diff --git a/CREDITS.txt b/CREDITS.txt
index 46714be5d..979215704 100644
--- a/CREDITS.txt
+++ b/CREDITS.txt
@@ -106,6 +106,7 @@ Jon Evans
Robert Guess
Christian Herndler
jeremie0
+Jamie Levy
Eugene Libster
Erik Ligda
Robert Lowe
diff --git a/README.txt b/README.txt
index 7fcc6262b..c7a0f196a 100644
--- a/README.txt
+++ b/README.txt
@@ -1,3 +1,5 @@
+This project is archived. See Volatility 3 for modern investigations: https://github.com/volatilityfoundation/volatility3
+
============================================================================
Volatility Framework - Volatile memory extraction utility framework
============================================================================
@@ -36,8 +38,8 @@ Windows:
* 64-bit Windows 7 Service Pack 0 and 1
* 64-bit Windows 8, 8.1, and 8.1 Update 1
* 64-bit Windows Server 2012 and 2012 R2
-* 64-bit Windows 10 (including at least 10.0.14393)
-* 64-bit Windows Server 2016 (including at least 10.0.14393.0)
+* 64-bit Windows 10 (including at least 10.0.19041)
+* 64-bit Windows Server 2016 (including at least 10.0.19041)
Note: Please see the guidelines at the following link for notes on
compatibility with recently patched Windows 7 (or later) memory samples:
@@ -45,8 +47,8 @@ compatibility with recently patched Windows 7 (or later) memory samples:
https://github.com/volatilityfoundation/volatility/wiki/2.6-Win-Profiles
Linux:
-* 32-bit Linux kernels 2.6.11 to 4.2.3
-* 64-bit Linux kernels 2.6.11 to 4.2.3
+* 32-bit Linux kernels 2.6.11 to 5.5
+* 64-bit Linux kernels 2.6.11 to 5.5
* OpenSuSE, Ubuntu, Debian, CentOS, Fedora, Mandriva, etc
Mac OSX:
@@ -60,6 +62,9 @@ Mac OSX:
* 64-bit 10.10.x Yosemite (there is no 32-bit version)
* 64-bit 10.11.x El Capitan (there is no 32-bit version)
* 64-bit 10.12.x Sierra (there is no 32-bit version)
+* 64-bit 10.13.x High Sierra (there is no 32-bit version))
+* 64-bit 10.14.x Mojave (there is no 32-bit version)
+* 64-bit 10.15.x Catalina (there is no 32-bit version)
Volatility does not provide memory sample acquisition
capabilities. For acquisition, there are both free and commercial
diff --git a/contrib/plugins/README.md b/contrib/plugins/README.md
new file mode 100644
index 000000000..8ece0a8d0
--- /dev/null
+++ b/contrib/plugins/README.md
@@ -0,0 +1 @@
+Plugins in this directory have moved. Please see the github.com/volatilityfoundation/community repository.
diff --git a/contrib/plugins/aspaces/README.md b/contrib/plugins/aspaces/README.md
new file mode 100644
index 000000000..8ece0a8d0
--- /dev/null
+++ b/contrib/plugins/aspaces/README.md
@@ -0,0 +1 @@
+Plugins in this directory have moved. Please see the github.com/volatilityfoundation/community repository.
