mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-08-28 18:59:44 +02:00
102 lines
4.3 KiB
Python
102 lines
4.3 KiB
Python
'''
|
|
Created on 10 Mar 2013
|
|
|
|
@author: mike
|
|
'''
|
|
|
|
import pdb
|
|
from volatility import framework
|
|
from volatility.framework import xp_sp2_x86_vtypes, layers
|
|
from volatility.framework.symbols import vtypes, native
|
|
|
|
def test_symbols():
|
|
nativelst = native.x86NativeTable
|
|
|
|
virtual_types = xp_sp2_x86_vtypes.ntkrnlmp_types
|
|
|
|
ntkrnlmp = vtypes.VTypeSymbolTable('ntkrnlmp', virtual_types, nativelst)
|
|
|
|
ctx = framework.Context(nativelst)
|
|
# ctx.symbol_space.append(nativelst)
|
|
ctx.symbol_space.append(ntkrnlmp)
|
|
print("Symbols,", nativelst.symbols)
|
|
|
|
for i in list(ntkrnlmp.symbols):
|
|
symbol = ctx.symbol_space.resolve('ntkrnlmp!' + i)
|
|
print(symbol.symbol_name, symbol, symbol.size)
|
|
_objthing = symbol(ctx, layer_name = '', offset = 0)
|
|
symbol = ctx.symbol_space.resolve('ntkrnlmp!_EPROCESS')
|
|
|
|
def test_memory():
|
|
nativelst = native.x86NativeTable
|
|
virtual_types = xp_sp2_x86_vtypes.ntkrnlmp_types
|
|
virtual_types['TEST_POINTER'] = [0x4,
|
|
{'point1': [0x0, ['pointer', ['TEST_SYMBOL']]]
|
|
}]
|
|
virtual_types['TEST_SYMBOL'] = [0x6,
|
|
{'test1': [0x0, ['unsigned int']],
|
|
'test2': [0x4, ['unsigned short']]
|
|
}]
|
|
ntkrnlmp = vtypes.VTypeSymbolTable('ntkrnlmp', virtual_types, nativelst)
|
|
|
|
ctx = framework.Context(nativelst)
|
|
ctx.symbol_space.append(ntkrnlmp)
|
|
|
|
base = layers.physical.FileLayer(ctx, 'data', filename = 'trig_data.bin')
|
|
ctx.memory.add_layer(base)
|
|
val = ctx.object('ntkrnlmp!TEST_POINTER', 'data', 0)
|
|
print(hex(val.point1.test1), val.point1.test2)
|
|
|
|
def intel32(ctx):
|
|
base = layers.physical.FileLayer(ctx, 'data', filename = '/home/mike/memory/xp-laptop-2005-06-25.img')
|
|
ctx.memory.add_layer(base)
|
|
intel = layers.intel.Intel(ctx, 'intel', 'data', page_map_offset = 0x39000)
|
|
x = [0x823c87c0, 0x81fdf020, 0x81f5a3b8, 0x81f8eb10, 0x820e0da0, 0x82199668, 0x81fa5aa0, 0x81fa8650, 0x81faba78, 0x81fa8240, 0x81f8dda0, 0x81f6e7e8, 0x81f9a670, 0x81f5f020, 0x8202bda0, 0x82113c48, 0x81f67500, 0x81f6ca90, 0x820dd588, 0x82025608, 0x81faf280, 0x821125d0, 0x82076558, 0x81f68518, 0x82059da0, 0x81f6db28, 0x82021a78, 0x81f48da0, 0x820238e0, 0x82081da0, 0x821ca3d0, 0x821ce4d8, 0x821d4da0, 0x81343790, 0xffab8020, 0x8205eda0, 0xffaa0c10, 0x82218020, 0x814b13b0, 0x81ed76b0, 0x81f269e0, 0xffadc9d0, 0x821fb3b8, 0x82079c18, 0x82000980, 0x822148f0, 0x81ed84e8]
|
|
return intel, x
|
|
|
|
def intelpae(ctx):
|
|
base = layers.physical.FileLayer(ctx, 'data', filename = '/home/mike/memory/private/jon-fres.dmp')
|
|
ctx.memory.add_layer(base)
|
|
intel = layers.intel.IntelPAE(ctx, 'intel', 'data', page_map_offset = 0x319000)
|
|
x = [0x81bcc830, 0x81989940, 0x81915020, 0x8192ad18, 0x818fa7b8, 0x818f6da0, 0x818d1020, 0x818b2878, 0x8189f180, 0x8188db58, 0x81884a40, 0x818766b0, 0x8185a948, 0x8183ad70, 0x81826020, 0x818a64c8, 0x81818020, 0x81800020, 0x817ff460, 0x817eb020, 0x817e9020, 0x817a62a8, 0x817a4b28, 0x81865020, 0x817972c0]
|
|
return intel, x
|
|
|
|
def intel32e(ctx):
|
|
base = layers.physical.FileLayer(ctx, 'data', filename = '/home/mike/memory/private/ikelos-winxpsp2-x64.dmp')
|
|
ctx.memory.add_layer(base)
|
|
intel = layers.intel.Intel32e(ctx, 'intel', 'data', page_map_offset = 0x3c3000)
|
|
x = [0xfffffadffa517c20, 0xfffffadffa2c9510, 0xfffffadffb16a660, 0xfffffadff9d77c20, 0xfffffadffb0fe040, 0xfffffadffb0f2040, 0xfffffadffb0c2040, 0xfffffadffb0b7c20, 0xfffffadffb087c20, 0xfffffadffb06a760, 0xfffffadffb039c20, 0xfffffadffb02c040, 0xfffffadffafe9c20, 0xfffffadffafa7040, 0xfffffadffaf2e040, 0xfffffadffaf279a0, 0xfffffadffaf24600, 0xfffffadffaed3040, 0xfffffadffaecf040, 0xfffffadffaeb35a0, 0xfffffadffae747b0, 0xfffffadffae30040, 0xfffffadffae2b040, 0xfffffadffae1d8b0, 0xfffffadffae1a040, 0xfffffadffae34810]
|
|
return intel, x
|
|
|
|
|
|
def test_translation():
|
|
nativelst = native.x86NativeTable
|
|
ctx = framework.Context(nativelst)
|
|
intel, x = intel32e(ctx)
|
|
|
|
for val in x:
|
|
print(hex(val), hex(intel.translate(val)))
|
|
#print(bin(0x39000), bin(0xffab8020))
|
|
#print(hex(intel.translate(0xffab8020)))
|
|
|
|
|
|
# TODO:
|
|
#
|
|
# Config system
|
|
# Plugins - Dataout Tree/List input/output
|
|
# Architectures
|
|
# Scanning Framework
|
|
# GUI/UI
|
|
#
|
|
|
|
if __name__ == '__main__':
|
|
# import timeit
|
|
# print(timeit.Timer(main).timeit(10))
|
|
try:
|
|
# test_symbols()
|
|
# test_memory()
|
|
test_translation()
|
|
except Exception as e:
|
|
print(repr(e))
|
|
pdb.post_mortem()
|