WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-08 10:47:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Changing properties for getters

Browse Source
This commit is contained in:
Gustavo Moreira
2022-04-30 14:14:18 +10:00
parent 1679769da7
commit f919d29c50
2 changed files with 46 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/linux/sockstat.py
+22 -21
View File
@@ -74,7 +74,7 @@ class SockHandlers(interfaces.configuration.VersionableInterface):
sock_stat: A tuple with the source, destination and state strings.
extended: A dictionary with key/value extended information.
"""
family = sock.family
family = sock.get_family()
extended = {}
sock_handler = self._sock_family_handlers.get(family)
if sock_handler:
@@ -144,13 +144,13 @@ class SockHandlers(interfaces.configuration.VersionableInterface):
sock_stat: A tuple with the source, destination and state strings.
"""
unix_sock = sock.cast("unix_sock")
state = unix_sock.state
saddr = unix_sock.name
sinode = unix_sock.inode
state = unix_sock.get_state()
saddr = unix_sock.get_name()
sinode = unix_sock.get_inode()
if unix_sock.peer != 0:
peer = unix_sock.peer.dereference().cast("unix_sock")
daddr = peer.name
dinode = peer.inode
daddr = peer.get_name()
dinode = peer.get_inode()
else:
daddr = dinode = ""
@@ -170,13 +170,13 @@ class SockHandlers(interfaces.configuration.VersionableInterface):
sock_stat: A tuple with the source, destination and state strings.
"""
inet_sock = sock.cast("inet_sock")
saddr = inet_sock.src_addr
sport = inet_sock.src_port
daddr = inet_sock.dst_addr
dport = inet_sock.dst_port
state = inet_sock.state
saddr = inet_sock.get_src_addr()
sport = inet_sock.get_src_port()
daddr = inet_sock.get_dst_addr()
dport = inet_sock.get_dst_port()
state = inet_sock.get_state()
if inet_sock.family == "AF_INET6":
if inet_sock.get_family() == "AF_INET6":
saddr = f"[{saddr}]"
saddr_tag = f"{saddr}:{sport}"
@@ -217,7 +217,7 @@ class SockHandlers(interfaces.configuration.VersionableInterface):
saddr_tag = ",".join(saddr_list)
daddr_tag = ",".join(daddr_list)
state = netlink_sock.state
state = netlink_sock.get_state()
sock_stat = saddr_tag, daddr_tag, state
return netlink_sock, sock_stat
@@ -260,7 +260,7 @@ class SockHandlers(interfaces.configuration.VersionableInterface):
saddr_tag = f"{dev_name}"
daddr_tag = ""
state = packet_sock.state
state = packet_sock.get_state()
sock_stat = saddr_tag, daddr_tag, state
return packet_sock, sock_stat
@@ -318,15 +318,16 @@ class SockHandlers(interfaces.configuration.VersionableInterface):
return ":".join(reversed(["%02x" % x for x in addr.b]))
saddr_tag = daddr_tag = ""
if bt_sock.protocol == "HCI":
bt_protocol = bt_sock.get_protocol()
if bt_protocol == "HCI":
pinfo = bt_sock.cast("hci_pinfo")
elif bt_sock.protocol == "L2CAP":
elif bt_protocol == "L2CAP":
pinfo = bt_sock.cast("l2cap_pinfo")
src_addr = bt_addr(pinfo.chan.src)
dst_addr = bt_addr(pinfo.chan.dst)
saddr_tag = f"{src_addr}"
daddr_tag = f"{dst_addr}"
elif bt_sock.protocol == "RFCOMM":
elif bt_protocol == "RFCOMM":
pinfo = bt_sock.cast("rfcomm_pinfo")
src_addr = bt_addr(pinfo.src)
dst_addr = bt_addr(pinfo.dst)
@@ -334,7 +335,7 @@ class SockHandlers(interfaces.configuration.VersionableInterface):
saddr_tag = f"[{src_addr}]:{channel}"
daddr_tag = f"{dst_addr}"
else:
vollog.log(constants.LOGLEVEL_V, "Unsupported bluetooth protocol '%s'", bt_sock.protocol)
vollog.log(constants.LOGLEVEL_V, "Unsupported bluetooth protocol '%s'", bt_protocol)
state = bt_sock.state
sock_stat = saddr_tag, daddr_tag, state
@@ -420,8 +421,8 @@ class Sockstat(plugins.PluginInterface):
sock = socket.sk.dereference()
sock_type = sock.type
family = sock.family
sock_type = sock.get_type()
family = sock.get_family()
sock_handler = SockHandlers(vmlinux, task)
sock_fields = sock_handler.process_sock(sock)
@@ -429,7 +430,7 @@ class Sockstat(plugins.PluginInterface):
continue
child_sock = sock_fields[0]
protocol = child_sock.protocol if hasattr(child_sock, "protocol") else ""
protocol = child_sock.get_protocol()
net = task.nsproxy.net_ns
netns_id = net.get_inode()
volatility3/framework/symbols/linux/extensions/__init__.py
+24 -44
View File
@@ -617,20 +617,17 @@ class sock(objects.StructType):
return module_names[0]
@property
def family(self):
def get_family(self):
family_idx = self.__sk_common.skc_family
if 0 <= family_idx < len(SOCK_FAMILY):
return SOCK_FAMILY[family_idx]
else:
return "UNKNOWN"
@property
def type(self):
def get_type(self):
return SOCK_TYPES.get(self.sk_type, "")
@property
def inode(self):
def get_inode(self):
if not self.sk_socket:
return 0
@@ -646,8 +643,7 @@ class sock(objects.StructType):
return vfs_inode.i_ino
class unix_sock(objects.StructType):
@property
def name(self):
def get_name(self):
if self.addr:
sockaddr_un = self.addr.name.cast("sockaddr_un")
saddr = str(utility.array_to_string(sockaddr_un.sun_path))
@@ -655,16 +651,14 @@ class unix_sock(objects.StructType):
saddr = ""
return saddr
@property
def protocol(self):
def get_protocol(self):
return ""
@property
def state(self):
def get_state(self):
"""Return a string representing the sock state."""
