From a34fb8497633394062e10366553a2c69ba10c85a Mon Sep 17 00:00:00 2001 From: Eve Date: Wed, 8 Mar 2023 13:31:37 +0000 Subject: [PATCH 1/4] Fix linux.psscan to use kernel offset when finding symbol location --- volatility3/framework/plugins/linux/psscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/psscan.py b/volatility3/framework/plugins/linux/psscan.py index ba233e53d..60b96ba40 100644 --- a/volatility3/framework/plugins/linux/psscan.py +++ b/volatility3/framework/plugins/linux/psscan.py @@ -111,7 +111,7 @@ class PsScan(interfaces.plugins.PluginInterface): # find all sched_class names by searching by if they include '_sched_class', e.g. 'fair_sched_class' if "_sched_class" in symbol: # use canonicalize to set the appropriate sign extension for the addr - addr = kernel_layer.canonicalize(vmlinux.get_symbol(symbol).address) + addr = kernel_layer.canonicalize(vmlinux.get_symbol(symbol).address + vmlinux.offset) # append to needles list the packed hex for searching needles.append(struct.pack(pack_format, addr)) From bdf57f071697aa7688595efed438c8b80aa336d6 Mon Sep 17 00:00:00 2001 From: Eve Date: Wed, 8 Mar 2023 13:44:08 +0000 Subject: [PATCH 2/4] Add extra debug messages to linux.psscan when finding symbol locations --- volatility3/framework/plugins/linux/psscan.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/psscan.py b/volatility3/framework/plugins/linux/psscan.py index 60b96ba40..7cf0aa631 100644 --- a/volatility3/framework/plugins/linux/psscan.py +++ b/volatility3/framework/plugins/linux/psscan.py @@ -112,9 +112,16 @@ class PsScan(interfaces.plugins.PluginInterface): if "_sched_class" in symbol: # use canonicalize to set the appropriate sign extension for the addr addr = kernel_layer.canonicalize(vmlinux.get_symbol(symbol).address + vmlinux.offset) + packed_addr = struct.pack(pack_format, addr) + + # debug message to show needles being searched for and symbol names + vollog.debug( + f"Found a sched_class named {symbol} at offset {hex(addr)}. Will scan for these bytes: {packed_addr.hex()}" + ) # append to needles list the packed hex for searching - needles.append(struct.pack(pack_format, addr)) + needles.append(packed_addr) + # scan the memory_layer for these needles memory_layer = context.layers["memory_layer"] for address, _ in memory_layer.scan( From abfe104eb96e5ddd4a07e7a7a4dd5073fc88e5d0 Mon Sep 17 00:00:00 2001 From: Eve Date: Wed, 8 Mar 2023 14:02:13 +0000 Subject: [PATCH 3/4] Fix linux.pscan to find memory layer to scan using kernel layers dependencies rather than hard coded value. --- volatility3/framework/plugins/linux/psscan.py | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/psscan.py b/volatility3/framework/plugins/linux/psscan.py index 7cf0aa631..e8cc17a40 100644 --- a/volatility3/framework/plugins/linux/psscan.py +++ b/volatility3/framework/plugins/linux/psscan.py @@ -6,7 +6,7 @@ from typing import Iterable, List, Tuple import struct from enum import Enum -from volatility3.framework import renderers, interfaces, symbols, constants +from volatility3.framework import renderers, interfaces, symbols, constants, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility from volatility3.framework.layers import scanners @@ -122,8 +122,20 @@ class PsScan(interfaces.plugins.PluginInterface): # append to needles list the packed hex for searching needles.append(packed_addr) + # find the memory layer to scan + if len(kernel_layer.dependencies) > 1: + vollog.warning( + f"Kernel layer depends on multiple layers however only {kernel_layer.dependencies[0]} will be scanned by this plugin." + ) + elif len(kernel_layer.dependencies) == 0: + vollog.error( + f"Kernel layer has no dependencies, meaning there is no memory layer for this plugin to scan." + ) + raise exceptions.LayerException(kernel_layer_name, f"Layer {kernel_layer_name} has no dependencies") + + memory_layer = context.layers[kernel_layer.dependencies[0]] + # scan the memory_layer for these needles - memory_layer = context.layers["memory_layer"] for address, _ in memory_layer.scan( context, scanners.MultiStringScanner(needles) ): From 32db4c0e5f3804b33f4cc1a4f66fae90494c0df8 Mon Sep 17 00:00:00 2001 From: Eve Date: Wed, 8 Mar 2023 14:08:44 +0000 Subject: [PATCH 4/4] Fix black linting for linux.psscan. --- volatility3/framework/plugins/linux/psscan.py | 20 ++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/volatility3/framework/plugins/linux/psscan.py b/volatility3/framework/plugins/linux/psscan.py index e8cc17a40..f4bfd347e 100644 --- a/volatility3/framework/plugins/linux/psscan.py +++ b/volatility3/framework/plugins/linux/psscan.py @@ -111,7 +111,9 @@ class PsScan(interfaces.plugins.PluginInterface): # find all sched_class names by searching by if they include '_sched_class', e.g. 'fair_sched_class' if "_sched_class" in symbol: # use canonicalize to set the appropriate sign extension for the addr - addr = kernel_layer.canonicalize(vmlinux.get_symbol(symbol).address + vmlinux.offset) + addr = kernel_layer.canonicalize( + vmlinux.get_symbol(symbol).address + vmlinux.offset + ) packed_addr = struct.pack(pack_format, addr) # debug message to show needles being searched for and symbol names @@ -121,20 +123,20 @@ class PsScan(interfaces.plugins.PluginInterface): # append to needles list the packed hex for searching needles.append(packed_addr) - # find the memory layer to scan if len(kernel_layer.dependencies) > 1: vollog.warning( - f"Kernel layer depends on multiple layers however only {kernel_layer.dependencies[0]} will be scanned by this plugin." - ) + f"Kernel layer depends on multiple layers however only {kernel_layer.dependencies[0]} will be scanned by this plugin." + ) elif len(kernel_layer.dependencies) == 0: vollog.error( - f"Kernel layer has no dependencies, meaning there is no memory layer for this plugin to scan." - ) - raise exceptions.LayerException(kernel_layer_name, f"Layer {kernel_layer_name} has no dependencies") - + f"Kernel layer has no dependencies, meaning there is no memory layer for this plugin to scan." + ) + raise exceptions.LayerException( + kernel_layer_name, f"Layer {kernel_layer_name} has no dependencies" + ) memory_layer = context.layers[kernel_layer.dependencies[0]] - + # scan the memory_layer for these needles for address, _ in memory_layer.scan( context, scanners.MultiStringScanner(needles)