From f898dca2968282e57e87a7fa7fde853570071571 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 6 Feb 2019 21:26:32 +0000 Subject: [PATCH] Refactor SymbolRequirement to SymbolTableRequirement for clarity. --- volatility/cli/__init__.py | 2 +- volatility/cli/volshell/windows.py | 2 +- volatility/framework/automagic/pdbscan.py | 2 +- volatility/framework/automagic/symbol_finder.py | 8 ++++---- volatility/framework/configuration/requirements.py | 6 +++--- volatility/framework/interfaces/configuration.py | 4 ++-- volatility/framework/layers/registry.py | 2 +- volatility/framework/plugins/linux/bash.py | 2 +- volatility/framework/plugins/linux/check_afinfo.py | 9 +++------ volatility/framework/plugins/linux/check_syscall.py | 9 +++------ volatility/framework/plugins/linux/elfs.py | 2 +- volatility/framework/plugins/linux/lsmod.py | 10 +++------- volatility/framework/plugins/linux/lsof.py | 2 +- volatility/framework/plugins/linux/malfind.py | 2 +- volatility/framework/plugins/linux/proc.py | 2 +- volatility/framework/plugins/linux/pslist.py | 10 +++------- volatility/framework/plugins/mac/bash.py | 2 +- volatility/framework/plugins/mac/check_syscall.py | 11 +++++------ volatility/framework/plugins/mac/lsmod.py | 8 ++------ volatility/framework/plugins/mac/malfind.py | 2 +- volatility/framework/plugins/mac/psaux.py | 2 +- volatility/framework/plugins/mac/pslist.py | 10 +++------- volatility/framework/plugins/mac/pstree.py | 2 +- volatility/framework/plugins/mac/trustedbsd.py | 9 +++------ volatility/framework/plugins/windows/cmdline.py | 2 +- volatility/framework/plugins/windows/dlldump.py | 2 +- volatility/framework/plugins/windows/dlllist.py | 2 +- volatility/framework/plugins/windows/handles.py | 2 +- volatility/framework/plugins/windows/info.py | 2 +- volatility/framework/plugins/windows/malfind.py | 2 +- volatility/framework/plugins/windows/moddump.py | 2 +- volatility/framework/plugins/windows/modules.py | 2 +- volatility/framework/plugins/windows/poolscanner.py | 2 +- volatility/framework/plugins/windows/procdump.py | 2 +- volatility/framework/plugins/windows/pslist.py | 2 +- .../framework/plugins/windows/registry/hivelist.py | 2 +- .../framework/plugins/windows/registry/printkey.py | 2 +- .../framework/plugins/windows/registry/userassist.py | 2 +- volatility/framework/plugins/windows/ssdt.py | 2 +- volatility/framework/plugins/windows/strings.py | 2 +- volatility/framework/plugins/windows/vaddump.py | 2 +- volatility/framework/plugins/windows/vadinfo.py | 2 +- volatility/framework/plugins/windows/vadyarascan.py | 2 +- volatility/framework/plugins/windows/verinfo.py | 2 +- 44 files changed, 67 insertions(+), 93 deletions(-) diff --git a/volatility/cli/__init__.py b/volatility/cli/__init__.py index 6583105f2..2473db741 100644 --- a/volatility/cli/__init__.py +++ b/volatility/cli/__init__.py @@ -268,7 +268,7 @@ class CommandLine(interfaces.plugins.FileConsumerInterface): translation_failed = translation_failed or isinstance( excp.unsatisfied[config_path], configuration.requirements.TranslationLayerRequirement) symbols_failed = symbols_failed or isinstance(excp.unsatisfied[config_path], - configuration.requirements.SymbolRequirement) + configuration.requirements.SymbolTableRequirement) print("Unsatisfied requirement {}: {}".format(config_path, excp.unsatisfied[config_path].description)) diff --git a/volatility/cli/volshell/windows.py b/volatility/cli/volshell/windows.py index 9a483552a..827f7341e 100644 --- a/volatility/cli/volshell/windows.py +++ b/volatility/cli/volshell/windows.py @@ -31,7 +31,7 @@ class Volshell(shellplugin.Volshell): @classmethod def get_requirements(cls): return (super().get_requirements() + [ - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.IntRequirement(name = 'pid', description = "Process ID", optional = True) ]) diff --git a/volatility/framework/automagic/pdbscan.py b/volatility/framework/automagic/pdbscan.py index e70e745d0..614376b61 100644 --- a/volatility/framework/automagic/pdbscan.py +++ b/volatility/framework/automagic/pdbscan.py @@ -414,7 +414,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): context.symbol_space.append(native.NativeTable("pdbscan", native.std_ctypes)) # TODO: check if this is a windows symbol requirement, otherwise ignore it self._symbol_requirements = self.find_requirements(context, config_path, requirement, - requirements.SymbolRequirement) + requirements.SymbolTableRequirement) potential_layers = self.find_virtual_layers_from_req( context = context, config_path = config_path, requirement = requirement) for sub_config_path, symbol_req in self._symbol_requirements: diff --git a/volatility/framework/automagic/symbol_finder.py b/volatility/framework/automagic/symbol_finder.py index 680ba9cb4..6fc86e721 100644 --- a/volatility/framework/automagic/symbol_finder.py +++ b/volatility/framework/automagic/symbol_finder.py @@ -65,17 +65,17 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface): self._requirements = self.find_requirements( context, config_path, - requirement, (requirements.TranslationLayerRequirement, requirements.SymbolRequirement), + requirement, (requirements.TranslationLayerRequirement, requirements.SymbolTableRequirement), shortcut = False) for (sub_path, requirement) in self._requirements: parent_path = interfaces.configuration.parent_path(sub_path) - if (isinstance(requirement, requirements.SymbolRequirement) + if (isinstance(requirement, requirements.SymbolTableRequirement) and requirement.unsatisfied(context, parent_path)): for (tl_sub_path, tl_requirement) in self._requirements: tl_parent_path = interfaces.configuration.parent_path(tl_sub_path) - # Find the TranslationLayer sibling to the SymbolRequirement + # Find the TranslationLayer sibling to the SymbolTableRequirement if (isinstance(tl_requirement, requirements.TranslationLayerRequirement) and tl_parent_path == parent_path): if context.config.get(tl_sub_path, None): @@ -89,7 +89,7 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface): requirement: interfaces.configuration.ConstructableRequirementInterface, layer_name: str, progress_callback: constants.ProgressCallback = None) -> None: - """Accepts a context, config_path and SymbolRequirement, with a constructed layer_name + """Accepts a context, config_path and SymbolTableRequirement, with a constructed layer_name and scans the layer for banners""" # Bomb out early if there's no banners diff --git a/volatility/framework/configuration/requirements.py b/volatility/framework/configuration/requirements.py index 8062b8577..6229e9b3b 100644 --- a/volatility/framework/configuration/requirements.py +++ b/volatility/framework/configuration/requirements.py @@ -315,8 +315,8 @@ class TranslationLayerRequirement(configuration.ConstructableRequirementInterfac return context.memory[value].build_configuration() -class SymbolRequirement(configuration.ConstructableRequirementInterface, - configuration.ConfigurableRequirementInterface): +class SymbolTableRequirement(configuration.ConstructableRequirementInterface, + configuration.ConfigurableRequirementInterface): """Class maintaining the limitations on what sort of symbol spaces are acceptable""" def unsatisfied(self, context: interfaces.context.ContextInterface, @@ -326,7 +326,7 @@ class SymbolRequirement(configuration.ConstructableRequirementInterface, value = self.config_value(context, config_path, None) if not isinstance(value, str): vollog.log(constants.LOGLEVEL_V, - "TypeError - SymbolRequirement only accepts string labels: {}".format(value)) + "TypeError - SymbolTableRequirement only accepts string labels: {}".format(value)) return {config_path: self} if value not in context.symbol_space: # This is an expected situation, so return False rather than raise diff --git a/volatility/framework/interfaces/configuration.py b/volatility/framework/interfaces/configuration.py index 54c2f5b0a..5745b5c2a 100644 --- a/volatility/framework/interfaces/configuration.py +++ b/volatility/framework/interfaces/configuration.py @@ -275,7 +275,7 @@ class RequirementInterface(metaclass = ABCMeta): :class:`~volatility.framework.configuration.requirements.IntRequirement`, :class:`~volatility.framework.configuration.requirements.BytesRequirement` and :class:`~volatility.framework.configuration.requirements.StringRequirement`) or complex types (such - as :class:`TranslationLayerRequirement`, :class:`SymbolRequirement` and :class:`ClassRequirement` + as :class:`TranslationLayerRequirement`, :class:`SymbolTableRequirement` and :class:`ClassRequirement` """ def __init__(self, @@ -385,7 +385,7 @@ class SimpleTypeRequirement(RequirementInterface): class ClassRequirement(RequirementInterface): """Requires a specific class. This is used as means to serialize specific classes for :class:`TranslationLayerRequirement` - and :class:`SymbolRequirement` classes.""" + and :class:`SymbolTableRequirement` classes.""" def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility/framework/layers/registry.py b/volatility/framework/layers/registry.py index 766bf350a..8373286bb 100644 --- a/volatility/framework/layers/registry.py +++ b/volatility/framework/layers/registry.py @@ -180,7 +180,7 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface): description = 'Offset within the base layer at which the hive lives', default = 0, optional = False), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), TranslationLayerRequirement( name = 'base_layer', description = 'Layer in which the registry hive lives', optional = False) ] diff --git a/volatility/framework/plugins/linux/bash.py b/volatility/framework/plugins/linux/bash.py index 09bd59935..183b66f7f 100644 --- a/volatility/framework/plugins/linux/bash.py +++ b/volatility/framework/plugins/linux/bash.py @@ -43,7 +43,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols") + requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols") ] def _generator(self, tasks): diff --git a/volatility/framework/plugins/linux/check_afinfo.py b/volatility/framework/plugins/linux/check_afinfo.py index 0f795aadf..014b4c2fb 100644 --- a/volatility/framework/plugins/linux/check_afinfo.py +++ b/volatility/framework/plugins/linux/check_afinfo.py @@ -41,7 +41,7 @@ class Check_afinfo(plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols") + requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols") ] # returns whether the symbol is found within the kernel (system.map) or not @@ -80,11 +80,8 @@ class Check_afinfo(plugins.PluginInterface): def _generator(self): linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary']) - vmlinux = contexts.Module(self.context, - self.config['vmlinux'], - self.config['primary'], - 0, - absolute_symbol_addresses = True) + vmlinux = contexts.Module( + self.context, self.config['vmlinux'], self.config['primary'], 0, absolute_symbol_addresses = True) op_members = vmlinux.get_type('file_operations').members seq_members = vmlinux.get_type('seq_operations').members diff --git a/volatility/framework/plugins/linux/check_syscall.py b/volatility/framework/plugins/linux/check_syscall.py index fbc87d171..0979690ce 100644 --- a/volatility/framework/plugins/linux/check_syscall.py +++ b/volatility/framework/plugins/linux/check_syscall.py @@ -48,7 +48,7 @@ class Check_syscall(plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols") + requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols") ] def _get_table_size_next_symbol(self, table_addr, ptr_sz, vmlinux): @@ -145,11 +145,8 @@ class Check_syscall(plugins.PluginInterface): def _generator(self): linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary']) - vmlinux = contexts.Module(self.context, - self.config['vmlinux'], - self.config['primary'], - 0, - absolute_symbol_addresses = True) + vmlinux = contexts.Module( + self.context, self.config['vmlinux'], self.config['primary'], 0, absolute_symbol_addresses = True) ptr_sz = vmlinux.get_type("pointer").size if ptr_sz == 4: diff --git a/volatility/framework/plugins/linux/elfs.py b/volatility/framework/plugins/linux/elfs.py index dd12cf642..a6f5fc0dc 100644 --- a/volatility/framework/plugins/linux/elfs.py +++ b/volatility/framework/plugins/linux/elfs.py @@ -39,7 +39,7 @@ class Elfs(plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols") + requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols") ] def _generator(self, tasks): diff --git a/volatility/framework/plugins/linux/lsmod.py b/volatility/framework/plugins/linux/lsmod.py index 3cb8d0fb5..9b0df9055 100644 --- a/volatility/framework/plugins/linux/lsmod.py +++ b/volatility/framework/plugins/linux/lsmod.py @@ -40,7 +40,7 @@ class Lsmod(plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols") + requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols") ] @classmethod @@ -48,12 +48,8 @@ class Lsmod(plugins.PluginInterface): """Lists all the modules in the primary layer""" linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name) - vmlinux = contexts.Module(context, - vmlinux_symbols, - layer_name, - 0, - absolute_symbol_addresses = True) - + vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0, absolute_symbol_addresses = True) + modules = vmlinux.object(symbol_name = "modules").cast("list_head") table_name = modules.vol.type_name.split(constants.BANG)[0] diff --git a/volatility/framework/plugins/linux/lsof.py b/volatility/framework/plugins/linux/lsof.py index 3d040ede2..bd1487bac 100644 --- a/volatility/framework/plugins/linux/lsof.py +++ b/volatility/framework/plugins/linux/lsof.py @@ -41,7 +41,7 @@ class Lsof(plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols") + requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols") ] def _generator(self, tasks): diff --git a/volatility/framework/plugins/linux/malfind.py b/volatility/framework/plugins/linux/malfind.py index 3afdbfb48..a77133dc1 100644 --- a/volatility/framework/plugins/linux/malfind.py +++ b/volatility/framework/plugins/linux/malfind.py @@ -38,7 +38,7 @@ class Malfind(interfaces_plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols") + requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols") ] def _list_injections(self, task): diff --git a/volatility/framework/plugins/linux/proc.py b/volatility/framework/plugins/linux/proc.py index 32d21d6e4..1a8f966e0 100644 --- a/volatility/framework/plugins/linux/proc.py +++ b/volatility/framework/plugins/linux/proc.py @@ -38,7 +38,7 @@ class Maps(plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols") + requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols") ] def _generator(self, tasks): diff --git a/volatility/framework/plugins/linux/pslist.py b/volatility/framework/plugins/linux/pslist.py index d31b4a7ff..4c8a95439 100644 --- a/volatility/framework/plugins/linux/pslist.py +++ b/volatility/framework/plugins/linux/pslist.py @@ -35,7 +35,7 @@ class PsList(interfaces_plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols") + requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols") ] @classmethod @@ -74,12 +74,8 @@ class PsList(interfaces_plugins.PluginInterface): """Lists all the tasks in the primary layer""" linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name) - vmlinux = contexts.Module(context, - vmlinux_symbols, - layer_name, - 0, - absolute_symbol_addresses = True) - + vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0, absolute_symbol_addresses = True) + init_task = vmlinux.object(symbol_name = "init_task") for task in init_task.tasks: diff --git a/volatility/framework/plugins/mac/bash.py b/volatility/framework/plugins/mac/bash.py index 06c94e473..c666ca79b 100644 --- a/volatility/framework/plugins/mac/bash.py +++ b/volatility/framework/plugins/mac/bash.py @@ -43,7 +43,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols") + requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols") ] def _generator(self, tasks): diff --git a/volatility/framework/plugins/mac/check_syscall.py b/volatility/framework/plugins/mac/check_syscall.py index 5255a2593..49cd6964a 100644 --- a/volatility/framework/plugins/mac/check_syscall.py +++ b/volatility/framework/plugins/mac/check_syscall.py @@ -10,6 +10,7 @@ from volatility.framework.renderers import format_hints vollog = logging.getLogger(__name__) + class Check_syscall(plugins.PluginInterface): """Check system call table for hooks""" @@ -18,16 +19,14 @@ class Check_syscall(plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols")] + requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols") + ] def _generator(self): mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary']) - kernel = contexts.Module(self._context, - self.config['darwin'], - self.config['primary'], - 0, - absolute_symbol_addresses = True) + kernel = contexts.Module( + self._context, self.config['darwin'], self.config['primary'], 0, absolute_symbol_addresses = True) nsysent = kernel.object(symbol_name = "nsysent") table = kernel.object(symbol_name = "sysent") diff --git a/volatility/framework/plugins/mac/lsmod.py b/volatility/framework/plugins/mac/lsmod.py index 5cd09ba18..4ead29f93 100644 --- a/volatility/framework/plugins/mac/lsmod.py +++ b/volatility/framework/plugins/mac/lsmod.py @@ -37,7 +37,7 @@ class Lsmod(plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "darwin", description = "Linux kernel symbols") + requirements.SymbolTableRequirement(name = "darwin", description = "Linux kernel symbols") ] @classmethod @@ -45,11 +45,7 @@ class Lsmod(plugins.PluginInterface): """Lists all the modules in the primary layer""" mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name) - kernel = contexts.Module(context, - darwin_symbols, - layer_name, - 0, - absolute_symbol_addresses = True) + kernel = contexts.Module(context, darwin_symbols, layer_name, 0, absolute_symbol_addresses = True) kmod_ptr = kernel.object(symbol_name = "kmod") diff --git a/volatility/framework/plugins/mac/malfind.py b/volatility/framework/plugins/mac/malfind.py index 307ed4f30..2d3ad62eb 100644 --- a/volatility/framework/plugins/mac/malfind.py +++ b/volatility/framework/plugins/mac/malfind.py @@ -36,7 +36,7 @@ class Malfind(interfaces_plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "darwin", description = "Linux kernel symbols") + requirements.SymbolTableRequirement(name = "darwin", description = "Linux kernel symbols") ] def _list_injections(self, task): diff --git a/volatility/framework/plugins/mac/psaux.py b/volatility/framework/plugins/mac/psaux.py index 1d16a4ddd..6b242edd3 100644 --- a/volatility/framework/plugins/mac/psaux.py +++ b/volatility/framework/plugins/mac/psaux.py @@ -35,7 +35,7 @@ class Psaux(plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols") + requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols") ] def _generator(self, tasks: Iterator[Any]) -> Generator[Tuple[int, Tuple[int, str, int, str]], None, None]: diff --git a/volatility/framework/plugins/mac/pslist.py b/volatility/framework/plugins/mac/pslist.py index b5f0c71a1..d3973a43d 100644 --- a/volatility/framework/plugins/mac/pslist.py +++ b/volatility/framework/plugins/mac/pslist.py @@ -38,7 +38,7 @@ class PsList(interfaces_plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols") + requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols") ] @classmethod @@ -80,12 +80,8 @@ class PsList(interfaces_plugins.PluginInterface): """Lists all the tasks in the primary layer""" mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name) - - kernel = contexts.Module(context, - darwin_symbols, - layer_name, - 0, - absolute_symbol_addresses = True) + + kernel = contexts.Module(context, darwin_symbols, layer_name, 0, absolute_symbol_addresses = True) proc = kernel.object(symbol_name = "allproc").lh_first diff --git a/volatility/framework/plugins/mac/pstree.py b/volatility/framework/plugins/mac/pstree.py index 12a394fea..396ba2d69 100644 --- a/volatility/framework/plugins/mac/pstree.py +++ b/volatility/framework/plugins/mac/pstree.py @@ -39,7 +39,7 @@ class PsTree(plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols") + requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols") ] def _find_level(self, pid): diff --git a/volatility/framework/plugins/mac/trustedbsd.py b/volatility/framework/plugins/mac/trustedbsd.py index e855d7c15..ed3835b73 100644 --- a/volatility/framework/plugins/mac/trustedbsd.py +++ b/volatility/framework/plugins/mac/trustedbsd.py @@ -41,17 +41,14 @@ class Check_syscall(plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols") + requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols") ] def _generator(self, mods: Iterator[Any]): mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary']) - kernel = contexts.Module(self._context, - self.config['darwin'], - self.config['primary'], - 0, - absolute_symbol_addresses = True) + kernel = contexts.Module( + self._context, self.config['darwin'], self.config['primary'], 0, absolute_symbol_addresses = True) policy_list = kernel.object(symbol_name = "_mac_policy_list").cast("mac_policy_list") diff --git a/volatility/framework/plugins/windows/cmdline.py b/volatility/framework/plugins/windows/cmdline.py index 0f8545555..434eb3b63 100644 --- a/volatility/framework/plugins/windows/cmdline.py +++ b/volatility/framework/plugins/windows/cmdline.py @@ -36,7 +36,7 @@ class CmdLine(interfaces_plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols") + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") ] def _generator(self, procs): diff --git a/volatility/framework/plugins/windows/dlldump.py b/volatility/framework/plugins/windows/dlldump.py index 904316938..cb25b796f 100644 --- a/volatility/framework/plugins/windows/dlldump.py +++ b/volatility/framework/plugins/windows/dlldump.py @@ -44,7 +44,7 @@ class DllDump(interfaces_plugins.PluginInterface): return [requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), # TODO: Convert this to a ListRequirement so that people can filter on sets of ranges requirements.IntRequirement(name = 'address', description = "Process virtual memory address