diff --git a/volatility/framework/plugins/windows/netlist.py b/volatility/framework/plugins/windows/netlist.py index 7a071676c..c1a8de592 100644 --- a/volatility/framework/plugins/windows/netlist.py +++ b/volatility/framework/plugins/windows/netlist.py @@ -96,23 +96,10 @@ class NetList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ret = [] for idx in range(bitmap_size_in_byte-1): current_byte = context.layers[layer_name].read(bitmap_offset + idx, 1)[0] - current_offs = idx*8 - if current_byte&1 != 0: - ret.append(0 + current_offs) - if current_byte&2 != 0: - ret.append(1 + current_offs) - if current_byte&4 != 0: - ret.append(2 + current_offs) - if current_byte&8 != 0: - ret.append(3 + current_offs) - if current_byte&16 != 0: - ret.append(4 + current_offs) - if current_byte&32 != 0: - ret.append(5 + current_offs) - if current_byte&64 != 0: - ret.append(6 + current_offs) - if current_byte&128 != 0: - ret.append(7 + current_offs) + current_offs = idx * 8 + for bit in range(7): + if current_byte & (1 << bit) != 0: + ret.append(bit + current_offs) return ret @classmethod @@ -147,6 +134,7 @@ class NetList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # invalid argument. yield + vollog.debug("Current Port: {}".format(port)) # the given port serves as a shifted index into the port pool lists list_index = port >> 8 truncated_port = port & 0xff @@ -167,7 +155,6 @@ class NetList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): if netw_inside: # if the value is valid, calculate the actual object address by subtracting the offset curr_obj = context.object(obj_name, layer_name = layer_name, offset = netw_inside - ptr_offset) - vollog.debug("Found {} object @ 0x{:2x}, yielding...".format(proto, curr_obj.vol.offset)) yield curr_obj # if the same port is used on different interfaces multiple objects are created @@ -203,7 +190,7 @@ class NetList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ht_offset: int, ht_length: int, alignment: int, - pointer_length: int) -> list: + net_symbol_table: str) -> list: """Parses a hashtable quick and dirty. Args: @@ -211,19 +198,20 @@ class NetList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): layer_name: The name of the layer on which to operate ht_offset: Beginning of the hash table ht_length: Length of the hash table - pointer_length: Length of this architecture's pointers Returns: The hash table entries which are _not_ empty """ + # we are looking for entries whose values are not their own address for index in range(ht_length): - # mask pointer so we do not get confused with abbreviated virtual offsets - # this currently only works for 64-bit. - # TODO: add x86 support. - current_qword = (0xffff000000000000 | cls.read_pointer(context, layer_name, ht_offset + index * alignment, pointer_length)) - if current_qword == (0xffff000000000000 | (ht_offset + index * alignment)): + current_addr = ht_offset + index * alignment + current_pointer = context.object(net_symbol_table + constants.BANG + "pointer", + layer_name = layer_name, + offset = current_addr) + # check if addr of pointer is equal to the value pointed to + if current_pointer.vol.offset == current_pointer: continue - yield current_qword + yield current_pointer @classmethod def parse_partitions(cls, @@ -231,8 +219,7 @@ class NetList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): layer_name: str, net_symbol_table: str, tcpip_symbol_table: str, - tcpip_module_offset: int, - pointer_length: int) -> Iterable[interfaces.objects.ObjectInterface]: + tcpip_module_offset: int) -> Iterable[interfaces.objects.ObjectInterface]: """Parses tcpip.sys's PartitionTable containing established TCP connections. The amount of Partition depends on the value of the symbol `PartitionCount` and correlates with the maximum processor count (refer to Art of Memory Forensics, chapter 11). @@ -254,7 +241,6 @@ class