WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-07 02:07:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Windows: Minor formatting and typing improvements

Browse Source
This commit is contained in:
Mike Auty
2020-09-24 01:01:51 +01:00
parent b07ce5bd38
commit dc8bec199f
3 changed files with 64 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/envars.py
+40 -35
View File
@@ -1,13 +1,17 @@
# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
import logging
from typing import List
from typing import Callable, List, Generator, Iterable, Dict
from volatility.framework import renderers, interfaces, objects, exceptions
from volatility.framework import renderers, interfaces, objects, exceptions, constants
from volatility.framework.configuration import requirements
from volatility.framework.objects import utility
from volatility.framework.layers import registry
from volatility.plugins.windows import pslist
from volatility.plugins.windows.registry import hivelist
vollog = logging.getLogger(__name__)
class Envars(interfaces.plugins.PluginInterface):
"Display process environment variables"
@@ -24,18 +28,18 @@ class Envars(interfaces.plugins.PluginInterface):
description = 'Filter on specific process IDs',
element_type = int,
optional = True),
requirements.BooleanRequirement(name='silent',
description='Suppress common and non-persistent variables',
optional=True),
requirements.BooleanRequirement(name = 'silent',
description = 'Suppress common and non-persistent variables',
optional = True),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)),
requirements.PluginRequirement(name = 'hivelist', plugin = hivelist.HiveList, version = (1, 0, 0))
]
def _get_silent_vars(self) -> List[str]:
"""Enumerate persistent & common variables.
This function collects the global (all users) and
user-specific environment variables from the
This function collects the global (all users) and
user-specific environment variables from the
registry. Any variables in a process env block that
does not exist in the persistent list was explicitly
set with the SetEnvironmentVariable() API.
@@ -43,16 +47,15 @@ class Envars(interfaces.plugins.PluginInterface):
values = []
for hive in hivelist.HiveList.list_hives(context = self.context,
base_config_path = self.config_path,
layer_name = self.config['primary'],
symbol_table = self.config['nt_symbols'],
hive_offsets = None):
base_config_path = self.config_path,
layer_name = self.config['primary'],
symbol_table = self.config['nt_symbols'],
hive_offsets = None):
sys = False
ntuser = False
## The global variables
## The global variables
try:
key = hive.get_key('CurrentControlSet\\Control\\Session Manager\\Environment')
sys = True
@@ -69,8 +72,9 @@ class Envars(interfaces.plugins.PluginInterface):
value_node_name = node.get_name()
if value_node_name:
values.append(value_node_name)
except (exceptions.InvalidAddressException, RegistryFormatException) as excp:
vollog.log(constants.LOGLEVEL_VVV, "Error while parsing global environment variables keys (some keys might be excluded)")
except (exceptions.InvalidAddressException, registry.RegistryFormatException) as excp:
vollog.log(constants.LOGLEVEL_VVV,
"Error while parsing global environment variables keys (some keys might be excluded)")
continue
except KeyError:
pass
@@ -88,8 +92,9 @@ class Envars(interfaces.plugins.PluginInterface):
value_node_name = node.get_name()
if value_node_name:
values.append(value_node_name)
except (exceptions.InvalidAddressException, RegistryFormatException) as excp:
vollog.log(constants.LOGLEVEL_VVV, "Error while parsing user environment variables keys (some keys might be excluded)")
except (exceptions.InvalidAddressException, registry.RegistryFormatException) as excp:
vollog.log(constants.LOGLEVEL_VVV,
"Error while parsing user environment variables keys (some keys might be excluded)")
continue
except KeyError:
pass
@@ -105,15 +110,15 @@ class Envars(interfaces.plugins.PluginInterface):
value_node_name = node.get_name()
if value_node_name:
values.append(value_node_name)
except (exceptions.InvalidAddressException, RegistryFormatException) as excp:
vollog.log(constants.LOGLEVEL_VVV, "Error while parsing volatile environment variables keys (some keys might be excluded)")
except (exceptions.InvalidAddressException, registry.RegistryFormatException) as excp:
vollog.log(constants.LOGLEVEL_VVV,
"Error while parsing volatile environment variables keys (some keys might be excluded)")
continue
except KeyError:
