diff --git a/volatility3/framework/plugins/windows/devicetree.py b/volatility3/framework/plugins/windows/devicetree.py index 6f39799c1..012a8750d 100644 --- a/volatility3/framework/plugins/windows/devicetree.py +++ b/volatility3/framework/plugins/windows/devicetree.py @@ -90,16 +90,15 @@ class DeviceTree(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="driverscan", plugin=driverscan.DriverScan, version=(1, 0, 0) + name="driverscan", plugin=driverscan.DriverScan, version=(2, 0, 0) ), ] def _generator(self) -> Iterator[Tuple]: - kernel = self.context.modules[self.config["kernel"]] - # Scan the Layer for drivers for driver in driverscan.DriverScan.scan_drivers( - self.context, kernel.layer_name, kernel.symbol_table_name + self.context, + self.config["kernel"], ): try: try: diff --git a/volatility3/framework/plugins/windows/driverirp.py b/volatility3/framework/plugins/windows/driverirp.py index c3eb7c5c1..a1959453a 100644 --- a/volatility3/framework/plugins/windows/driverirp.py +++ b/volatility3/framework/plugins/windows/driverirp.py @@ -2,11 +2,15 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # +import logging + from volatility3.framework import constants from volatility3.framework import renderers, exceptions, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints -from volatility3.plugins.windows import ssdt, driverscan +from volatility3.plugins.windows import ssdt, driverscan, modules + +vollog = logging.getLogger(__name__) MAJOR_FUNCTIONS = [ "IRP_MJ_CREATE", @@ -58,7 +62,10 @@ class DriverIrp(interfaces.plugins.PluginInterface): name="ssdt", plugin=ssdt.SSDT, version=(1, 0, 0) ), requirements.PluginRequirement( - name="driverscan", plugin=driverscan.DriverScan, version=(1, 0, 0) + name="driverscan", plugin=driverscan.DriverScan, version=(2, 0, 0) + ), + requirements.PluginRequirement( + name="modules", plugin=modules.Modules, version=(2, 1, 0) ), ] @@ -69,17 +76,34 @@ class DriverIrp(interfaces.plugins.PluginInterface): self.context, kernel.layer_name, kernel.symbol_table_name ) + kernel_space_start = modules.Modules.get_kernel_space_start( + self.context, self.config["kernel"] + ) + for driver in driverscan.DriverScan.scan_drivers( - self.context, kernel.layer_name, kernel.symbol_table_name + self.context, + self.config["kernel"], ): try: driver_name = driver.get_driver_name() except (ValueError, exceptions.InvalidAddressException): driver_name = renderers.NotApplicableValue() - for i, address in enumerate(driver.MajorFunction): + for i in range(len(driver.MajorFunction)): + try: + irp_handler = driver.MajorFunction[i] + except exceptions.InvalidAddressException: + vollog.debug( + f"Failed to get IRP handler entry at index {i} for driver at {driver.vol.offset:#x}" + ) + continue + + # smear + if irp_handler < kernel_space_start: + continue + module_symbols = collection.get_module_symbols_by_absolute_location( - address + irp_handler ) module_found = False @@ -96,7 +120,7 @@ class DriverIrp(interfaces.plugins.PluginInterface): format_hints.Hex(driver.vol.offset), driver_name, MAJOR_FUNCTIONS[i], - format_hints.Hex(address), + format_hints.Hex(irp_handler), module_name, symbol.split(constants.BANG)[1], ), @@ -109,7 +133,7 @@ class DriverIrp(interfaces.plugins.PluginInterface): format_hints.Hex(driver.vol.offset), driver_name, MAJOR_FUNCTIONS[i], - format_hints.Hex(address), + format_hints.Hex(irp_handler), module_name, renderers.NotAvailableValue(), ), @@ -122,7 +146,7 @@ class DriverIrp(interfaces.plugins.PluginInterface): format_hints.Hex(driver.vol.offset), driver_name, MAJOR_FUNCTIONS[i], - format_hints.Hex(address), + format_hints.Hex(irp_handler), renderers.NotAvailableValue(), renderers.NotAvailableValue(), ), diff --git a/volatility3/framework/plugins/windows/drivermodule.py b/volatility3/framework/plugins/windows/drivermodule.py index de827602e..db1255637 100644 --- a/volatility3/framework/plugins/windows/drivermodule.py +++ b/volatility3/framework/plugins/windows/drivermodule.py @@ -5,7 +5,7 @@ from typing import Iterator, List, Tuple from volatility3.framework import renderers, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints -from volatility3.plugins.windows import ssdt, driverscan +from volatility3.plugins.windows import ssdt, driverscan, modules # built in Windows-components that trigger false positives KNOWN_DRIVERS = ["ACPI_HAL", "PnpManager", "RAW", "WMIxWDM", "Win32k", "Fs_Rec"] @@ -29,7 +29,10 @@ class DriverModule(interfaces.plugins.PluginInterface): name="ssdt", plugin=ssdt.SSDT, version=(1, 0, 0) ), requirements.PluginRequirement( - name="driverscan", plugin=driverscan.DriverScan, version=(1, 0, 0) + name="driverscan", plugin=driverscan.DriverScan, version=(2, 0, 0) + ), + requirements.PluginRequirement( + name="modules", plugin=modules.Modules, version=(2, 1, 0) ), ] @@ -45,9 +48,19 @@ class DriverModule(interfaces.plugins.PluginInterface): self.context, kernel.layer_name, kernel.symbol_table_name ) + kernel_space_start = modules.Modules.get_kernel_space_start( + self.context, self.config["kernel"] + ) + for driver in driverscan.DriverScan.scan_drivers( - self.context, kernel.layer_name, kernel.symbol_table_name + self.context, + self.config["kernel"], ): + # We want starts of 0 as rootkits often set this value + # greater than 0 but less than the kernel space start is smear/terminated though + if 0 < driver.DriverStart < kernel_space_start: + continue + # we do not care about actual symbol names, we just want to know if the driver points to a known module module_symbols = list( collection.get_module_symbols_by_absolute_location(driver.DriverStart) @@ -59,6 +72,10 @@ class DriverModule(interfaces.plugins.PluginInterface): name, ) = driverscan.DriverScan.get_names_for_driver(driver) + # drivers without any names will not produce useful output + if not driver_name and not service_key and not name: + continue + known_exception = driver_name in KNOWN_DRIVERS yield ( @@ -66,9 +83,9 @@ class DriverModule(interfaces.plugins.PluginInterface): ( format_hints.Hex(driver.vol.offset), known_exception, - driver_name, - service_key, - name, + driver_name or renderers.NotAvailableValue(), + service_key or renderers.NotAvailableValue(), + name or renderers.NotAvailableValue(), ), ) diff --git a/volatility3/framework/plugins/windows/driverscan.py b/volatility3/framework/plugins/windows/driverscan.py index d388ffbb7..f179ff548 100644 --- a/volatility3/framework/plugins/windows/driverscan.py +++ b/volatility3/framework/plugins/windows/driverscan.py @@ -2,19 +2,19 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from typing import Iterable +from typing import Iterable, Optional, Tuple from volatility3.framework import renderers, interfaces, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints -from volatility3.plugins.windows import poolscanner +from volatility3.plugins.windows import poolscanner, modules class DriverScan(interfaces.plugins.PluginInterface): """Scans for drivers present in a particular windows memory image.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + _version = (2, 0, 0) @classmethod def get_requirements(cls): @@ -33,8 +33,7 @@ class DriverScan(interfaces.plugins.PluginInterface): def scan_drivers( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, ) -> Iterable[interfaces.objects.ObjectInterface]: """Scans for drivers using the poolscanner module and constraints. @@ -47,18 +46,51 @@ class DriverScan(interfaces.plugins.PluginInterface): A list of Driver objects as found from the `layer_name` layer based on Driver pool signatures """ + kernel = context.modules[kernel_module_name] + + symbol_table_name = kernel.symbol_table_name + layer_name = kernel.layer_name + constraints = poolscanner.PoolScanner.builtin_constraints( - symbol_table, [b"Dri\xf6", b"Driv"] + symbol_table_name, [b"Dri\xf6", b"Driv"] + ) + + module = context.module(symbol_table_name, layer_name, 0) + driver_start_offset = module.get_type("_DRIVER_OBJECT").relative_child_offset( + "DriverStart" + ) + + kernel_space_start = modules.Modules.get_kernel_space_start( + context, kernel_module_name ) for result in poolscanner.PoolScanner.generate_pool_scan( - context, layer_name, symbol_table, constraints + context, layer_name, symbol_table_name, constraints ): _constraint, mem_object, _header = result - yield mem_object + + scanned_layer = context.layers[mem_object.vol.layer_name] + + # *Many* _DRIVER_OBJECT instances were found at the end of a page + # leading to member access causing backtraces across several plugins + # when members were accessed as the next page was paged out. + # `DriverStart` is the first member from the beginning of the structure + # of interest to plugins, so if it is not accessible then this instance + # is not useful or usable during analysis + # 8 covers this value 32 and 64 bit systems + if scanned_layer.is_valid(mem_object.vol.offset + driver_start_offset, 8): + # Many/most rootkits zero out their DriverStart member for anti-forensics + # so we accept a driver start that is either 0 or is points into kernel memory (the current layer) + if ( + mem_object.DriverStart == 0 + or mem_object.DriverStart > kernel_space_start + ): + yield mem_object @classmethod - def get_names_for_driver(cls, driver): + def get_names_for_driver( + cls, driver + ) -> Tuple[Optional[str], Optional[str], Optional[str]]: """ Convenience method for getting the commonly used names associated with a driver @@ -72,37 +104,40 @@ class DriverScan(interfaces.plugins.PluginInterface): try: driver_name = driver.get_driver_name() except (ValueError, exceptions.InvalidAddressException): - driver_name = renderers.NotApplicableValue() + driver_name = None try: service_key = driver.DriverExtension.ServiceKeyName.String except exceptions.InvalidAddressException: - service_key = renderers.NotApplicableValue() + service_key = None try: name = driver.DriverName.String except exceptions.InvalidAddressException: - name = renderers.NotApplicableValue() + name = None return driver_name, service_key, name def _generator(self): - kernel = self.context.modules[self.config["kernel"]] - for driver in self.scan_drivers( - self.context, kernel.layer_name, kernel.symbol_table_name + self.context, + self.config["kernel"], ): driver_name, service_key, name = self.get_names_for_driver(driver) + # Prior to #1481, this plugin reported dozens to hundreds of junk drivers per sample + if not driver_name and not service_key and not name: + continue + yield ( 0, ( format_hints.Hex(driver.vol.offset), format_hints.Hex(driver.DriverStart), format_hints.Hex(driver.DriverSize), - service_key, - driver_name, - name, + service_key or renderers.NotAvailableValue(), + driver_name or renderers.NotAvailableValue(), + name or renderers.NotAvailableValue(), ), ) diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index a21a87bbd..44a67f472 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -138,16 +138,25 @@ class Modules(interfaces.plugins.PluginInterface): """ module = context.modules[module_name] + # default is used if/when MmSystemRangeStart is paged out if symbols.symbol_table_is_64bit(context, module.symbol_table_name): object_type = "unsigned long long" + default_start = 0xFFFF800000000000 else: object_type = "unsigned long" + default_start = 0x80000000 range_start_offset = module.get_symbol("MmSystemRangeStart").address - kernel_space_start = module.object( - object_type=object_type, offset=range_start_offset - ) + try: + kernel_space_start = module.object( + object_type=object_type, offset=range_start_offset + ) + except exceptions.InvalidAddressException: + vollog.debug( + f"Unable to read MmSystemRangeStart. Defaulting to {default_start:#x} for the kernel space start." + ) + kernel_space_start = default_start layer = context.layers[module.layer_name]