NetList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): alignment = 8 obj_name = net_symbol_table + constants.BANG + "_TCP_ENDPOINT" - # part_table_symbol is the offset within tcpip.sys which contains the address of the partition table itself part_table_symbol = context.symbol_space.get_symbol(tcpip_symbol_table + constants.BANG + "PartitionTable").address part_count_symbol = context.symbol_space.get_symbol(tcpip_symbol_table + constants.BANG + "PartitionCount").address @@ -262,23 +248,25 @@ class NetList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): part_table_addr = context.object(net_symbol_table + constants.BANG + "pointer", layer_name = layer_name, offset = tcpip_module_offset + part_table_symbol) + # part_table is the actual partition table offset and consists out of a dynamic amount of _PARTITION objects part_table = context.object(net_symbol_table + constants.BANG + "_PARTITION_TABLE", layer_name = layer_name, offset = part_table_addr) part_count = int.from_bytes(context.layers[layer_name].read(tcpip_module_offset + part_count_symbol, 1), "little") part_table.Partitions.count = part_count - partition_size = context.symbol_space.get_type(net_symbol_table + constants.BANG + "_PARTITION").size + vollog.debug("Found TCP connection PartitionTable @ 0x{:x} (partition count: {})".format(part_table_addr, part_count)) entry_offset = context.symbol_space.get_type(obj_name).relative_child_offset("ListEntry") - for partition in part_table.Partitions: + for ctr, partition in enumerate(part_table.Partitions): + vollog.debug("Parsing partition {}".format(ctr)) if partition.Endpoints.NumEntries > 0: for endpoint_entry in cls.parse_hashtable(context, layer_name, partition.Endpoints.Directory, - partition_size, + partition.Endpoints.TableSize, alignment, - pointer_length): + net_symbol_table): endpoint = context.object(obj_name, layer_name = layer_name, offset = endpoint_entry - entry_offset) yield endpoint @@ -333,8 +321,7 @@ class NetList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): layer_name: str, net_symbol_table: str, tcpip_symbol_table: str, - tcpip_module_offset: int, - pointer_length: int) -> (int, int): + tcpip_module_offset: int) -> (int, int): """Finds the given image's port pools. Older Windows versions (presumably < Win10 build 14251) use driver symbols called `UdpPortPool` and `TcpPortPool` which point towards the pools. Newer Windows versions use `UdpCompartmentSet` and `TcpCompartmentSet`, which we first have to translate into @@ -346,7 +333,6 @@ class NetList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): net_symbol_table: The name of the table containing the tcpip types tcpip_module_offset: This memory dump's tcpip.sys image offset tcpip_symbol_table: The name of the table containing the tcpip driver symbols - pointer_length: Length of this architecture's pointers Returns: The tuple containing the address of the UDP and TCP port pool respectively. @@ -387,7 +373,7 @@ class NetList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): raise exceptions.SymbolError("UdpPortPool", tcpip_symbol_table, "Neither UdpPortPool nor UdpCompartmentSet found in {} table".format(tcpip_symbol_table)) - vollog.debug("Found PortPools @ 0x{:x} (TCP) && 0x{:x} (UDP)".format(upp_addr, tpp_addr)) + vollog.debug("Found PortPools @ 0x{:x} (UDP) && 0x{:x} (TCP)".format(upp_addr, tpp_addr)) return upp_addr, tpp_addr @classmethod @@ -416,15 +402,13 @@ class NetList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): tcpip_module_offset = tcpip_module.DllBase - pointer_length = context.symbol_space.get_type(net_symbol_table + constants.BANG + "pointer").size - # first, TCP endpoints by parsing the partition table - for endpoint in cls.parse_partitions(context, layer_name, net_symbol_table, tcpip_symbol_table, tcpip_module_offset, pointer_length): + for endpoint in