diff --git a/contrib/plugins/aspaces/__init__.py b/contrib/plugins/aspaces/__init__.py
deleted file mode 100644
index e69de29bb..000000000
diff --git a/contrib/plugins/aspaces/ewf.py b/contrib/plugins/aspaces/ewf.py
deleted file mode 100644
index 0364d3099..000000000
--- a/contrib/plugins/aspaces/ewf.py
+++ /dev/null
@@ -1,107 +0,0 @@
-""" This Address Space allows us to open ewf files """
-
-#pylint: disable-msg=C0111
-
-from ctypes import CDLL, c_char_p, c_int, pointer, c_ulonglong, c_ulong, create_string_buffer
-import ctypes.util
-import volatility.plugins.addrspaces.standard as standard
-
-possible_names = ['libewf-1', 'ewf', ]
-for name in possible_names:
- resolved = ctypes.util.find_library(name)
- if resolved:
- break
-
-if resolved:
- libewf = CDLL(resolved)
-
-if not resolved or not libewf._name:
- libewf = None
-
-class ewffile(object):
- """ A file like object to provide access to the ewf file """
- def __init__(self, volumes):
- if isinstance(volumes, str):
- volumes = [volumes, ]
-
- volume_array = c_char_p * len(volumes)
- self.handle = libewf.libewf_open(volume_array(*volumes), c_int(len(volumes)),
- c_int(1))
- if self.handle == 0:
- raise RuntimeError("Unable to open ewf file")
-
- self.readptr = 0
- size_p = pointer(c_ulonglong(0))
- libewf.libewf_get_media_size(self.handle, size_p)
- self.size = size_p.contents.value
-
- def seek(self, offset, whence = 0):
- if whence == 0:
- self.readptr = offset
- elif whence == 1:
- self.readptr += offset
- elif whence == 2:
- self.readptr = self.size + offset
-
- self.readptr = min(self.readptr, self.size)
-
- def tell(self):
- return self.readptr
-
- def read(self, length):
- buf = create_string_buffer(length)
- length = libewf.libewf_read_random(self.handle, buf,
- c_ulong(length),
- c_ulonglong(self.readptr))
-
- return buf.raw[:length]
-
- def close(self):
- libewf.libewf_close(self.handle)
-
- def get_headers(self):
- properties = ["case_number", "description", "examinier_name",
- "evidence_number", "notes", "acquiry_date",
- "system_date", "acquiry_operating_system",
- "acquiry_software_version", "password",
- "compression_type", "model", "serial_number", ]
-
- ## Make sure we parsed all headers
- libewf.libewf_parse_header_values(self.handle, c_int(4))
- result = {'size': self.size}
- buf = create_string_buffer(1024)
- for p in properties:
- libewf.libewf_get_header_value(self.handle, p, buf, 1024)
- result[p] = buf.value
-
- ## Get the hash
- if libewf.libewf_get_md5_hash(self.handle, buf, 16) == 1:
- result['md5'] = buf.raw[:16]
-
- return result
-
-def ewf_open(volumes):
- return ewffile(volumes)
-
-class EWFAddressSpace(standard.FileAddressSpace):
- """ An EWF capable address space.
-
- In order for us to work we need:
- 1) There must be a base AS.
- 2) The first 6 bytes must be 45 56 46 09 0D 0A (EVF header)
- """
- order = 20
- def __init__(self, base, config, **kwargs):
- self.as_assert(libewf, "No libEWF implementation found")
- standard.FileAddressSpace.__init__(self, base, config, layered = True)
- self.as_assert(base, "No base address space provided")
- self.as_assert(base.read(0, 6) == "\x45\x56\x46\x09\x0D\x0A", "EWF signature not present")
- self.fhandle = ewf_open([self.name])
- self.fhandle.seek(0, 2)
- self.fsize = self.fhandle.tell()
- self.fhandle.seek(0)
-
- def write(self, _addr, _buf):
- if not self._config.WRITE:
- return False
- raise NotImplementedError("Write support is not yet implemented for EWF files")
diff --git a/contrib/plugins/enumfunc.py b/contrib/plugins/enumfunc.py
deleted file mode 100644
index 79c8a4a18..000000000
--- a/contrib/plugins/enumfunc.py
+++ /dev/null
@@ -1,95 +0,0 @@
-# Volatility
-# Copyright (c) 2012 Michael Ligh (michael.ligh@mnin.org)
-#
-# This file is part of Volatility.
-#
-# Volatility is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Volatility is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Volatility. If not, see .
