Refactor SymbolRequirement to SymbolTableRequirement for clarity.

This commit is contained in:
Mike Auty
2019-02-06 21:26:32 +00:00
parent d23e6474ce
commit f898dca296
44 changed files with 67 additions and 93 deletions
+1 -1
View File
@@ -43,7 +43,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols")
]
def _generator(self, tasks):
@@ -41,7 +41,7 @@ class Check_afinfo(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols")
]
# returns whether the symbol is found within the kernel (system.map) or not
@@ -80,11 +80,8 @@ class Check_afinfo(plugins.PluginInterface):
def _generator(self):
linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary'])
vmlinux = contexts.Module(self.context,
self.config['vmlinux'],
self.config['primary'],
0,
absolute_symbol_addresses = True)
vmlinux = contexts.Module(
self.context, self.config['vmlinux'], self.config['primary'], 0, absolute_symbol_addresses = True)
op_members = vmlinux.get_type('file_operations').members
seq_members = vmlinux.get_type('seq_operations').members
@@ -48,7 +48,7 @@ class Check_syscall(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols")
]
def _get_table_size_next_symbol(self, table_addr, ptr_sz, vmlinux):
@@ -145,11 +145,8 @@ class Check_syscall(plugins.PluginInterface):
def _generator(self):
linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary'])
vmlinux = contexts.Module(self.context,
self.config['vmlinux'],
self.config['primary'],
0,
absolute_symbol_addresses = True)
vmlinux = contexts.Module(
self.context, self.config['vmlinux'], self.config['primary'], 0, absolute_symbol_addresses = True)
ptr_sz = vmlinux.get_type("pointer").size
if ptr_sz == 4:
+1 -1
View File
@@ -39,7 +39,7 @@ class Elfs(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols")
]
def _generator(self, tasks):
+3 -7
View File
@@ -40,7 +40,7 @@ class Lsmod(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols")
]
@classmethod
@@ -48,12 +48,8 @@ class Lsmod(plugins.PluginInterface):
"""Lists all the modules in the primary layer"""
linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name)
vmlinux = contexts.Module(context,
vmlinux_symbols,
layer_name,
0,
absolute_symbol_addresses = True)
vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0, absolute_symbol_addresses = True)
modules = vmlinux.object(symbol_name = "modules").cast("list_head")
table_name = modules.vol.type_name.split(constants.BANG)[0]
+1 -1
View File
@@ -41,7 +41,7 @@ class Lsof(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols")
]
def _generator(self, tasks):
@@ -38,7 +38,7 @@ class Malfind(interfaces_plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols")
]
def _list_injections(self, task):
+1 -1
View File
@@ -38,7 +38,7 @@ class Maps(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols")
]
def _generator(self, tasks):
+3 -7
View File
@@ -35,7 +35,7 @@ class PsList(interfaces_plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols")
]
@classmethod
@@ -74,12 +74,8 @@ class PsList(interfaces_plugins.PluginInterface):
"""Lists all the tasks in the primary layer"""
linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name)
vmlinux = contexts.Module(context,
vmlinux_symbols,
layer_name,
0,
absolute_symbol_addresses = True)
vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0, absolute_symbol_addresses = True)
init_task = vmlinux.object(symbol_name = "init_task")
for task in init_task.tasks:
+1 -1
View File
@@ -43,7 +43,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols")
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols")
]
def _generator(self, tasks):
@@ -10,6 +10,7 @@ from volatility.framework.renderers import format_hints
vollog = logging.getLogger(__name__)
class Check_syscall(plugins.PluginInterface):
"""Check system call table for hooks"""
@@ -18,16 +19,14 @@ class Check_syscall(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols")]
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols")
]
def _generator(self):
mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
kernel = contexts.Module(self._context,
self.config['darwin'],
self.config['primary'],
0,
absolute_symbol_addresses = True)
kernel = contexts.Module(
self._context, self.config['darwin'], self.config['primary'], 0, absolute_symbol_addresses = True)
nsysent = kernel.object(symbol_name = "nsysent")
table = kernel.object(symbol_name = "sysent")
+2 -6
View File
@@ -37,7 +37,7 @@ class Lsmod(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "darwin", description = "Linux kernel symbols")
requirements.SymbolTableRequirement(name = "darwin", description = "Linux kernel symbols")
]
@classmethod
@@ -45,11 +45,7 @@ class Lsmod(plugins.PluginInterface):
"""Lists all the modules in the primary layer"""
mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name)
kernel = contexts.Module(context,
darwin_symbols,
layer_name,
0,
absolute_symbol_addresses = True)
kernel = contexts.Module(context, darwin_symbols, layer_name, 0, absolute_symbol_addresses = True)
kmod_ptr = kernel.object(symbol_name = "kmod")
+1 -1
View File
@@ -36,7 +36,7 @@ class Malfind(interfaces_plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "darwin", description = "Linux kernel symbols")
requirements.SymbolTableRequirement(name = "darwin", description = "Linux kernel symbols")
]
def _list_injections(self, task):
+1 -1
View File
@@ -35,7 +35,7 @@ class Psaux(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols")
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols")
]