to include " \ diff --git a/volatility/framework/plugins/windows/dlllist.py b/volatility/framework/plugins/windows/dlllist.py index fe7ca93a8..5c698feb9 100644 --- a/volatility/framework/plugins/windows/dlllist.py +++ b/volatility/framework/plugins/windows/dlllist.py @@ -36,7 +36,7 @@ class DllList(interfaces_plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols") + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") ] def _generator(self, procs): diff --git a/volatility/framework/plugins/windows/handles.py b/volatility/framework/plugins/windows/handles.py index f6d7085f5..3da2eb415 100644 --- a/volatility/framework/plugins/windows/handles.py +++ b/volatility/framework/plugins/windows/handles.py @@ -55,7 +55,7 @@ class Handles(interfaces_plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols") + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") ] def _decode_pointer(self, value, magic): diff --git a/volatility/framework/plugins/windows/info.py b/volatility/framework/plugins/windows/info.py index 92d5ff574..2b914e1f5 100644 --- a/volatility/framework/plugins/windows/info.py +++ b/volatility/framework/plugins/windows/info.py @@ -37,7 +37,7 @@ class Info(plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols") + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") ] def get_depends(self, layer_name: str, index: int = 0): diff --git a/volatility/framework/plugins/windows/malfind.py b/volatility/framework/plugins/windows/malfind.py index ac4e57b79..60a7bf2b5 100644 --- a/volatility/framework/plugins/windows/malfind.py +++ b/volatility/framework/plugins/windows/malfind.py @@ -36,7 +36,7 @@ class Malfind(interfaces.plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols") + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") ] @classmethod diff --git a/volatility/framework/plugins/windows/moddump.py b/volatility/framework/plugins/windows/moddump.py index 22a8c6f40..712b1c0aa 100644 --- a/volatility/framework/plugins/windows/moddump.py +++ b/volatility/framework/plugins/windows/moddump.py @@ -44,7 +44,7 @@ class ModDump(interfaces_plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols") + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") ] @classmethod diff --git a/volatility/framework/plugins/windows/modules.py b/volatility/framework/plugins/windows/modules.py index 2a7fc54ae..4a6befe6d 100644 --- a/volatility/framework/plugins/windows/modules.py +++ b/volatility/framework/plugins/windows/modules.py @@ -35,7 +35,7 @@ class Modules(interfaces.plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols") + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") ] def _generator(self): diff --git a/volatility/framework/plugins/windows/poolscanner.py b/volatility/framework/plugins/windows/poolscanner.py index d7bf5b7f8..43d6308c7 100644 --- a/volatility/framework/plugins/windows/poolscanner.py +++ b/volatility/framework/plugins/windows/poolscanner.py @@ -79,7 +79,7 @@ class PoolScanner(plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols") + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") ] @staticmethod diff --git a/volatility/framework/plugins/windows/procdump.py b/volatility/framework/plugins/windows/procdump.py index 9f559a4ba..38966f1b4 100644 --- a/volatility/framework/plugins/windows/procdump.py +++ b/volatility/framework/plugins/windows/procdump.py @@ -43,7 +43,7 @@ class ProcDump(interfaces_plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols") + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") ] def _generator(self, procs): diff --git a/volatility/framework/plugins/windows/pslist.py b/volatility/framework/plugins/windows/pslist.py index e96246a85..3e48ef788 100644 --- a/volatility/framework/plugins/windows/pslist.py +++ b/volatility/framework/plugins/windows/pslist.py @@ -38,7 +38,7 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), # TODO: Convert this to a ListRequirement so that people can filter on sets of pids requirements.IntRequirement( name = 'pid', description = "Process ID to include (all other processes are excluded)", diff --git a/volatility/framework/plugins/windows/registry/hivelist.py b/volatility/framework/plugins/windows/registry/hivelist.py index 74af10381..b89bf6047 100644 --- a/volatility/framework/plugins/windows/registry/hivelist.py +++ b/volatility/framework/plugins/windows/registry/hivelist.py @@ -34,7 +34,7 @@ class