continue
## These are variables set explicitly but are
## common enough to ignore safely.
## common enough to ignore safely.
values.extend(["ProgramFiles", "CommonProgramFiles", "SystemDrive",
"SystemRoot", "ProgramData", "PUBLIC", "ALLUSERSPROFILE",
"COMPUTERNAME", "SESSIONNAME", "USERNAME", "USERPROFILE",
@@ -132,27 +137,27 @@ class Envars(interfaces.plugins.PluginInterface):
return values
def _generator(self, data):
silent_vars = []
if self.config.get('SILENT', None):
silent_vars = self._get_silent_vars()
for task in data:
for var, val in task.environment_variables():
if self.config.get('SILENT', None):
if self.config.get('silent', None):
if var in silent_vars:
continue
yield (0, [int(task.UniqueProcessId),
str(objects.utility.array_to_string(task.ImageFileName)),
hex(task.get_peb().ProcessParameters.Environment.vol.offset),
str(var),
str(val)])
continue
yield (0, (int(task.UniqueProcessId),
str(objects.utility.array_to_string(task.ImageFileName)),
hex(task.get_peb().ProcessParameters.Environment.vol.offset),
str(var),
str(val)))
def run(self):
filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None))
return renderers.TreeGrid([("PID", int),("Process", str),("Block", str),("Variable", str),("Value", str)],
return renderers.TreeGrid([("PID", int), ("Process", str), ("Block", str), ("Variable", str), ("Value", str)],
self._generator(pslist.PsList.list_processes(context = self.context,
layer_name = self.config['primary'],
symbol_table = self.config['nt_symbols'],
filter_func = filter_func)))
layer_name = self.config['primary'],
symbol_table = self.config['nt_symbols'],
filter_func = filter_func)))
volatility/framework/plugins/windows/getservicesids.py
+9 -10
View File
@@ -1,17 +1,16 @@
# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
from volatility.plugins.windows.registry import hivelist
from volatility.framework import renderers, interfaces, objects, constants, exceptions
from volatility.framework.configuration import requirements
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from typing import List
import logging
import hashlib
import json
import logging
import os
import struct
import os, json
from typing import List
from volatility.framework import renderers, interfaces, constants, exceptions
from volatility.framework.configuration import requirements
from volatility.plugins.windows.registry import hivelist
vollog = logging.getLogger(__name__)
@@ -81,7 +80,7 @@ class GetServiceSIDs(interfaces.plugins.PluginInterface):
for s in services.get_subkeys():
if s.get_name() not in self.servicesids.values():
sid = createservicesid(s.get_name())
yield (0, [sid, s.get_name()])
yield (0, (sid, s.get_name()))
def run(self):
return renderers.TreeGrid([("SID", str), ("Service", str)], self._generator())
volatility/framework/plugins/windows/getsids.py
+15 -13
View File
@@ -1,24 +1,28 @@
# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
import json
import logging
import re, ntpath, os, json
from typing import Callable, List, Generator, Iterable, Dict
import ntpath
import os
import re
from typing import List, Dict, Union
from volatility.framework import renderers, interfaces, objects, exceptions, constants, layers
from volatility.framework.configuration import requirements
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from volatility.framework.symbols.windows.extensions import registry
from volatility.plugins.windows import pslist
from volatility.plugins.windows.registry import hivelist
import volatility.framework.symbols.windows.extensions.registry as registry
vollog = logging.getLogger(__name__)
def find_sid_re(sid_string, sid_re_list) -> str:
def find_sid_re(sid_string, sid_re_list) -> Union[str, interfaces.renderers.BaseAbsentValue]:
for reg, name in sid_re_list:
if reg.search(sid_string):
return name
return renderers.NotAvailableValue()
class GetSIDs(interfaces.plugins.PluginInterface):
@@ -117,15 +121,13 @@ class GetSIDs(interfaces.plugins.PluginInterface):
# Go all over the process list, get the token
for task in procs:
#print('here')
#print(task.UniqueProcessId)
# Make sure we have a valid token
try:
token = task.Token.dereference().cast("_TOKEN")
except exceptions.InvalidAddressException:
token = False
if not token:
if not token or not isinstance(token, interfaces.objects.ObjectInterface):
yield (0, [int(task.UniqueProcessId), str(task.ImageFileName), "Token unreadable", ""])
continue
@@ -144,12 +146,12 @@ class GetSIDs(interfaces.plugins.PluginInterface):
else:
sid_name = ""
yield (0, [
int(task.UniqueProcessId),
yield (0, (
task.UniqueProcessId,
objects.utility.array_to_string(task.ImageFileName),
str(sid_string),
str(sid_name)
])
sid_string,
sid_name
))
def run(self):