From dc8bec199f3ef161ceb2b4cb5226f360067b2842 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 24 Sep 2020 01:01:51 +0100 Subject: [PATCH] Windows: Minor formatting and typing improvements --- .../framework/plugins/windows/envars.py | 75 ++++++++++--------- .../plugins/windows/getservicesids.py | 19 +++-- .../framework/plugins/windows/getsids.py | 28 +++---- 3 files changed, 64 insertions(+), 58 deletions(-) diff --git a/volatility/framework/plugins/windows/envars.py b/volatility/framework/plugins/windows/envars.py index 9f5ac0c05..2f534e9e3 100644 --- a/volatility/framework/plugins/windows/envars.py +++ b/volatility/framework/plugins/windows/envars.py @@ -1,13 +1,17 @@ # This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +import logging +from typing import List -from typing import Callable, List, Generator, Iterable, Dict -from volatility.framework import renderers, interfaces, objects, exceptions +from volatility.framework import renderers, interfaces, objects, exceptions, constants from volatility.framework.configuration import requirements -from volatility.framework.objects import utility +from volatility.framework.layers import registry from volatility.plugins.windows import pslist from volatility.plugins.windows.registry import hivelist +vollog = logging.getLogger(__name__) + + class Envars(interfaces.plugins.PluginInterface): "Display process environment variables" @@ -24,18 +28,18 @@ class Envars(interfaces.plugins.PluginInterface): description = 'Filter on specific process IDs', element_type = int, optional = True), - requirements.BooleanRequirement(name='silent', - description='Suppress common and non-persistent variables', - optional=True), + requirements.BooleanRequirement(name = 'silent', + description = 'Suppress common and non-persistent variables', + optional = True), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), requirements.PluginRequirement(name = 'hivelist', plugin = hivelist.HiveList, version = (1, 0, 0)) ] def _get_silent_vars(self) -> List[str]: """Enumerate persistent & common variables. - - This function collects the global (all users) and - user-specific environment variables from the + + This function collects the global (all users) and + user-specific environment variables from the registry. Any variables in a process env block that does not exist in the persistent list was explicitly set with the SetEnvironmentVariable() API. @@ -43,16 +47,15 @@ class Envars(interfaces.plugins.PluginInterface): values = [] - for hive in hivelist.HiveList.list_hives(context = self.context, - base_config_path = self.config_path, - layer_name = self.config['primary'], - symbol_table = self.config['nt_symbols'], - hive_offsets = None): + base_config_path = self.config_path, + layer_name = self.config['primary'], + symbol_table = self.config['nt_symbols'], + hive_offsets = None): sys = False ntuser = False - ## The global variables + ## The global variables try: key = hive.get_key('CurrentControlSet\\Control\\Session Manager\\Environment') sys = True @@ -69,8 +72,9 @@ class Envars(interfaces.plugins.PluginInterface): value_node_name = node.get_name() if value_node_name: values.append(value_node_name) - except (exceptions.InvalidAddressException, RegistryFormatException) as excp: - vollog.log(constants.LOGLEVEL_VVV, "Error while parsing global environment variables keys (some keys might be excluded)") + except (exceptions.InvalidAddressException, registry.RegistryFormatException) as excp: + vollog.log(constants.LOGLEVEL_VVV, + "Error while parsing global environment variables keys (some keys might be excluded)") continue except KeyError: pass @@ -88,8 +92,9 @@ class Envars(interfaces.plugins.PluginInterface): value_node_name = node.get_name() if value_node_name: values.append(value_node_name) - except (exceptions.InvalidAddressException, RegistryFormatException) as excp: - vollog.log(constants.LOGLEVEL_VVV, "Error while parsing user environment variables keys (some keys might be excluded)") + except (exceptions.InvalidAddressException, registry.RegistryFormatException) as excp: + vollog.log(constants.LOGLEVEL_VVV, + "Error while parsing user environment variables keys (some keys might be excluded)") continue except KeyError: pass @@ -105,15 +110,15 @@ class Envars(interfaces.plugins.PluginInterface): value_node_name = node.get_name() if value_node_name: values.append(value_node_name) - except (exceptions.InvalidAddressException, RegistryFormatException) as excp: - vollog.log(constants.LOGLEVEL_VVV, "Error while parsing volatile environment variables keys (some keys might be excluded)") + except (exceptions.InvalidAddressException, registry.RegistryFormatException) as excp: + vollog.log(constants.LOGLEVEL_VVV, + "Error while parsing volatile environment variables keys (some keys might be excluded)") continue except KeyError: continue - ## These are variables set explicitly but are - ## common enough to ignore safely. + ## common enough to ignore