config['darwin'])
handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, kernel.layer_name, kernel, mods)
members_to_check = [
"sf_unregistered", "sf_attach", "sf_detach", "sf_notify", "sf_getpeername", "sf_getsockname", "sf_data_in",
volatility3/framework/plugins/mac/timers.py
+14 -13
View File
@@ -5,7 +5,7 @@ import logging
from typing import List
from volatility3.framework import exceptions, interfaces
from volatility3.framework import renderers, contexts
from volatility3.framework import renderers
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.renderers import format_hints
@@ -18,36 +18,36 @@ vollog = logging.getLogger(__name__)
class Timers(plugins.PluginInterface):
"""Check for malicious kernel timers."""
_required_framework_version = (1, 0, 0)
_required_framework_version = (1, 2, 0)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
return [
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"),
requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)),
requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0))
requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
architectures = ["Intel32", "Intel64"]),
requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 3, 0)),
requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (2, 0, 0))
]
def _generator(self):
kernel = contexts.Module(self.context, self.config['darwin'], self.config['primary'], 0)
kernel = self.context.modules[self.config['darwin']]
mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin'])
mods = lsmod.Lsmod.list_modules(self.context, self.config['darwin'])
handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, kernel.layer_name, kernel, mods)
real_ncpus = kernel.object_from_symbol(symbol_name = "real_ncpus")
cpu_data_ptrs_ptr = kernel.get_symbol("cpu_data_ptr").address
# Returns the a pointer to the absolute address
cpu_data_ptrs_addr = kernel.object(object_type = "pointer",
offset = cpu_data_ptrs_ptr,
subtype = kernel.get_type('long unsigned int'))
cpu_data_ptrs = kernel.object(object_type = "array",
offset = cpu_data_ptrs_addr,
absolute = True,
subtype = kernel.get_type('cpu_data'),
count = real_ncpus)
@@ -68,9 +68,10 @@ class Timers(plugins.PluginInterface):
else:
entry_time = -1
module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, handler)
module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, handler,
self.config['darwin'])
yield (0, (format_hints.Hex(handler), format_hints.Hex(timer.param0), format_hints.Hex(timer.param1), \
yield (0, (format_hints.Hex(handler), format_hints.Hex(timer.param0), format_hints.Hex(timer.param1),
timer.deadline, entry_time, module_name, symbol_name))
def run(self):
volatility3/framework/plugins/mac/trustedbsd.py
+12 -13
View File
@@ -6,7 +6,7 @@ import logging
from typing import List, Iterator, Any
from volatility3.framework import exceptions, interfaces
from volatility3.framework import renderers, contexts
from volatility3.framework import renderers
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.objects import utility
@@ -20,29 +20,28 @@ vollog = logging.getLogger(__name__)
class Trustedbsd(plugins.PluginInterface):
"""Checks for malicious trustedbsd modules"""
_required_framework_version = (1, 0, 0)
_required_framework_version = (1, 2, 0)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
return [
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"),
requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)),
requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0))
requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
architectures = ["Intel32", "Intel64"]),
requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 3, 0)),
requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (2, 0, 0))
]
def _generator(self, mods: Iterator[Any]):
kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
kernel = self.context.modules[self.config['darwin']]
handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, kernel.layer_name, kernel, mods)
policy_list = kernel.object_from_symbol(symbol_name = "mac_policy_list").cast("mac_policy_list")
entries = kernel.object(object_type = "array",
offset = policy_list.entries.dereference().vol.offset,
subtype = kernel.get_type('mac_policy_list_element'),
absolute = True,
count = policy_list.staticmax + 1)
for i, ent in enumerate(entries):
@@ -65,7 +64,8 @@ class Trustedbsd(plugins.PluginInterface):
if call_addr is None or call_addr == 0:
continue
module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, call_addr)
module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, call_addr,
self.config['darwin'])
yield (0, (check, ent_name, format_hints.Hex(call_addr), module_name, symbol_name))
@@ -73,5 +73,4 @@ class Trustedbsd(plugins.PluginInterface):
return renderers.TreeGrid([("Member", str), ("Policy Name", str), ("Handler Address", format_hints.Hex),
("Handler Module", str), ("Handler Symbol", str)],
self._generator(
lsmod.Lsmod.list_modules(self.context, self.config['primary'],
self.config['darwin'])))
lsmod.Lsmod.list_modules(self.context, self.config['darwin'])))
volatility3/framework/plugins/mac/vfsevents.py
+6 -7
View File
@@ -2,7 +2,7 @@
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
from volatility3.framework import renderers, interfaces, exceptions, contexts
from volatility3.framework import renderers, interfaces, exceptions
from volatility3.framework.configuration import requirements
from volatility3.framework.objects import utility
@@ -10,7 +10,7 @@ from volatility3.framework.objects import utility
class VFSevents(interfaces.plugins.PluginInterface):
""" Lists processes that are filtering file system events """
_required_framework_version = (1, 0, 0)
_required_framework_version = (1, 2, 0)
event_types = [
"CREATE_FILE", "DELETE", "STAT_CHANGED", "RENAME", "CONTENT_MODIFIED", "EXCHANGE", "FINDER_INFO_CHANGED",
@@ -20,10 +20,8 @@ class VFSevents(interfaces.plugins.PluginInterface):
@classmethod
def get_requirements(cls):
return [
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel"),
requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS',
architectures = ["Intel32", "Intel64"]),
]
def _generator(self):
@@ -32,7 +30,7 @@ class VFSevents(interfaces.plugins.PluginInterface):
Also lists which event(s) a process is registered for
"""
kernel = contexts.Module(self.context, self.config['darwin'], self.config['primary'], 0)
kernel = self.context.modules[self.config['darwin']]
watcher_table = kernel.object_from_symbol("watcher_table")
@@ -48,6 +46,7 @@ class VFSevents(interfaces.plugins.PluginInterface):
try:
event_array = kernel.object(object_type = "array",
offset = watcher.event_list,
absolute = True,
count = 13,
subtype = kernel.get_type("unsigned char"))