mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-08-22 06:22:23 +02:00
189 lines
8.0 KiB
Python
189 lines
8.0 KiB
Python
"""
|
|
Created on 10 Mar 2013
|
|
|
|
@author: mike
|
|
"""
|
|
|
|
import logging
|
|
import pdb
|
|
|
|
import volatility.framework.symbols.windows.extensions
|
|
import volatility.plugins
|
|
from volatility import framework
|
|
from volatility.framework import contexts, layers
|
|
from volatility.framework.interfaces import objects
|
|
from volatility.framework.symbols import native, vtypes
|
|
from volatility.framework.symbols.windows import xp_sp2_x86_vtypes
|
|
|
|
|
|
def utils_load_as():
|
|
# TODO: This should hold the smarts for determining the physical layers and guessing at various values and so on
|
|
native_list = native.x86NativeTable
|
|
ctx = framework.contexts.Context(native_list)
|
|
ctx.symbol_space.append(native_list)
|
|
|
|
ntkrnlmp = vtypes.VTypeSymbolTable(name = 'ntkrnlmp',
|
|
vtype_pymodule = "volatility.framework.symbols.windows.xp_sp2_x86_vtypes",
|
|
vtype_variable = "ntkrnlmp_types", native_types = ctx.symbol_space.natives)
|
|
ntkrnlmp.set_type_class('_ETHREAD', volatility.framework.symbols.windows.extensions._ETHREAD)
|
|
ntkrnlmp.set_type_class('_LIST_ENTRY', volatility.framework.symbols.windows.extensions._LIST_ENTRY)
|
|
ctx.symbol_space.append(ntkrnlmp)
|
|
# contexts.windows.WindowsContextModifier(ctx.config).modify_context(ctx)
|
|
|
|
return ctx
|
|
|
|
|
|
def test_symbols():
|
|
ctx = utils_load_as()
|
|
print("Symbols,", ctx.symbol_space.natives.types)
|
|
|
|
virtual_types = xp_sp2_x86_vtypes.ntkrnlmp_types
|
|
virtual_types['TEST_POINTER'] = [0x4, {'point1': [0x0, ['pointer', ['TEST_SYMBOL']]]}]
|
|
virtual_types['TEST_SYMBOL'] = [0x6, {'test1': [0x0, ['unsigned int']], 'test2': [0x4, ['unsigned short']]}]
|
|
ntkrnlmp = vtypes.VTypeSymbolTable(name = 'ntkrnlmp',
|
|
vtype_pymodule = "volatility.framework.symbols.windows.xp_sp2_x86_vtypes",
|
|
vtype_variable = "ntkrnlmp_types",
|
|
native_types = ctx.symbol_space.natives)
|
|
# TODO: Find a way to alter the virtual types if this test is required
|
|
|
|
ctx.symbol_space.append(ntkrnlmp)
|
|
|
|
for i in list(ctx.symbol_space['ntkrnlmp'].types):
|
|
symbol = ctx.symbol_space.get_type('ntkrnlmp!' + i)
|
|
print(symbol.vol.type_name, symbol, symbol.vol.size)
|
|
_ = symbol(ctx, objects.ObjectInformation(layer_name = '', offset = 0))
|
|
symbol = ctx.symbol_space.get_type('ntkrnlmp!_EPROCESS')
|
|
return symbol
|
|
|
|
|
|
def test_memory():
|
|
ctx = utils_load_as()
|
|
ctx.config["memtest.filename"] = 'trig_data.bin'
|
|
base = layers.physical.FileLayer(ctx, config_path = "memtest", name = 'physical')
|
|
ctx.memory.add_layer(base)
|
|
val = ctx.object('ntkrnlmp!TEST_POINTER', 'physical', 0)