def _generator(self, tasks: Iterator[Any]) -> Generator[Tuple[int, Tuple[int, str, int, str]], None, None]:
+3 -7
View File
@@ -38,7 +38,7 @@ class PsList(interfaces_plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols")
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols")
]
@classmethod
@@ -80,12 +80,8 @@ class PsList(interfaces_plugins.PluginInterface):
"""Lists all the tasks in the primary layer"""
mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name)
kernel = contexts.Module(context,
darwin_symbols,
layer_name,
0,
absolute_symbol_addresses = True)
kernel = contexts.Module(context, darwin_symbols, layer_name, 0, absolute_symbol_addresses = True)
proc = kernel.object(symbol_name = "allproc").lh_first
+1 -1
View File
@@ -39,7 +39,7 @@ class PsTree(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols")
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols")
]
def _find_level(self, pid):
@@ -41,17 +41,14 @@ class Check_syscall(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols")
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols")
]
def _generator(self, mods: Iterator[Any]):
mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
kernel = contexts.Module(self._context,
self.config['darwin'],
self.config['primary'],
0,
absolute_symbol_addresses = True)
kernel = contexts.Module(
self._context, self.config['darwin'], self.config['primary'], 0, absolute_symbol_addresses = True)
policy_list = kernel.object(symbol_name = "_mac_policy_list").cast("mac_policy_list")
@@ -36,7 +36,7 @@ class CmdLine(interfaces_plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
]
def _generator(self, procs):
@@ -44,7 +44,7 @@ class DllDump(interfaces_plugins.PluginInterface):
return [requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
# TODO: Convert this to a ListRequirement so that people can filter on sets of ranges
requirements.IntRequirement(name = 'address',
description = "Process virtual memory address to include " \
@@ -36,7 +36,7 @@ class DllList(interfaces_plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
]
def _generator(self, procs):
@@ -55,7 +55,7 @@ class Handles(interfaces_plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
]
def _decode_pointer(self, value, magic):
+1 -1
View File
@@ -37,7 +37,7 @@ class Info(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
]
def get_depends(self, layer_name: str, index: int = 0):
@@ -36,7 +36,7 @@ class Malfind(interfaces.plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
]
@classmethod
@@ -44,7 +44,7 @@ class ModDump(interfaces_plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
]
@classmethod
@@ -35,7 +35,7 @@ class Modules(interfaces.plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
]
def _generator(self):
@@ -79,7 +79,7 @@ class PoolScanner(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
]
@staticmethod
@@ -43,7 +43,7 @@ class ProcDump(interfaces_plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
]
def _generator(self, procs):
@@ -38,7 +38,7 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
# TODO: Convert this to a ListRequirement so that people can filter on sets of pids
requirements.IntRequirement(
name = 'pid', description = "Process ID to include (all other processes are excluded)",
@@ -34,7 +34,7 @@ class HiveList(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.StringRequirement(
name = 'filter', description = "String to filter hive names returned", optional = True, default = None)
]
@@ -39,7 +39,7 @@ class PrintKey(interfaces.plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.IntRequirement(name = 'offset', description = "Hive Offset", default = None, optional = True),
requirements.StringRequirement(
name = 'key', description = "Key to start from", default = None, optional = True),
@@ -52,7 +52,7 @@ class UserAssist(interfaces.plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.IntRequirement(name = 'offset', description = "Hive Offset", default = None, optional = True)
]
+1 -1
View File
@@ -40,7 +40,7 @@ class SSDT(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols")
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols")
]
def _generator(self, mods: Iterator[Any]) -> Iterator[Tuple[int, Tuple[int, int, Any, Any]]]:
@@ -38,7 +38,7 @@ class Strings(interfaces.plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.URIRequirement(name = "strings_file", description = "Strings file")
]
# TODO: Make URLRequirement that can accept a file address which the framework can open
@@ -41,7 +41,7 @@ class VadDump(interfaces_plugins.PluginInterface):
return [requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
# TODO: Convert this to a ListRequirement so that people can filter on sets of ranges
requirements.IntRequirement(name = 'address',
description = "Process virtual memory address to include " \
@@ -60,7 +60,7 @@ class VadInfo(interfaces.plugins.PluginInterface):
return [requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
# TODO: Convert this to a ListRequirement so that people can filter on sets of ranges
requirements.IntRequirement(name = 'address',
description = "Process virtual memory address to include " \
@@ -43,7 +43,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = "Memory layer for the kernel", architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.BooleanRequirement(
name = "wide", description = "Match wide (unicode) strings", default = False, optional = True),
requirements.StringRequirement(
@@ -50,7 +50,7 @@ class VerInfo(interfaces_plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
]
@classmethod