-#
-
-import volatility.plugins.taskmods as taskmods
-import volatility.utils as utils
-import volatility.win32.tasks as tasks
-import volatility.win32.modules as modules
-import volatility.plugins.filescan as filescan
-import volatility.plugins.modscan as modscan
-
-class EnumFunc(taskmods.DllList):
- """Enumerate imported/exported functions"""
-
- def __init__(self, config, *args, **kwargs):
- taskmods.DllList.__init__(self, config, *args, **kwargs)
- config.remove_option("PID")
- config.remove_option("OFFSET")
- config.add_option("SCAN", short_option = 's', default = False,
- action = 'store_true', help = 'Scan for objects')
- config.add_option("PROCESS-ONLY", short_option = 'P', default = False,
- action = 'store_true', help = 'Process only')
- config.add_option("KERNEL-ONLY", short_option = 'K', default = False,
- action = 'store_true', help = 'Kernel only')
- config.add_option("IMPORT-ONLY", short_option = 'I', default = False,
- action = 'store_true', help = 'Imports only')
- config.add_option("EXPORT-ONLY", short_option = 'E', default = False,
- action = 'store_true', help = 'Exports only')
-
- def calculate(self):
- addr_space = utils.load_as(self._config)
-
- tasklist = []
- modslist = []
-
- if self._config.SCAN:
- if not self._config.KERNEL_ONLY:
- for t in filescan.PSScan(self._config).calculate():
- v = self.virtual_process_from_physical_offset(addr_space, t.obj_offset)
- if v:
- tasklist.append(v)
- if not self._config.PROCESS_ONLY:
- modslist = [m for m in modscan.ModScan(self._config).calculate()]
- else:
- if not self._config.KERNEL_ONLY:
- tasklist = [t for t in tasks.pslist(addr_space)]
- if not self._config.PROCESS_ONLY:
- modslist = [m for m in modules.lsmod(addr_space)]
-
- for task in tasklist:
- for mod in task.get_load_modules():
- yield task, mod
-
- for mod in modslist:
- yield None, mod
-
- def render_text(self, outfd, data):
-
- outfd.write("{0:<20} {1:<10} {2:<20} {3:<10} {4:<20} {5}\n".format(
- "Process", "Type", "Module", "Ordinal", "Address", "Name"))
-
- for process, module in data:
- if not self._config.IMPORT_ONLY:
- for o, f, n in module.exports():
- outfd.write("{0:<20} {1:<10} {2:<20} {3:<10} {4:#018x} {5}\n".format(
- process.ImageFileName if process else "",
- "Export", module.BaseDllName,
- o,
- (module.DllBase + f) if f else 0, # None if forwarded
- n or '' # None if paged
- ))
- if not self._config.EXPORT_ONLY:
- for dll, o, f, n in module.imports():
- outfd.write("{0:<20} {1:<10} {2:<20} {3:<10} {4:#018x} {5}\n".format(
- process.ImageFileName if process else "",
- "Import", module.BaseDllName,
- o,
- f or 0, # None if paged
- dll + "!" + n or '' # None if paged or imported by ordinal
- ))
diff --git a/contrib/plugins/malware/README.md b/contrib/plugins/malware/README.md
new file mode 100644
index 000000000..8ece0a8d0
--- /dev/null
+++ b/contrib/plugins/malware/README.md
@@ -0,0 +1 @@
+Plugins in this directory have moved. Please see the github.com/volatilityfoundation/community repository.
diff --git a/contrib/plugins/malware/__init__.py b/contrib/plugins/malware/__init__.py
deleted file mode 100644
index e69de29bb..000000000
diff --git a/contrib/plugins/malware/poisonivy.py b/contrib/plugins/malware/poisonivy.py
deleted file mode 100644
index 16fffb579..000000000
--- a/contrib/plugins/malware/poisonivy.py
+++ /dev/null
@@ -1,396 +0,0 @@
-# Poison Ivy RAT detection and analysis for Volatility 2.0
-#
-# Version 1.0 (for release at the FIRST Conference, June 18, 2012)
-#
-# This version is limited to PoisonIvy's server version 2.3.1
-#
-# Author: Andreas Schuster
-#
-# This plugin is based on zeusscan2.py by Michael Hale Ligh.
-#
-# This file is part of Volatility.
-#
-# Volatility is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Volatility is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Volatility. If not, see .
