From f688af529bc6b42f588abe67f2dfe023ef8ef5e8 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 18 Nov 2016 11:39:55 +0000 Subject: [PATCH] Initial commit of pdb kernel scanning automagic code. --- volatility/framework/automagic/__init__.py | 2 +- volatility/framework/automagic/pdbscan.py | 31 +++++++++++++++++++++- 2 files changed, 31 insertions(+), 2 deletions(-) diff --git a/volatility/framework/automagic/__init__.py b/volatility/framework/automagic/__init__.py index 3591a5f99..7a05f5420 100644 --- a/volatility/framework/automagic/__init__.py +++ b/volatility/framework/automagic/__init__.py @@ -1,7 +1,7 @@ import sys from volatility.framework import class_subclasses, import_files, interfaces -from volatility.framework.automagic import construct_layers, stacker, windows +from volatility.framework.automagic import construct_layers, stacker, windows, pdbscan from volatility.framework.configuration import requirements diff --git a/volatility/framework/automagic/pdbscan.py b/volatility/framework/automagic/pdbscan.py index e8cec09da..85fa96063 100644 --- a/volatility/framework/automagic/pdbscan.py +++ b/volatility/framework/automagic/pdbscan.py @@ -61,7 +61,8 @@ def scan(ctx, layer_name): b"ntoskrnl.pdb", ] - for (GUID, age, pdb_name, signature_offset) in ctx.memory[layer_name].scan(ctx, PdbSigantureScanner(pdb_names)): + for (GUID, age, pdb_name, signature_offset) in ctx.memory[layer_name].scan(ctx, PdbSigantureScanner(pdb_names), + progress_callback = progress_callback): mz_offset = None sig_pfn = signature_offset // PAGE_SIZE @@ -78,3 +79,31 @@ def scan(ctx, layer_name): results.append((GUID, age, pdb_name, signature_offset, mz_offset)) return results + + +def progress_callback(progress): + print("Progress: ", progress) + + +class KernelPDBScanner(interfaces.automagic.AutomagicInterface): + """Looks for all Intel address spaces and attempts to identify the PDB guid required for the space""" + priority = 30 + thing = None + + def __call__(self, context, config_path, requirement): + if not self.thing: + self.thing = True + print(context.config) + sub_config_path = interfaces.configuration.path_join(config_path, requirement.name) + print("SUBCONFIGPATH", sub_config_path) + if isinstance(requirement, interfaces.configuration.TranslationLayerRequirement): + # Check for symbols in this layer + layer_name = context.config.get( + interfaces.configuration.path_join(config_path, requirement.name), None) + print("FOUND ONE", layer_name) + if layer_name: + results = scan(context, layer_name) + print("RESULTS", results) + else: + for subreq in requirement.requirements.values(): + self(context, sub_config_path, subreq)