WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-13 21:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Refactor SymbolRequirement to SymbolTableRequirement for clarity.

Browse Source
This commit is contained in:
Mike Auty
2019-02-06 21:26:32 +00:00
parent d23e6474ce
commit f898dca296
44 changed files with 67 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/mac/bash.py
+1 -1
View File
@@ -43,7 +43,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols")
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols")
]
def _generator(self, tasks):
volatility/framework/plugins/mac/check_syscall.py
+5 -6
View File
@@ -10,6 +10,7 @@ from volatility.framework.renderers import format_hints
vollog = logging.getLogger(__name__)
class Check_syscall(plugins.PluginInterface):
"""Check system call table for hooks"""
@@ -18,16 +19,14 @@ class Check_syscall(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols")]
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols")
]
def _generator(self):
mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
kernel = contexts.Module(self._context,
self.config['darwin'],
self.config['primary'],
0,
absolute_symbol_addresses = True)
kernel = contexts.Module(
self._context, self.config['darwin'], self.config['primary'], 0, absolute_symbol_addresses = True)
nsysent = kernel.object(symbol_name = "nsysent")
table = kernel.object(symbol_name = "sysent")
volatility/framework/plugins/mac/lsmod.py
+2 -6
View File
@@ -37,7 +37,7 @@ class Lsmod(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "darwin", description = "Linux kernel symbols")
requirements.SymbolTableRequirement(name = "darwin", description = "Linux kernel symbols")
]
@classmethod
@@ -45,11 +45,7 @@ class Lsmod(plugins.PluginInterface):
"""Lists all the modules in the primary layer"""
mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name)
kernel = contexts.Module(context,
darwin_symbols,
layer_name,
0,
absolute_symbol_addresses = True)
kernel = contexts.Module(context, darwin_symbols, layer_name, 0, absolute_symbol_addresses = True)
kmod_ptr = kernel.object(symbol_name = "kmod")
volatility/framework/plugins/mac/malfind.py
+1 -1
View File
@@ -36,7 +36,7 @@ class Malfind(interfaces_plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "darwin", description = "Linux kernel symbols")
requirements.SymbolTableRequirement(name = "darwin", description = "Linux kernel symbols")
]
def _list_injections(self, task):
volatility/framework/plugins/mac/psaux.py
+1 -1
View File
@@ -35,7 +35,7 @@ class Psaux(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols")
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols")
]
def _generator(self, tasks: Iterator[Any]) -> Generator[Tuple[int, Tuple[int, str, int, str]], None, None]:
volatility/framework/plugins/mac/pslist.py
+3 -7
View File
@@ -38,7 +38,7 @@ class PsList(interfaces_plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols")
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols")
]
@classmethod
@@ -80,12 +80,8 @@ class PsList(interfaces_plugins.PluginInterface):
"""Lists all the tasks in the primary layer"""
mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name)
kernel = contexts.Module(context,
darwin_symbols,
layer_name,
0,
absolute_symbol_addresses = True)
kernel = contexts.Module(context, darwin_symbols, layer_name, 0, absolute_symbol_addresses = True)
proc = kernel.object(symbol_name = "allproc").lh_first
volatility/framework/plugins/mac/pstree.py
+1 -1
View File
@@ -39,7 +39,7 @@ class PsTree(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols")
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols")
]
def _find_level(self, pid):
volatility/framework/plugins/mac/trustedbsd.py
+3 -6
View File
@@ -41,17 +41,14 @@ class Check_syscall(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols")
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols")
]
def _generator(self, mods: Iterator[Any]):
mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
kernel = contexts.Module(self._context,
self.config['darwin'],
self.config['primary'],
0,
absolute_symbol_addresses = True)
kernel = contexts.Module(
self._context, self.config['darwin'], self.config['primary'], 0, absolute_symbol_addresses = True)
policy_list = kernel.object(symbol_name = "_mac_policy_list").cast("mac_policy_list")