|
|
print(hex(val.point1.test1), val.point1.test2)
|
|
|
|
|
|
def test_kdbgfind():
|
|
ctx = utils_load_as()
|
|
ctx.config["memtest.filename"] = '/run/media/mike/disk/memory/xp-laptop-2005-06-25.img'
|
|
base = layers.physical.FileLayer(ctx, config_path = "memtest", name = 'physical')
|
|
ctx.memory.add_layer(base)
|
|
ctx.config["memtest.memory_layer"] = 'physical'
|
|
ctx.config["memtest.page_map_offset"] = 0x39000
|
|
intel = layers.intel.Intel(ctx, config_path = "memtest", name = 'kernel')
|
|
ctx.memory.add_layer(intel)
|
|
|
|
|
|
def intel32(ctx):
|
|
ctx.config["memtest.filename"] = '/run/media/mike/disk/memory/xp-laptop-2005-06-25.img'
|
|
base = layers.physical.FileLayer(ctx, config_path = "memtest", name = 'physical')
|
|
ctx.memory.add_layer(base)
|
|
ctx.config["memtest.memory_layer"] = 'physical'
|
|
ctx.config["memtest.page_map_offset"] = 0x39000
|
|
intel = layers.intel.Intel(ctx, config_path = "memtest", name = 'kernel')
|
|
x = [0x823c87c0, 0x81fdf020, 0x81f5a3b8, 0x81f8eb10, 0x820e0da0, 0x82199668, 0x81fa5aa0, 0x81fa8650, 0x81faba78,
|
|
0x81fa8240, 0x81f8dda0, 0x81f6e7e8, 0x81f9a670, 0x81f5f020, 0x8202bda0, 0x82113c48, 0x81f67500, 0x81f6ca90,
|
|
0x820dd588, 0x82025608, 0x81faf280, 0x821125d0, 0x82076558, 0x81f68518, 0x82059da0, 0x81f6db28, 0x82021a78,
|
|
0x81f48da0, 0x820238e0, 0x82081da0, 0x821ca3d0, 0x821ce4d8, 0x821d4da0, 0x81343790, 0xffab8020, 0x8205eda0,
|
|
0xffaa0c10, 0x82218020, 0x814b13b0, 0x81ed76b0, 0x81f269e0, 0xffadc9d0, 0x821fb3b8, 0x82079c18, 0x82000980,
|
|
0x822148f0, 0x81ed84e8]
|
|
return intel, x
|
|
|
|
|
|
def intelpae(ctx):
|
|
ctx.config["memtest.filename"] = '/run/media/mike/disk/memory/private/jon-fres.dmp'
|
|
base = layers.physical.FileLayer(ctx, config_path = "memtest", name = 'physical')
|
|
ctx.memory.add_layer(base)
|
|
ctx.config["memtest.memory_layer"] = 'physical'
|
|
ctx.config["memtest.page_map_offset"] = 0x319000
|
|
intel = layers.intel.IntelPAE(ctx, config_path = "memtest", name = 'intel')
|
|
x = [0x81bcc830, 0x81989940, 0x81915020, 0x8192ad18, 0x818fa7b8, 0x818f6da0, 0x818d1020, 0x818b2878, 0x8189f180,
|
|
0x8188db58, 0x81884a40, 0x818766b0, 0x8185a948, 0x8183ad70, 0x81826020, 0x818a64c8, 0x81818020, 0x81800020,
|
|
0x817ff460, 0x817eb020, 0x817e9020, 0x817a62a8, 0x817a4b28, 0x81865020, 0x817972c0]
|
|
return intel, x
|
|
|
|
|
|
def intel32e(ctx):
|
|
ctx.config["memtest.filename"] = '/run/media/mike/disk/memory/private/ikelos-winxpsp2-x64.dmp'
|
|
base = layers.physical.FileLayer(ctx, config_path = "memtest", name = 'data')
|
|
ctx.memory.add_layer(base)
|
|
ctx.config["memtest.memory_layer"] = 'data'
|
|
ctx.config["memtest.page_map_offset"] = 0x3c3000
|
|