HiveList(plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.StringRequirement( name = 'filter', description = "String to filter hive names returned", optional = True, default = None) ] diff --git a/volatility/framework/plugins/windows/registry/printkey.py b/volatility/framework/plugins/windows/registry/printkey.py index 06379e705..ae5047856 100644 --- a/volatility/framework/plugins/windows/registry/printkey.py +++ b/volatility/framework/plugins/windows/registry/printkey.py @@ -39,7 +39,7 @@ class PrintKey(interfaces.plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.IntRequirement(name = 'offset', description = "Hive Offset", default = None, optional = True), requirements.StringRequirement( name = 'key', description = "Key to start from", default = None, optional = True), diff --git a/volatility/framework/plugins/windows/registry/userassist.py b/volatility/framework/plugins/windows/registry/userassist.py index 1b4da3a6e..bd20676f6 100644 --- a/volatility/framework/plugins/windows/registry/userassist.py +++ b/volatility/framework/plugins/windows/registry/userassist.py @@ -52,7 +52,7 @@ class UserAssist(interfaces.plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.IntRequirement(name = 'offset', description = "Hive Offset", default = None, optional = True) ] diff --git a/volatility/framework/plugins/windows/ssdt.py b/volatility/framework/plugins/windows/ssdt.py index 8a854e4a0..be22fcba9 100644 --- a/volatility/framework/plugins/windows/ssdt.py +++ b/volatility/framework/plugins/windows/ssdt.py @@ -40,7 +40,7 @@ class SSDT(plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols") + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") ] def _generator(self, mods: Iterator[Any]) -> Iterator[Tuple[int, Tuple[int, int, Any, Any]]]: diff --git a/volatility/framework/plugins/windows/strings.py b/volatility/framework/plugins/windows/strings.py index 5e8f669fa..f72e12337 100644 --- a/volatility/framework/plugins/windows/strings.py +++ b/volatility/framework/plugins/windows/strings.py @@ -38,7 +38,7 @@ class Strings(interfaces.plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.URIRequirement(name = "strings_file", description = "Strings file") ] # TODO: Make URLRequirement that can accept a file address which the framework can open diff --git a/volatility/framework/plugins/windows/vaddump.py b/volatility/framework/plugins/windows/vaddump.py index 95540e382..45d6658ca 100644 --- a/volatility/framework/plugins/windows/vaddump.py +++ b/volatility/framework/plugins/windows/vaddump.py @@ -41,7 +41,7 @@ class VadDump(interfaces_plugins.PluginInterface): return [requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), # TODO: Convert this to a ListRequirement so that people can filter on sets of ranges requirements.IntRequirement(name = 'address', description = "Process virtual memory address to include " \ diff --git a/volatility/framework/plugins/windows/vadinfo.py b/volatility/framework/plugins/windows/vadinfo.py index 64a49d868..3c59d0e18 100644 --- a/volatility/framework/plugins/windows/vadinfo.py +++ b/volatility/framework/plugins/windows/vadinfo.py @@ -60,7 +60,7 @@ class VadInfo(interfaces.plugins.PluginInterface): return [requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), # TODO: Convert this to a ListRequirement so that people can filter on sets of ranges requirements.IntRequirement(name = 'address', description = "Process virtual memory address to include " \ diff --git a/volatility/framework/plugins/windows/vadyarascan.py b/volatility/framework/plugins/windows/vadyarascan.py index a7be33000..ce969b910 100644 --- a/volatility/framework/plugins/windows/vadyarascan.py +++ b/volatility/framework/plugins/windows/vadyarascan.py @@ -43,7 +43,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = "Memory layer for the kernel", architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.BooleanRequirement( name = "wide", description = "Match wide (unicode) strings", default = False, optional = True), requirements.StringRequirement( diff --git a/volatility/framework/plugins/windows/verinfo.py b/volatility/framework/plugins/windows/verinfo.py index 2d5a8468d..6b2eceec4 100644 --- a/volatility/framework/plugins/windows/verinfo.py +++ b/volatility/framework/plugins/windows/verinfo.py @@ -50,7 +50,7 @@ class VerInfo(interfaces_plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), ] @classmethod