mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-08-23 06:42:21 +02:00
Mike Auty
9824538bd9
This includes: * Better ways of checking empty lists * Not shadowing builtin functions like filter * Preventing invalid slash warnings by marking strings as regexps * Removing unnecessary brackets * Lowercase variable names * Adding/updating parameters in docstrings * Removing unused code (lines not chunks) * Change in not a member tests * Changing some methods to static * Shorting range membership checks * Missing parameters * Make some exception handlers more specific * Don't define a lambda to a variable * A few more instance checks to help type checkers
140 lines
6.4 KiB
Python
140 lines
6.4 KiB
Python
import time
|
|
from typing import List
|
|
|
|
import volatility.framework.interfaces.plugins as plugins
|
|
from volatility.framework import constants, interfaces, layers
|
|
from volatility.framework.configuration import requirements
|
|
from volatility.framework.renderers import TreeGrid
|
|
from volatility.framework.symbols.windows.kdbg import KdbgIntermedSymbols
|
|
from volatility.framework.symbols.windows.pe import PEIntermedSymbols
|
|
|
|
|
|
class Info(plugins.PluginInterface):
|
|
"""Show OS & kernel details of the memory sample being analyzed"""
|
|
|
|
@classmethod
|
|
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
|
|
return [requirements.TranslationLayerRequirement(name = 'primary',
|
|
description = 'Kernel Address Space',
|
|
architectures = ["Intel32", "Intel64"]),
|
|
requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS")]
|
|
|
|
def get_depends(self, layer_name: str, index: int = 0):
|
|
"""List the dependencies of a given layer.
|
|
|
|
Args:
|
|
layer_name: the name of the starting layer
|
|
index: the index/order of the layer
|
|
"""
|
|
layer = self.context.memory[layer_name]
|
|
yield index, layer
|
|
try:
|
|
for depends in layer.dependencies:
|
|
for j, dep in self.get_depends(depends, index + 1):
|
|
yield j, self.context.memory[dep.name]
|
|
except AttributeError:
|
|
# FileLayer won't have dependencies
|
|
pass
|
|
|
|
def _generator(self):
|
|
|
|
virtual_layer_name = self.config["primary"]
|
|
virtual_layer = self.context.memory[virtual_layer_name]
|
|
if not isinstance(virtual_layer, layers.intel.Intel):
|
|
raise TypeError("Virtual Layer is not an intel layer")
|
|
|
|
native_types = self.context.symbol_space[self.config["nt_symbols"]].natives
|
|
|
|
kdbg_table_name = KdbgIntermedSymbols.create(self.context,
|
|
self.config_path,
|
|
"windows",
|
|
"kdbg",
|
|
native_types = native_types)
|
|
|
|
pe_table_name = PEIntermedSymbols.create(self.context,
|
|
self.config_path,
|
|
"windows",
|
|
"pe")
|
|
|
|
kvo = virtual_layer.config["kernel_virtual_offset"]
|
|
|
|
ntkrnlmp = self.context.module(self.config["nt_symbols"],
|
|
layer_name = virtual_layer_name, offset = kvo)
|
|
|
|
kdbg_offset = ntkrnlmp.get_symbol("KdDebuggerDataBlock").address
|
|
|
|
kdbg = self.context.object(kdbg_table_name + constants.BANG +
|
|
"_KDDEBUGGER_DATA64", offset = kvo + kdbg_offset,
|
|
layer_name = virtual_layer_name)
|
|
|
|
yield (0, ("Memory Location", self.config["primary.memory_layer.location"]))
|
|
yield (0, ("Kernel Base", hex(self.config["primary.kernel_virtual_offset"])))
|
|
yield (0, ("DTB", hex(self.config["primary.page_map_offset"])))
|
|
yield (0, ("Symbols", self.config["nt_symbols.isf_url"]))
|
|
|
|
for i, layer in self.get_depends("primary"):
|
|
yield (0, (layer.name, "{} {}".format(i, layer.__class__.__name__)))
|
|
|
|
if kdbg.Header.OwnerTag == 0x4742444B:
|
|
|
|
yield (0, ("KdDebuggerDataBlock", hex(kdbg.vol.offset)))
|
|
yield (0, ("NTBuildLab", kdbg.get_build_lab()))
|
|
yield (0, ("CSDVersion", str(kdbg.get_csdversion())))
|
|
|
|
vers_offset = ntkrnlmp.get_symbol("KdVersionBlock").address
|
|
|
|
vers = ntkrnlmp.object(type_name = "_DBGKD_GET_VERSION64",
|
|
layer_name = virtual_layer_name,
|
|
offset = kvo + vers_offset)
|
|
|
|
yield (0, ("KdVersionBlock", hex(vers.vol.offset)))
|
|
yield (0, ("Major/Minor", "{0}.{1}".format(vers.MajorVersion, vers.MinorVersion)))
|
|
yield (0, ("MachineType", str(vers.MachineType)))
|
|
|
|
cpu_count_offset = ntkrnlmp.get_symbol("KeNumberProcessors").address
|
|
|
|
cpu_count = ntkrnlmp.object(type_name = "unsigned int",
|
|
layer_name = virtual_layer_name,
|
|
offset = kvo + cpu_count_offset)
|
|
|
|
yield (0, ("KeNumberProcessors", str(cpu_count)))
|
|
|
|
# this is a hard-coded address in the Windows OS
|
|
if virtual_layer.bits_per_register == 32:
|
|
kuser_addr = 0xFFDF0000
|
|
else:
|
|
kuser_addr = 0xFFFFF78000000000
|
|
|
|
kuser = ntkrnlmp.object(type_name = "_KUSER_SHARED_DATA",
|
|
layer_name = virtual_layer_name,
|
|
offset = kuser_addr)
|
|
|
|
yield (0, ("SystemTime", str(kuser.SystemTime.get_time())))
|
|
yield (0, ("NtSystemRoot", str(kuser.NtSystemRoot.cast("string",
|
|
encoding = "utf-16",
|
|
errors = "replace",
|
|
max_length = 260))))
|
|
yield (0, ("NtProductType", str(kuser.NtProductType.description)))
|
|
yield (0, ("NtMajorVersion", str(kuser.NtMajorVersion)))
|
|
yield (0, ("NtMinorVersion", str(kuser.NtMinorVersion)))
|
|
# yield (0, ("KdDebuggerEnabled", "True" if ord(kuser.KdDebuggerEnabled) else "False"))
|
|
# yield (0, ("SafeBootMode", "True" if ord(kuser.SafeBootMode) else "False"))
|
|
|
|
dos_header = self.context.object(pe_table_name + constants.BANG +
|
|
"_IMAGE_DOS_HEADER", offset = kvo,
|
|
layer_name = virtual_layer_name)
|
|
|
|
nt_header = dos_header.get_nt_header()
|
|
|
|
yield (0, ("PE MajorOperatingSystemVersion", str(nt_header.OptionalHeader.MajorOperatingSystemVersion)))
|
|
yield (0, ("PE MinorOperatingSystemVersion", str(nt_header.OptionalHeader.MinorOperatingSystemVersion)))
|
|
|
|
yield (0, ("PE Machine", str(nt_header.FileHeader.Machine)))
|
|
yield (0, ("PE TimeDateStamp", time.asctime(time.gmtime(nt_header.FileHeader.TimeDateStamp))))
|
|
|
|
def run(self):
|
|
|
|
return TreeGrid([("Variable", str),
|
|
("Value", str)],
|
|
self._generator())
|