diff --git a/volatility/framework/plugins/windows/psscan.py b/volatility/framework/plugins/windows/psscan.py index 80595fb98..07b8cbd39 100644 --- a/volatility/framework/plugins/windows/psscan.py +++ b/volatility/framework/plugins/windows/psscan.py @@ -9,9 +9,12 @@ from typing import Iterable, Callable from volatility.framework import renderers, interfaces from volatility.framework.configuration import requirements from volatility.framework.renderers import format_hints +from volatility.framework.symbols import intermed +from volatility.framework.symbols.windows import extensions from volatility.plugins import timeliner from volatility.plugins.windows import poolscanner from volatility.plugins.windows import pslist +from volatility.plugins.windows import info vollog = logging.getLogger(__name__) @@ -29,10 +32,15 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), + requirements.VersionRequirement(name = 'info', component = info.Info, version = (1, 0, 0)), requirements.ListRequirement(name = 'pid', element_type = int, description = "Process ID to include (all other processes are excluded)", - optional = True) + optional = True), + requirements.BooleanRequirement(name = 'dump', + description = "Extract listed processes", + default = False, + optional = True) ] @classmethod @@ -61,17 +69,88 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): if not filter_func(mem_object): yield mem_object - def _generator(self): + @classmethod + def virtual_process_from_physical(cls, + context: interfaces.context.ContextInterface, + layer_name: str, + symbol_table: str, + proc: interfaces.objects.ObjectInterface) -> \ + Iterable[interfaces.objects.ObjectInterface]: + """ Returns a virtual process from a physical addressed one + Args: + context: The context to retrieve required elements (layers, symbol tables) from + layer_name: The name of the layer on which to operate + symbol_table: The name of the table containing the kernel symbols + proc: the process object with phisical address + + Returns: + A process object on virtual address space + + """ + + # We'll use the first thread to bounce back to the virtual process + kvo = context.layers[layer_name].config['kernel_virtual_offset'] + ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo) + + tleoffset = ntkrnlmp.get_type("_ETHREAD").relative_child_offset("ThreadListEntry") + # Start out with the member offset given to us from the profile + offsets = [tleoffset] + + # If (and only if) we're dealing with 64-bit Windows 7 SP1 + # then add the other commonly seen member offset to the list + kuser = info.Info.get_kuser_structure(context, layer_name, symbol_table) + nt_major_version = int(kuser.NtMajorVersion) + nt_minor_version = int(kuser.NtMinorVersion) + vers = info.Info.get_version_structure(context, layer_name, symbol_table) + build = vers.MinorVersion + bits = context.layers[layer_name].bits_per_register + version = (nt_major_version, nt_minor_version, build) + if version == (6, 1, 7601) and bits == 64: + offsets.append(tleoffset + 8) + + # Now we can try to bounce back + for ofs in offsets: + ethread = ntkrnlmp.object(object_type = "_ETHREAD", + offset = proc.ThreadListHead.Flink - ofs, + absolute = True) + + # Ask for the thread's process to get an _EPROCESS with a virtual address space + virtual_process = ethread.owning_process() + # Sanity check the bounce. + # This compares the original offset with the new one (translated from virtual space) + (_, _, ph_offset, _, _) = list(context.layers[layer_name].mapping(offset = virtual_process.vol.offset, + length = 0))[0] + if virtual_process and \ + proc.vol.offset == ph_offset: + return virtual_process + + def _generator(self): + pe_table_name = intermed.IntermediateSymbolTable.create(self.context, + self.config_path, + "windows", + "pe", + class_types = extensions.pe.class_types) for proc in self.scan_processes(self.context, self.config['primary'], self.config['nt_symbols'], filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None))): + dumped = False + if self.config['dump']: + vproc = self.virtual_process_from_physical(self.context, self.config['primary'], + self.config['nt_symbols'], proc) + + filedata = pslist.PsList.process_dump(self.context, self.config['nt_symbols'], pe_table_name, vproc) + if filedata: + dumped = True + self.produce_file(filedata) + yield (0, (proc.UniqueProcessId, proc.InheritedFromUniqueProcessId, - proc.ImageFileName.cast("string", max_length = proc.ImageFileName.vol.count, errors = 'replace'), - format_hints.Hex(proc.vol.offset), proc.ActiveThreads, proc.get_handle_count(), - proc.get_session_id(), proc.get_is_wow64(), proc.get_create_time(), proc.get_exit_time())) + proc.ImageFileName.cast("string", max_length = proc.ImageFileName.vol.count, + errors = 'replace'), format_hints.Hex(proc.vol.offset), + proc.ActiveThreads, proc.get_handle_count(), proc.get_session_id(), proc.get_is_wow64(), + proc.get_create_time(), proc.get_exit_time(), dumped)) def generate_timeline(self): for row in self._generator(): @@ -83,5 +162,5 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): def run(self): return renderers.TreeGrid([("PID", int), ("PPID", int), ("ImageFileName", str), ("Offset", format_hints.Hex), ("Threads", int), ("Handles", int), ("SessionId", int), ("Wow64", bool), - ("CreateTime", datetime.datetime), ("ExitTime", datetime.datetime)], - self._generator()) + ("CreateTime", datetime.datetime), ("ExitTime", datetime.datetime), + ("Dumped", bool)], self._generator())