cls.parse_partitions(context, layer_name, net_symbol_table, tcpip_symbol_table, tcpip_module_offset): yield endpoint # then, towards the UDP and TCP port pools # first, find their addresses - upp_addr, tpp_addr = cls.find_port_pools(context, layer_name, net_symbol_table, tcpip_symbol_table, tcpip_module_offset, pointer_length) + upp_addr, tpp_addr = cls.find_port_pools(context, layer_name, net_symbol_table, tcpip_symbol_table, tcpip_module_offset) # create port pool objects at the detected address and parse the port bitmap upp_obj = context.object(net_symbol_table + constants.BANG + "_INET_PORT_POOL", layer_name = layer_name, offset = upp_addr) @@ -433,6 +417,8 @@ class NetList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): tpp_obj = context.object(net_symbol_table + constants.BANG + "_INET_PORT_POOL", layer_name = layer_name, offset = tpp_addr) tcpl_ports = cls.parse_bitmap(context, layer_name, tpp_obj.PortBitMap.Buffer, tpp_obj.PortBitMap.SizeOfBitMap // 8) + vollog.debug("Found TCP Ports: {}".format(tcpl_ports)) + vollog.debug("Found UDP Ports: {}".format(udpa_ports)) # given the list of TCP / UDP ports, calculate the address of their respective objects and yield them. for port in tcpl_ports: # port value can be 0, which we can skip @@ -451,10 +437,6 @@ class NetList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): def _generator(self, show_corrupt_results: Optional[bool] = None): """ Generates the network objects for use in rendering. """ - # can this be checked via a PluginRequirement? - if not symbols.symbol_table_is_64bit(self.context, self.config['nt_symbols']): - raise exceptions.LayerException("This plugin currently only supports 64-bit memory images.") - netscan_symbol_table = netscan.NetScan.create_netscan_symbol_table(self.context, self.config["primary"], self.config["nt_symbols"], self.config_path) @@ -469,7 +451,6 @@ class NetList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): tcpip_module, tcpip_symbol_table): - vollog.debug("Found netw obj @ 0x{:2x} of assumed type {}".format(netw_obj.vol.offset, type(netw_obj))) # objects passed pool header constraints. check for additional constraints if strict flag is set. if not show_corrupt_results and not netw_obj.is_valid(): continue diff --git a/volatility/framework/symbols/windows/extensions/network.py b/volatility/framework/symbols/windows/extensions/network.py index 6c6f722b0..e13af6707 100644 --- a/volatility/framework/symbols/windows/extensions/network.py +++ b/volatility/framework/symbols/windows/extensions/network.py @@ -199,21 +199,21 @@ class _TCP_ENDPOINT(_TCP_LISTENER): def is_valid(self): if self.State not in self.State.choices.values(): - vollog.debug("invalid due to invalid tcp state {}".format(self.State)) + vollog.debug("{} 0x{:x} invalid due to invalid tcp state {}".format(type(self), self.vol.offset, self.State)) return False try: if self.get_address_family() not in (AF_INET, AF_INET6): - vollog.debug("invalid due to invalid address_family {}".format(self.get_address_family())) + vollog.debug("{} 0x{:x} invalid due to invalid address_family {}".format(type(self), self.vol.offset, self.get_address_family())) return False if not self.get_local_address() and (not self.get_owner() or self.get_owner().UniqueProcessId == 0 or self.get_owner().UniqueProcessId > 65535): - vollog.debug("invalid due to invalid owner data") + vollog.debug("{} 0x{:x} invalid due to invalid owner data".format(type(self), self.vol.offset)) return False except exceptions.InvalidAddressException: - vollog.debug("invalid due to invalid address access") + vollog.debug("{} 0x{:x} invalid due to invalid address access".format(type(self), self.vol.offset)) return False return True diff --git a/volatility/framework/symbols/windows/netscan-win10-15063-x64.json b/volatility/framework/symbols/windows/netscan-win10-15063-x64.json index c212ea6be..e15f6eb50 100644 --- a/volatility/framework/symbols/windows/netscan-win10-15063-x64.json +++ b/volatility/framework/symbols/windows/netscan-win10-15063-x64.json @@ -92,6 +92,16 @@ } }, + "Next": { + "offset": 112, + "type":{ + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_UDP_ENDPOINT" + } + } + }, "Port": { "offset": 120, "type": { @@ -116,6 +126,16 @@ } }, + "Next": { + "offset": 120, + "type":{ + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_TCP_LISTENER" + } + } + }, "CreateTime": { "offset": 64, "type": { @@ -195,6 +215,13 @@ } } }, + "ListEntry": { + "offset": 40, + "type": { + "kind": "union", + "name": "nt_symbols!