safely. values.extend(["ProgramFiles", "CommonProgramFiles", "SystemDrive", "SystemRoot", "ProgramData", "PUBLIC", "ALLUSERSPROFILE", "COMPUTERNAME", "SESSIONNAME", "USERNAME", "USERPROFILE", @@ -132,27 +137,27 @@ class Envars(interfaces.plugins.PluginInterface): return values def _generator(self, data): + silent_vars = [] if self.config.get('SILENT', None): silent_vars = self._get_silent_vars() for task in data: for var, val in task.environment_variables(): - if self.config.get('SILENT', None): + if self.config.get('silent', None): if var in silent_vars: - continue - yield (0, [int(task.UniqueProcessId), - str(objects.utility.array_to_string(task.ImageFileName)), - hex(task.get_peb().ProcessParameters.Environment.vol.offset), - str(var), - str(val)]) - + continue + yield (0, (int(task.UniqueProcessId), + str(objects.utility.array_to_string(task.ImageFileName)), + hex(task.get_peb().ProcessParameters.Environment.vol.offset), + str(var), + str(val))) def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) - return renderers.TreeGrid([("PID", int),("Process", str),("Block", str),("Variable", str),("Value", str)], + return renderers.TreeGrid([("PID", int), ("Process", str), ("Block", str), ("Variable", str), ("Value", str)], self._generator(pslist.PsList.list_processes(context = self.context, - layer_name = self.config['primary'], - symbol_table = self.config['nt_symbols'], - filter_func = filter_func))) + layer_name = self.config['primary'], + symbol_table = self.config['nt_symbols'], + filter_func = filter_func))) diff --git a/volatility/framework/plugins/windows/getservicesids.py b/volatility/framework/plugins/windows/getservicesids.py index 8e7e5b4f9..878cc99b8 100644 --- a/volatility/framework/plugins/windows/getservicesids.py +++ b/volatility/framework/plugins/windows/getservicesids.py @@ -1,17 +1,16 @@ # This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 -from volatility.plugins.windows.registry import hivelist -from volatility.framework import renderers, interfaces, objects, constants, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints - -from typing import List -import logging import hashlib +import json +import logging +import os import struct -import os, json +from typing import List + +from volatility.framework import renderers, interfaces, constants, exceptions +from volatility.framework.configuration import requirements +from volatility.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) @@ -81,7 +80,7 @@ class GetServiceSIDs(interfaces.plugins.PluginInterface): for s in services.get_subkeys(): if s.get_name() not in self.servicesids.values(): sid = createservicesid(s.get_name()) - yield (0, [sid, s.get_name()]) + yield (0, (sid, s.get_name())) def run(self): return renderers.TreeGrid([("SID", str), ("Service", str)], self._generator()) diff --git a/volatility/framework/plugins/windows/getsids.py b/volatility/framework/plugins/windows/getsids.py index 0fdcc8c5e..3c0b5e192 100644 --- a/volatility/framework/plugins/windows/getsids.py +++ b/volatility/framework/plugins/windows/getsids.py @@ -1,24 +1,28 @@ # This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +import json import logging -import re, ntpath, os, json -from typing import Callable, List, Generator, Iterable, Dict +import ntpath +import os +import re +from typing import List, Dict, Union + from volatility.framework import renderers, interfaces, objects, exceptions, constants, layers from volatility.framework.configuration import requirements -from volatility.framework.objects import utility from volatility.framework.renderers import format_hints +from volatility.framework.symbols.windows.extensions import registry from volatility.plugins.windows import pslist from volatility.plugins.windows.registry import hivelist -import volatility.framework.symbols.windows.extensions.registry as registry vollog = logging.getLogger(__name__) -def find_sid_re(sid_string, sid_re_list) -> str: +def find_sid_re(sid_string, sid_re_list) -> Union[str, interfaces.renderers.BaseAbsentValue]: for reg, name in sid_re_list: if reg.search(sid_string): return name + return renderers.NotAvailableValue() class GetSIDs(interfaces.plugins.PluginInterface): @@ -117,15 +121,13 @@ class GetSIDs(interfaces.plugins.PluginInterface): # Go all over the process list, get the token for task in procs: - #print('here') - #print(task.UniqueProcessId) # Make sure we have a valid token try: token = task.Token.dereference().cast("_TOKEN") except exceptions.InvalidAddressException: token = False - if not token: + if not token or not isinstance(token, interfaces.objects.ObjectInterface): yield (0, [int(task.UniqueProcessId), str(task.ImageFileName), "Token unreadable", ""]) continue @@ -144,12 +146,12 @@ class GetSIDs(interfaces.plugins.PluginInterface): else: sid_name = "" - yield (0, [ - int(task.UniqueProcessId), + yield (0, ( + task.UniqueProcessId, objects.utility.array_to_string(task.ImageFileName), - str(sid_string), - str(sid_name) - ]) + sid_string, + sid_name + )) def run(self):