-#
-
-import volatility.plugins.taskmods as taskmods
-import volatility.obj as obj
-import volatility.win32.tasks as tasks
-import volatility.utils as utils
-import volatility.debug as debug
-import volatility.plugins.malware.malfind as malfind
-
-try:
- import yara
- has_yara = True
-except ImportError:
- has_yara = False
-
-class PIHOST(obj.CType):
- """Class for Poison Ivy Host/Proxy"""
-
- def next(self):
- """The next variable-length structure in the array"""
-
- return obj.Object("PIHOST",
- offset = self.obj_offset + self.length +
- self.obj_vm.profile.get_obj_size("PIHOST"),
- vm = self.obj_vm)
-
-class PICONFIG(obj.CType):
- """Class for Poison Ivy Configuration Block"""
-
- def _read_hosts(self, memb):
- """Parse C2 or proxy config from data block"""
-
- # The first object in the array
- host = obj.Object("PIHOST", offset = memb.obj_offset, vm = self.obj_vm)
- # The number of objects shall not exceed
- # the total size of the array
- size = self.obj_vm.profile.get_obj_size("HOSTCFGSPACE")
-
- while (host.length > 0 and
- host.obj_offset < memb.obj_offset + size):
- yield host
- host = host.next()
-
- def get_hosts(self):
- """Return the list of C2 hosts"""
-
- if self.ProxyCfgPresent == 1:
- return self._read_hosts(self.C2WhenProxy)
- else:
- return self._read_hosts(self.NextHop)
-
- def get_proxies(self):
- """Return the list of proxies"""
-
- if self.ProxyCfgPresent == 1:
- return self._read_hosts(self.NextHop)
- else:
- raise StopIteration
-
- @property
- def CopyDestFile(self):
- """Return the destination directory and file name"""
-
- destination = ''
- if self.CopyDestDir == 1:
- destination = '%WINDIR%'
- elif self.CopyDestDir == 2:
- destination = '%WINDIR%\\System32'
-
- if self.CopyAsADS == 1:
- destination += ':'
- else:
- destination += '\\'
-
- return destination + self.m('CopyDestFile')
-
-class PoisonIvyTypesx86(obj.ProfileModification):
- """Modification for Poison Ivy"""
-
- conditions = {'os': lambda x: x == 'windows',
- 'memory_model': lambda x: x == '32bit'}
-
- def modification(self, profile):
-
- profile.object_classes.update({'PIHOST': PIHOST, 'PICONFIG': PICONFIG})
-
- profile.vtypes.update({
- 'PIHOST': [ 4, { # minimum size based on the static fields
- 'length' : [ 0, ['unsigned char']],
- 'hostname' : [ 1, ['String', dict(length = lambda x : x.length)]],
- 'proto' : [ lambda x: x.obj_offset + 1 + x.length, ['Enumeration', dict(target = 'unsigned char', choices = {0: 'direct', 1: 'SOCKS', 2: 'HTTP'})]],
- 'port' : [ lambda x: x.obj_offset + 1 + x.length + 1, ['unsigned short']],
- }],
- 'HOSTCFGSPACE' : [ 256, {
- }],
- 'PICONFIG' : [ 0xf74, {
- 'imp_socket' : [ 0x001, ['unsigned int']],
- 'imp_connect' : [ 0x005, ['unsigned int']],
- 'imp_closesocket' : [ 0x009, ['unsigned int']],
- 'imp_send' : [ 0x00d, ['unsigned int']],
- 'imp_recv' : [ 0x011, ['unsigned int']],
- 'imp_htons' : [ 0x015, ['unsigned int']],
- 'imp_inet_addr' : [ 0x019, ['unsigned int']],