_LIST_ENTRY" + } + }, "LocalPort": { "offset": 112, "type": { @@ -355,6 +382,173 @@ }, "kind": "union", "size": 8 + }, + "_INET_COMPARTMENT_SET": { + "fields": { + "InetCompartment": { + "offset": 328, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_INET_COMPARTMENT" + } + } + } + }, + "kind": "struct", + "size": 384 + }, + "_INET_COMPARTMENT": { + "fields": { + "ProtocolCompartment": { + "offset": 32, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_PROTOCOL_COMPARTMENT" + } + } + } + }, + "kind": "struct", + "size": 48 + }, + "_PROTOCOL_COMPARTMENT": { + "fields": { + "PortPool": { + "offset": 0, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_INET_PORT_POOL" + } + } + } + }, + "kind": "struct", + "size": 16 + }, + "_PORT_ASSIGNMENT_ENTRY": { + "fields": { + "Entry": { + "offset": 8, + "type": { + "kind": "pointer", + "subtype": { + "kind": "base", + "name": "void" + } + } + } + }, + "kind": "struct", + "size": 24 + }, + "_PORT_ASSIGNMENT_LIST": { + "fields": { + "Assignments": { + "offset": 0, + "type": { + "count": 256, + "kind": "array", + "subtype": { + "kind": "struct", + "name": "_PORT_ASSIGNMENT_ENTRY" + } + } + } + }, + "kind": "struct", + "size": 6144 + }, + "_PORT_ASSIGNMENT": { + "fields": { + "InPaBigPoolBase": { + "offset": 24, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_PORT_ASSIGNMENT_LIST" + } + } + } + }, + "kind": "struct", + "size": 32 + }, + "_INET_PORT_POOL": { + "fields": { + "PortAssignments": { + "offset": 232, + "type": { + "count": 256, + "kind": "array", + "subtype": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_PORT_ASSIGNMENT" + } + } + } + }, + "PortBitMap": { + "offset": 216, + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + } + } + }, + "kind": "struct", + "size": 11200 + }, + "_PARTITION": { + "fields": { + "Endpoints" : { + "offset": 8, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "nt_symbols!_RTL_DYNAMIC_HASH_TABLE" + } + } + }, + "UnknownHashTable" : { + "offset": 16, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "nt_symbols!_RTL_DYNAMIC_HASH_TABLE" + } + } + } + }, + "kind": "struct", + "size": 128 + }, + "_PARTITION_TABLE": { + "fields": { + "Partitions": { + "offset": 0, + "type": { + "count": 1, + "kind": "array", + "subtype": { + "kind": "struct", + "name": "_PARTITION" + } + } + } + }, + "kind": "struct", + "size": 128 } }, "enums": { diff --git a/volatility/framework/symbols/windows/netscan-win10-15063-x86.json b/volatility/framework/symbols/windows/netscan-win10-15063-x86.json index 08ba89dbb..0f934b7d5 100644 --- a/volatility/framework/symbols/windows/netscan-win10-15063-x86.json +++ b/volatility/framework/symbols/windows/netscan-win10-15063-x86.json @@ -238,6 +238,16 @@ "kind": "base", "name": "unsigned be short" } + }, + "Next": { + "offset": 76, + "type":{ + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_UDP_ENDPOINT" + } + } } }, "kind": "struct", @@ -291,6 +301,16 @@ "kind": "base", "name": "unsigned be short" } + }, + "Next": { + "offset": 72, + "type":{ + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_TCP_LISTENER" + } + } } }, "kind": "struct", @@ -502,6 +522,173 @@ }, "kind": "union", "size": 8 + }, + "_INET_COMPARTMENT_SET": { + "fields": { + "InetCompartment": { + "offset": 324, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_INET_COMPARTMENT" + } + } + } + }, + "kind": "struct", + "size": 