intel = layers.intel.Intel32e(ctx, config_path = "memtest", name = 'kernel')
|
|
x = [0xfffffadffa517c20, 0xfffffadffa2c9510, 0xfffffadffb16a660, 0xfffffadff9d77c20, 0xfffffadffb0fe040,
|
|
0xfffffadffb0f2040, 0xfffffadffb0c2040, 0xfffffadffb0b7c20, 0xfffffadffb087c20, 0xfffffadffb06a760,
|
|
0xfffffadffb039c20, 0xfffffadffb02c040, 0xfffffadffafe9c20, 0xfffffadffafa7040, 0xfffffadffaf2e040,
|
|
0xfffffadffaf279a0, 0xfffffadffaf24600, 0xfffffadffaed3040, 0xfffffadffaecf040, 0xfffffadffaeb35a0,
|
|
0xfffffadffae747b0, 0xfffffadffae30040, 0xfffffadffae2b040, 0xfffffadffae1d8b0, 0xfffffadffae1a040,
|
|
0xfffffadffae34810]
|
|
return intel, x
|
|
|
|
|
|
def test_translation():
|
|
nativelst = native.x86NativeTable
|
|
ctx = contexts.Context(nativelst)
|
|
intel, x = intel32(ctx)
|
|
|
|
base = layers.physical.BufferDataLayer(ctx, config_path = "memtest", name = 'base', buffer = b" ")
|
|
|
|
print(base.is_valid(0), base.is_valid(0) == True)
|
|
print(base.is_valid(1), base.is_valid(1) == False)
|
|
print(base.is_valid(0, 2), base.is_valid(0, 2) == False)
|
|
|
|
for val in x:
|
|
a, b = intel._translate(val)
|
|
print(hex(val), hex(a), hex(b))
|
|
# print(bin(0x39000), bin(0xffab8020))
|
|
# print(hex(intel.mapping(0xffab8020, 0)))
|
|
|
|
|
|
def test_plugin():
|
|
ctx = utils_load_as()
|
|
ctx.config["memtest.filename"] = '/run/media/mike/disk/memory/xp-laptop-2005-06-25.img'
|
|
base = layers.physical.FileLayer(ctx, config_path = "memtest", name = 'physical')
|
|
ctx.memory.add_layer(base)
|
|
ctx.config["memtest.memory_layer"] = 'physical'
|
|
ctx.config["memtest.page_map_offset"] = 0x39000
|
|
intel = layers.intel.Intel(ctx, config_path = "memtest", name = 'kernel')
|
|
ctx.memory.add_layer(intel)
|
|
|
|
import volatility.plugins.windows.pslist as pslist
|
|
|
|
# _ETHREAD physical offset for System process of xp-laptop-2005-06-25
|
|
eproc = pslist.PsList.kernel_process_from_physical_process(ctx, 'physical', 'kernel', 0x23c87c0)
|
|
for proc in eproc.ActiveProcessLinks:
|
|
print(proc.UniqueProcessId)
|
|
|
|
|
|
# TODO:
|
|
#
|
|
# X - Config system
|
|
# X - Dataout Tree/List input/output
|
|
# - Plugins taking TranslationLayers
|
|
# - Plugins
|
|
# - Architectures
|
|
# - Scanning Framework
|
|
# - GUI/UI
|
|
#
|
|
|
|
if __name__ == '__main__':
|
|
logger = logging.getLogger()
|
|
logger.setLevel(logging.DEBUG)
|
|
framework.import_files(volatility.plugins)
|
|
# import timeit
|
|
# print(timeit.Timer(main).timeit(10))
|
|
try:
|
|
print("[!] Testing Symbols")
|
|
test_symbols()
|
|
print("[!] Testing Memory")
|
|
test_memory()
|
|
print("[!] Testing Intel Translations")
|
|
test_translation()
|
|
print("[!] Testing Plugin")
|
|
test_plugin()
|
|
except Exception as e:
|
|
print(repr(e))
|
|
pdb.post_mortem()
|