- 'imp_gethostbyname' : [ 0x01d, ['unsigned int']],
- 'imp_VirtualAlloc' : [ 0x021, ['unsigned int']],
- 'imp_VirtualFree' : [ 0x025, ['unsigned int']],
- 'imp_CreateThread' : [ 0x029, ['unsigned int']],
- 'imp_CreateProcessA' : [ 0x02d, ['unsigned int']],
- 'imp_RegCloseKey' : [ 0x031, ['unsigned int']],
- 'imp_RegOpenKeyExA' : [ 0x035, ['unsigned int']],
- 'imp_RegQueryValueExA' : [ 0x039, ['unsigned int']],
- 'imp_RegSetValueExA' : [ 0x03d, ['unsigned int']],
- 'imp_RegDeleteKeyA' : [ 0x041, ['unsigned int']],
- 'imp_RegCreateKeyExA' : [ 0x045, ['unsigned int']],
- 'imp_RegQueryInfoKeyA' : [ 0x049, ['unsigned int']],
- 'imp_RegEnumKeyExA' : [ 0x04d, ['unsigned int']],
- 'imp_DeleteFileA' : [ 0x051, ['unsigned int']],
- 'imp_CopyFileA' : [ 0x055, ['unsigned int']],
- 'imp_CreateFileA' : [ 0x059, ['unsigned int']],
- 'imp_GetKeyNameTextA' : [ 0x05d, ['unsigned int']],
- 'imp_GetActiveWindow' : [ 0x061, ['unsigned int']],
- 'imp_GetWindowTextA' : [ 0x065, ['unsigned int']],
- 'imp_WriteFile' : [ 0x069, ['unsigned int']],
- 'imp_CallNextHookEx' : [ 0x06d, ['unsigned int']],
- 'imp_SetFilePointer' : [ 0x071, ['unsigned int']],
- 'imp_ToAscii' : [ 0x075, ['unsigned int']],
- 'imp_GetKeyboardState' : [ 0x079, ['unsigned int']],
- 'imp_GetLocalTime' : [ 0x07d, ['unsigned int']],
- 'imp_lstrcat' : [ 0x081, ['unsigned int']],
- 'imp_CreateMutexA' : [ 0x085, ['unsigned int']],
- 'imp_RtlGetLastWin32Error' : [ 0x089, ['unsigned int']],
- 'imp_GetFileTime' : [ 0x08d, ['unsigned int']],
- 'imp_SetFileTime' : [ 0x091, ['unsigned int']],
- 'imp_OpenProcess' : [ 0x095, ['unsigned int']],
- 'imp_select' : [ 0x099, ['unsigned int']],
- 'imp_LoadLibraryA' : [ 0x09d, ['unsigned int']],
- 'imp_CloseHandle' : [ 0x0a1, ['unsigned int']],
- 'imp_Sleep' : [ 0x0a5, ['unsigned int']],
- 'imp_RtlMoveMemory' : [ 0x0a9, ['unsigned int']],
- 'imp_RtlZeroMemory' : [ 0x0ad, ['unsigned int']],
- 'imp_VirtualAllocEx' : [ 0x0b1, ['unsigned int']],
- 'imp_WriteProcessMemory' : [ 0x0b5, ['unsigned int']],
- 'imp_CreateToolhelp32Snapshot' : [ 0x0b9, ['unsigned int']],
- 'imp_Process32First' : [ 0x0bd, ['unsigned int']],
- 'imp_Process32Next' : [ 0x0c1, ['unsigned int']],
- 'func_FindProcess' : [ 0x0c5, ['unsigned int']],
- 'imp_CreateRemoteThread' : [ 0x0c9, ['unsigned int']],
- 'imp_lstrcmpi' : [ 0x0cd, ['unsigned int']],
- 'func_WriteProcess' : [ 0x0d1, ['unsigned int']],
- 'func_Extra' : [ 0x0d5, ['unsigned int']],
- 'func_Main' : [ 0x0d9, ['unsigned int']],
- 'func_GetProcAddressByCRC32' : [ 0x0dd, ['unsigned int']],
- 'NULL' : [ 0x0e1, ['unsigned int']],
- 'func_Send_Receive' : [ 0x0e5, ['unsigned int']],
- 'func_strcopy' : [ 0x0e9, ['unsigned int']],
- 'func_Keylogger_Hook' : [ 0x0ed, ['unsigned int']],
- 'func_0f1' : [ 0x0f1, ['unsigned int']],
- 'func_Persist_ActiveSetup' : [ 0x0f5, ['unsigned int']],
- 'func_Injector' : [ 0x0f9, ['unsigned int']],
- 'func_Key_expansion' : [ 0x0fd, ['unsigned int']],
- 'func_Encrypt' : [ 0x101, ['unsigned int']],