384 + }, + "_INET_COMPARTMENT": { + "fields": { + "ProtocolCompartment": { + "offset": 20, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_PROTOCOL_COMPARTMENT" + } + } + } + }, + "kind": "struct", + "size": 24 + }, + "_PROTOCOL_COMPARTMENT": { + "fields": { + "PortPool": { + "offset": 0, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_INET_PORT_POOL" + } + } + } + }, + "kind": "struct", + "size": 16 + }, + "_PORT_ASSIGNMENT_ENTRY": { + "fields": { + "Entry": { + "offset": 4, + "type": { + "kind": "pointer", + "subtype": { + "kind": "base", + "name": "void" + } + } + } + }, + "kind": "struct", + "size": 8 + }, + "_PORT_ASSIGNMENT_LIST": { + "fields": { + "Assignments": { + "offset": 0, + "type": { + "count": 256, + "kind": "array", + "subtype": { + "kind": "struct", + "name": "_PORT_ASSIGNMENT_ENTRY" + } + } + } + }, + "kind": "struct", + "size": 4096 + }, + "_PORT_ASSIGNMENT": { + "fields": { + "InPaBigPoolBase": { + "offset": 16, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_PORT_ASSIGNMENT_LIST" + } + } + } + }, + "kind": "struct", + "size": 24 + }, + "_INET_PORT_POOL": { + "fields": { + "PortAssignments": { + "offset": 152, + "type": { + "count": 256, + "kind": "array", + "subtype": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_PORT_ASSIGNMENT" + } + } + } + }, + "PortBitMap": { + "offset": 144, + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + } + } + }, + "kind": "struct", + "size": 11200 + }, + "_PARTITION": { + "fields": { + "Endpoints" : { + "offset": 4, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "nt_symbols!_RTL_DYNAMIC_HASH_TABLE" + } + } + }, + "UnknownHashTable" : { + "offset": 12, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "nt_symbols!_RTL_DYNAMIC_HASH_TABLE" + } + } + } + }, + "kind": "struct", + "size": 64 + }, + "_PARTITION_TABLE": { + "fields": { + "Partitions": { + "offset": 0, + "type": { + "count": 1, + "kind": "array", + "subtype": { + "kind": "struct", + "name": "_PARTITION" + } + } + } + }, + "kind": "struct", + "size": 64 } }, "enums": { diff --git a/volatility/framework/symbols/windows/netscan-win10-19041-x64.json b/volatility/framework/symbols/windows/netscan-win10-19041-x64.json index ec8e7d870..0ff62ee99 100644 --- a/volatility/framework/symbols/windows/netscan-win10-19041-x64.json +++ b/volatility/framework/symbols/windows/netscan-win10-19041-x64.json @@ -71,6 +71,16 @@ "name": "_LARGE_INTEGER" } }, + "Next": { + "offset": 112, + "type":{ + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_UDP_ENDPOINT" + } + } + }, "LocalAddr": { "offset": 168, "type":{ @@ -92,16 +102,6 @@ } }, - "MaskedPrevObj": { - "offset": 112, - "type":{ - "kind": "pointer", - "subtype": { - "kind": "struct", - "name": "_UDP_ENDPOINT" - } - } - }, "Port": { "offset": 160, "type": { @@ -111,7 +111,7 @@ } }, "kind": "struct", - "size": 132 + "size": 168 }, "_TCP_LISTENER": { "fields": { @@ -155,7 +155,7 @@ } }, - "MaskedPrevObj": { + "Next": { "offset": 120, "type":{ "kind": "pointer", @@ -205,6 +205,13 @@ } } }, + "ListEntry": { + "offset": 40, + "type": { + "kind": "union", + "name": "nt_symbols!_LIST_ENTRY" + } + }, "InetAF": { "offset": 16, "type":{ @@ -375,6 +382,173 @@ }, "kind": "union", "size": 8 + }, + "_INET_COMPARTMENT_SET": { + "fields": { + "InetCompartment": { + "offset": 328, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_INET_COMPARTMENT" + } + } + } + }, + "kind": "struct", + "size": 384 + }, + "_INET_COMPARTMENT": { + "fields": { + "ProtocolCompartment": { + "offset": 32, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_PROTOCOL_COMPARTMENT" + } + } + } + }, + "kind": "struct", + "size": 48 + }, + "_PROTOCOL_COMPARTMENT": { + "fields": { + "PortPool": { + "offset": 0, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_INET_PORT_POOL" + } + } + } + }, + "kind": "struct", + "size": 