# Unix socket states reuse (a subset) of the inet_sock states contants
if self.sk.type == "STREAM":
if self.sk.get_type() == "STREAM":
state_idx = self.sk.__sk_common.skc_state
if 0 <= state_idx < len(TCP_STATES):
state = TCP_STATES[state_idx]
@@ -675,33 +669,29 @@ class unix_sock(objects.StructType):
return state
@property
def inode(self):
return self.sk.inode
def get_inode(self):
return self.sk.get_inode()
class inet_sock(objects.StructType):
@property
def family(self):
def get_family(self):
family_idx = self.sk.__sk_common.skc_family
if 0 <= family_idx < len(SOCK_FAMILY):
return SOCK_FAMILY[family_idx]
else:
return "UNKNOWN"
@property
def protocol(self):
def get_protocol(self):
# If INET6 family and a proto is defined, we use that specific IPv6 protocol.
# Otherwise, we use the standard IP protocol.
protocol = IP_PROTOCOLS.get(self.sk.sk_protocol, "UNKNOWN")
if self.family == "AF_INET6":
if self.get_family() == "AF_INET6":
protocol = IPV6_PROTOCOLS.get(self.sk.sk_protocol, protocol)
return protocol
@property
def state(self):
def get_state(self):
"""Return a string representing the sock state."""
if self.sk.type == "STREAM":
if self.sk.get_type() == "STREAM":
state_idx = self.sk.__sk_common.skc_state
if 0 <= state_idx < len(TCP_STATES):
state = TCP_STATES[state_idx]
@@ -712,14 +702,12 @@ class inet_sock(objects.StructType):
return state
@property
def src_port(self):
def get_src_port(self):
sport_le = getattr(self, "sport", getattr(self, "inet_sport", None))
if sport_le is not None:
return socket.htons(sport_le)
@property
def dst_port(self):
def get_dst_port(self):
sk_common = self.sk.__sk_common
if hasattr(sk_common, "skc_portpair"):
dport_le = sk_common.skc_portpair & 0xffff
@@ -734,8 +722,7 @@ class inet_sock(objects.StructType):
return socket.htons(dport_le)
@property
def src_addr(self):
def get_src_addr(self):
sk_common = self.sk.__sk_common
family = sk_common.skc_family
if family == socket.AF_INET:
@@ -756,8 +743,7 @@ class inet_sock(objects.StructType):
addr_bytes = parent_layer.read(saddr.vol.offset, addr_size)
return socket.inet_ntop(family, addr_bytes)
@property
def dst_addr(self):
def get_dst_addr(self):
sk_common = self.sk.__sk_common
family = sk_common.skc_family
if family == socket.AF_INET:
@@ -782,16 +768,14 @@ class inet_sock(objects.StructType):
return socket.inet_ntop(family, addr_bytes)
class netlink_sock(objects.StructType):
@property
def protocol(self):
def get_protocol(self):
protocol_idx = self.sk.sk_protocol
if 0 <= protocol_idx < len(NETLINK_PROTOCOLS):
return NETLINK_PROTOCOLS[protocol_idx]
else:
return "UNKNOWN"
@property
def state(self):
def get_state(self):
# Netlink is a datagram-oriented service. We can only have
# SOCK_RAW or SOCK_DGRAM socket types.
# NOTE: We are overriding the netlink_sock.state member here
@@ -800,8 +784,7 @@ class netlink_sock(objects.StructType):
class packet_sock(objects.StructType):
@property
def protocol(self):
def get_protocol(self):
eth_proto = socket.htons(self.num)
if eth_proto == 0:
return ""
@@ -810,15 +793,13 @@ class packet_sock(objects.StructType):
else:
return f"0x{eth_proto:x}"
@property
def state(self):
def get_state(self):
# Packet socket types are either SOCK_RAW or SOCK_DGRAM.
return "UNCONNECTED"
class bt_sock(objects.StructType):
@property
def protocol(self):
def get_protocol(self):
type_idx = self.sk.sk_protocol
if 0 <= type_idx < len(BLUETOOTH_PROTOCOLS):
state = BLUETOOTH_PROTOCOLS[type_idx]
@@ -827,8 +808,7 @@ class bt_sock(objects.StructType):
return state
@property
def state(self):
def get_state(self):
state_idx = self.sk.__sk_common.skc_state
if 0 <= state_idx < len(BLUETOOTH_STATES):
state = BLUETOOTH_STATES[state_idx]