WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-07 18:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

dump of processes extracted by psscan (Issue #318)

Browse Source
This commit is contained in:
cecio
2020-09-08 22:36:09 +01:00
committed by ikelos
parent 6b9ec5a079
commit d060a5cbdb
1 changed files with 86 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/psscan.py
+86 -7
View File
@@ -9,9 +9,12 @@ from typing import Iterable, Callable
from volatility.framework import renderers, interfaces
from volatility.framework.configuration import requirements
from volatility.framework.renderers import format_hints
from volatility.framework.symbols import intermed
from volatility.framework.symbols.windows import extensions
from volatility.plugins import timeliner
from volatility.plugins.windows import poolscanner
from volatility.plugins.windows import pslist
from volatility.plugins.windows import info
vollog = logging.getLogger(__name__)
@@ -29,10 +32,15 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)),
requirements.VersionRequirement(name = 'info', component = info.Info, version = (1, 0, 0)),
requirements.ListRequirement(name = 'pid',
element_type = int,
description = "Process ID to include (all other processes are excluded)",
optional = True)
optional = True),
requirements.BooleanRequirement(name = 'dump',
description = "Extract listed processes",
default = False,
optional = True)
]
@classmethod
@@ -61,17 +69,88 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
if not filter_func(mem_object):
yield mem_object
def _generator(self):
@classmethod
def virtual_process_from_physical(cls,
context: interfaces.context.ContextInterface,
layer_name: str,
symbol_table: str,
proc: interfaces.objects.ObjectInterface) -> \
Iterable[interfaces.objects.ObjectInterface]:
""" Returns a virtual process from a physical addressed one
Args:
context: The context to retrieve required elements (layers, symbol tables) from
layer_name: The name of the layer on which to operate
symbol_table: The name of the table containing the kernel symbols
proc: the process object with phisical address
Returns:
A process object on virtual address space
"""
# We'll use the first thread to bounce back to the virtual process
kvo = context.layers[layer_name].config['kernel_virtual_offset']
ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo)
tleoffset = ntkrnlmp.get_type("_ETHREAD").relative_child_offset("ThreadListEntry")
# Start out with the member offset given to us from the profile
offsets = [tleoffset]
# If (and only if) we're dealing with 64-bit Windows 7 SP1
# then add the other commonly seen member offset to the list
kuser = info.Info.get_kuser_structure(context, layer_name, symbol_table)
nt_major_version = int(kuser.NtMajorVersion)
nt_minor_version = int(kuser.NtMinorVersion)
vers = info.Info.get_version_structure(context, layer_name, symbol_table)
build = vers.MinorVersion
bits = context.layers[layer_name].bits_per_register
version = (nt_major_version, nt_minor_version, build)
if version == (6, 1, 7601) and bits == 64:
offsets.append(tleoffset + 8)
# Now we can try to bounce back
for ofs in offsets:
ethread = ntkrnlmp.object(object_type = "_ETHREAD",
offset = proc.ThreadListHead.Flink - ofs,
absolute = True)
# Ask for the thread's process to get an _EPROCESS with a virtual address space
virtual_process = ethread.owning_process()
# Sanity check the bounce.
# This compares the original offset with the new one (translated from virtual space)
(_, _, ph_offset, _, _) = list(context.layers[layer_name].mapping(offset = virtual_process.vol.offset,
length = 0))[0]
if virtual_process and \
proc.vol.offset == ph_offset:
return virtual_process
def _generator(self):
pe_table_name = intermed.IntermediateSymbolTable.create(self.context,
self.config_path,
"windows",
"pe",
class_types = extensions.pe.class_types)
for proc in self.scan_processes(self.context,
self.config['primary'],
self.config['nt_symbols'],
filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None))):
dumped = False
if self.config['dump']:
vproc = self.virtual_process_from_physical(self.context, self.config['primary'],
self.config['nt_symbols'], proc)
filedata = pslist.PsList.process_dump(self.context, self.config['nt_symbols'], pe_table_name, vproc)
if filedata:
dumped = True
self.produce_file(filedata)
yield (0, (proc.UniqueProcessId, proc.InheritedFromUniqueProcessId,
proc.ImageFileName.cast("string", max_length = proc.ImageFileName.vol.count, errors = 'replace'),
format_hints.Hex(proc.vol.offset), proc.ActiveThreads, proc.get_handle_count(),
proc.get_session_id(), proc.get_is_wow64(), proc.get_create_time(), proc.get_exit_time()))
proc.ImageFileName.cast("string", max_length = proc.ImageFileName.vol.count,
errors = 'replace'), format_hints.Hex(proc.vol.offset),
proc.ActiveThreads, proc.get_handle_count(), proc.get_session_id(), proc.get_is_wow64(),
proc.get_create_time(), proc.get_exit_time(), dumped))
def generate_timeline(self):
for row in self._generator():
@@ -83,5 +162,5 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
def run(self):
return renderers.TreeGrid([("PID", int), ("PPID", int), ("ImageFileName", str), ("Offset", format_hints.Hex),
("Threads", int), ("Handles", int), ("SessionId", int), ("Wow64", bool),
("CreateTime", datetime.datetime), ("ExitTime", datetime.datetime)],
self._generator())
("CreateTime", datetime.datetime), ("ExitTime", datetime.datetime),
("Dumped", bool)], self._generator())