16 + }, + "_PORT_ASSIGNMENT_ENTRY": { + "fields": { + "Entry": { + "offset": 16, + "type": { + "kind": "pointer", + "subtype": { + "kind": "base", + "name": "void" + } + } + } + }, + "kind": "struct", + "size": 32 + }, + "_PORT_ASSIGNMENT_LIST": { + "fields": { + "Assignments": { + "offset": 0, + "type": { + "count": 256, + "kind": "array", + "subtype": { + "kind": "struct", + "name": "_PORT_ASSIGNMENT_ENTRY" + } + } + } + }, + "kind": "struct", + "size": 6144 + }, + "_PORT_ASSIGNMENT": { + "fields": { + "InPaBigPoolBase": { + "offset": 24, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_PORT_ASSIGNMENT_LIST" + } + } + } + }, + "kind": "struct", + "size": 32 + }, + "_INET_PORT_POOL": { + "fields": { + "PortAssignments": { + "offset": 224, + "type": { + "count": 256, + "kind": "array", + "subtype": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_PORT_ASSIGNMENT" + } + } + } + }, + "PortBitMap": { + "offset": 208, + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + } + } + }, + "kind": "struct", + "size": 11200 + }, + "_PARTITION": { + "fields": { + "Endpoints" : { + "offset": 8, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "nt_symbols!_RTL_DYNAMIC_HASH_TABLE" + } + } + }, + "UnknownHashTable" : { + "offset": 16, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "nt_symbols!_RTL_DYNAMIC_HASH_TABLE" + } + } + } + }, + "kind": "struct", + "size": 192 + }, + "_PARTITION_TABLE": { + "fields": { + "Partitions": { + "offset": 0, + "type": { + "count": 1, + "kind": "array", + "subtype": { + "kind": "struct", + "name": "_PARTITION" + } + } + } + }, + "kind": "struct", + "size": 128 } }, "enums": { diff --git a/volatility/framework/symbols/windows/netscan-win10-x86.json b/volatility/framework/symbols/windows/netscan-win10-x86.json index bbd77d4aa..b27380f4c 100644 --- a/volatility/framework/symbols/windows/netscan-win10-x86.json +++ b/volatility/framework/symbols/windows/netscan-win10-x86.json @@ -211,6 +211,16 @@ "name": "_LARGE_INTEGER" } }, + "Next": { + "offset": 76, + "type":{ + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_UDP_ENDPOINT" + } + } + }, "LocalAddr": { "offset": 56, "type":{ @@ -291,10 +301,20 @@ "kind": "base", "name": "unsigned be short" } + }, + "Next": { + "offset": 72, + "type":{ + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_TCP_LISTENER" + } + } } }, "kind": "struct", - "size": 72 + "size": 78 }, "_TCP_ENDPOINT": { "fields": { @@ -502,6 +522,173 @@ }, "kind": "union", "size": 8 + }, + "_INET_COMPARTMENT_SET": { + "fields": { + "InetCompartment": { + "offset": 328, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_INET_COMPARTMENT" + } + } + } + }, + "kind": "struct", + "size": 384 + }, + "_INET_COMPARTMENT": { + "fields": { + "ProtocolCompartment": { + "offset": 32, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_PROTOCOL_COMPARTMENT" + } + } + } + }, + "kind": "struct", + "size": 48 + }, + "_PROTOCOL_COMPARTMENT": { + "fields": { + "PortPool": { + "offset": 0, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_INET_PORT_POOL" + } + } + } + }, + "kind": "struct", + "size": 16 + }, + "_PORT_ASSIGNMENT_ENTRY": { + "fields": { + "Entry": { + "offset": 4, + "type": { + "kind": "pointer", + "subtype": { + "kind": "base", + "name": "void" + } + } + } + }, + "kind": "struct", + "size": 8 + }, + "_PORT_ASSIGNMENT_LIST": { + "fields": { + "Assignments": { + "offset": 0, + "type": { + "count": 256, + "kind": "array", + "subtype": { + "kind": "struct", + "name": "_PORT_ASSIGNMENT_ENTRY" + } + } + } + }, + "kind": "struct", + "size": 4096 + }, + "_PORT_ASSIGNMENT": { + "fields": { + "InPaBigPoolBase": { + "offset": 16, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_PORT_ASSIGNMENT_LIST" + } + } + } + }, + "kind": "struct", + "size": 24 + }, + "_INET_PORT_POOL": { + "fields": { + "PortAssignments": { + "offset": 152, + "type": { + "count": 256, + "kind": "array", + "subtype": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_PORT_ASSIGNMENT" + } + } + } + }, + "PortBitMap": { + "offset": 144, + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + } + } + }, + "kind": "struct", + "size": 11200 + }, + "_PARTITION": { + "fields": { + "Endpoints" : { + "offset": 4, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "nt_symbols!_RTL_DYNAMIC_HASH_TABLE" + } + } + }, + "UnknownHashTable" : { + "offset": 12, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "nt_symbols!_RTL_DYNAMIC_HASH_TABLE" + } + } + } + }, + "kind": "struct", + "size": 64 + }, + "_PARTITION_TABLE": { + "fields": { + "Partitions": { + "offset": 0, + "type": { + "count": 1, + "kind": "array", + "subtype": { + "kind": "struct", + "name": "_PARTITION" + } + } + } + }, + "kind": "struct", + "size": 64 } }, "enums": { diff --git a/volatility/framework/symbols/windows/netscan-win7-x86.json b/volatility/framework/symbols/windows/netscan-win7-x86.json index 891e7072c..03cbe7bf2 100644 --- a/volatility/framework/symbols/windows/netscan-win7-x86.json +++ b/volatility/framework/symbols/windows/netscan-win7-x86.json @@ -231,6 +231,16 @@ } }, + "Next": { + "offset": 76, + "type":{ + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_UDP_ENDPOINT" + } + } + }, "Port": { "offset": 72, "type": { @@ -290,10 +300,20 @@ "kind": "base", "name": "unsigned be short" } + }, + "Next": { + "offset": 64, + "type":{ + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_TCP_LISTENER" + } + } } }, "kind": "struct", - "size": 64 + "size": 72 }, "_TCP_ENDPOINT": { "fields": { @@ -503,6 +523,173 @@ }, "kind": "union", "size": 8 + }, + "_INET_COMPARTMENT_SET": { + "fields": { + "InetCompartment": { + "offset": 328, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_INET_COMPARTMENT" + } + } + } + }, + "kind": "struct", + "size": 384 + }, + "_INET_COMPARTMENT": { + "fields": { + "ProtocolCompartment": { + "offset": 32, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_PROTOCOL_COMPARTMENT" + } + } + } + }, + "kind": "struct", + "size": 48 + }, + "_PROTOCOL_COMPARTMENT": { + "fields": { + "PortPool": { + "offset": 0, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_INET_PORT_POOL" + } + } + } + }, + "kind": "struct", + "size": 16 + }, + "_PORT_ASSIGNMENT_ENTRY": { + "fields": { + "Entry": { + "offset": 4, + "type": { + "kind": "pointer", + "subtype": { + "kind": "base", + "name": "void" + } + } + } + }, + "kind": "struct", + "size": 8 + }, + "_PORT_ASSIGNMENT_LIST": { + "fields": { + "Assignments": { + "offset": 0, + "type": { + "count": 256, + "kind": "array", + "subtype": { + "kind": "struct", + "name": "_PORT_ASSIGNMENT_ENTRY" + } + } + } + }, + "kind": "struct", + "size": 4096 + }, + "_PORT_ASSIGNMENT": { + "fields": { + "InPaBigPoolBase": { + "offset": 20, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_PORT_ASSIGNMENT_LIST" + } + } + } + }, + "kind": "struct", + "size": 24 + }, + "_INET_PORT_POOL": { + "fields": { + "PortAssignments": { + "offset": 88, + "type": { + "count": 256, + "kind": "array", + "subtype": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_PORT_ASSIGNMENT" + } + } + } + }, + "PortBitMap": { + "offset": 80, + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + } + } + }, + "kind": "struct", + "size": 11200 + }, + "_PARTITION": { + "fields": { + "Endpoints" : { + "offset": 4, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "nt_symbols!_RTL_DYNAMIC_HASH_TABLE" + } + } + }, + "UnknownHashTable" : { + "offset": 12, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "nt_symbols!_RTL_DYNAMIC_HASH_TABLE" + } + } + } + }, + "kind": "struct", + "size": 64 + }, + "_PARTITION_TABLE": { + "fields": { + "Partitions": { + "offset": 0, + "type": { + "count": 1, + "kind": "array", + "subtype": { + "kind": "struct", + "name": "_PARTITION" + } + } + } + }, + "kind": "struct", + "size": 64 } }, "enums": {