- 'func_Decrypt' : [ 0x105, ['unsigned int']],
- 'func_Camellia_feistel' : [ 0x109, ['unsigned int']],
- 'func_Camellia_local' : [ 0x10d, ['unsigned int']],
- 'var_Camellia_Sbox1' : [ 0x111, ['unsigned int']],
- 'var_Camellia_Table1' : [ 0x115, ['unsigned int']],
- 'var_Camellia_Table2' : [ 0x119, ['unsigned int']],
- 'var_Socket' : [ 0x121, ['unsigned int']],
- 'var_Version' : [ 0x129, ['unsigned int']],
- 'CopyDestFile' : [ 0x12d, ['String', dict(length = 24)]],
- 'Secret' : [ 0x145, ['String', dict(length = 32)]],
- 'PersistActiveSetupGUID' : [ 0x165, ['String', dict(length = 38)]],
- 'NextHop' : [ 0x190, ['HOSTCFGSPACE']],
- 'ProxyCfgPresent' : [ 0x2c1, ['int']],
- 'C2WhenProxy' : [ 0x2c5, ['HOSTCFGSPACE']],
- 'PersistActiveSetupOn' : [ 0x3f6, ['unsigned char']],
- 'CopyDestDir' : [ 0x3f7, ['unsigned char']],
- 'Melt' : [ 0x3f8, ['unsigned char']],
- 'InjectPersist' : [ 0x3f9, ['unsigned char']],
- 'Keylogger' : [ 0x3fa, ['unsigned char']],
- 'Mutex' : [ 0x3fb, ['String', dict(length = 20)]],
- 'PersistActiveSetupName' : [ 0x40f, ['String', dict(length = 9)]],
- 'DefaultBrowserKey' : [ 0x418, ['String', dict(length = 41)]],
- 'InjectIntoDefaultBrowser' : [ 0x441, ['unsigned char']],
- 'InjectIntoProcessName' : [ 0x442, ['String', dict(length = 20)]],
- 'PersistActiveSetupKeyPart' : [ 0x456, ['String', dict(length = 93)]],
- 'PersistActiveSetupKey' : [ 0x4b3, ['String', dict(length = 255)]],
- 'CurrentFile' : [ 0x5b2, ['String', dict(length = 255)]],
- 'PersistentFile' : [ 0x6b1, ['String', dict(length = 255)]],
- 'KeyloggerLogfile' : [ 0x7b0, ['String', dict(length = 255)]],
- 'IsAdmin' : [ 0x8af, ['unsigned char']],
- 'var_8b4' : [ 0x8b4, ['unsigned int']],
- 'var_8b8' : [ 0x8b8, ['unsigned char']],
- 'var_8b9' : [ 0x8b9, ['unsigned int']],
- 'KeyloggerTID' : [ 0x8bd, ['unsigned int']],
- 'InjectorTID' : [ 0x8c1, ['unsigned int']],
- 'hnd_Mutex' : [ 0x8c5, ['unsigned int']],
- 'Challenge' : [ 0x8d9, ['array', 136, ['unsigned char']]],
- 'var_Camellia_Keyschedule' : [ 0x96b, ['array', 272, ['unsigned char']]],
- 'hnd_Kernel32' : [ 0xabb, ['unsigned int']],
- 'hnd_User32' : [ 0xabf, ['unsigned int']],
- 'hnd_Ws2_32' : [ 0xac3, ['unsigned int']],
- 'hnd_Advapi32' : [ 0xad3, ['unsigned int']],
- 'hnd_Ntdll' : [ 0xadb, ['unsigned int']],
- 'imp_lstrlenA' : [ 0xaf0, ['unsigned int']],
- 'UseProxy' : [ 0xaf4, ['unsigned char']],
- 'ProxyNoPersist' : [ 0xaf5, ['unsigned char']],
- 'func_af6' : [ 0xaf6, ['unsigned int']],
- 'ServerId' : [ 0xafa, ['String', dict(length = 255)]],
- 'ServerGroup' : [ 0xbf9, ['String', dict(length = 255)]],
- 'imp_GetFileSize' : [ 0xcf8, ['unsigned int']],
- 'imp_ReadFile' : [ 0xcfc, ['unsigned int']],
- 'func_CopyFile' : [ 0xd00, ['unsigned int']],
- 'func_Inject_explorer' : [ 0xd04, ['unsigned int']],
- 'Inject' : [ 0xd08, ['unsigned char']],
- 'PersistHKLMRun' : [ 0xd09, ['unsigned char']],
- 'func_Persist_HKLMRun' : [ 0xd0a, ['unsigned int']],
- 'func_Keylogger' : [ 0xd0e, ['unsigned int']],
- 'CopyAsADS' : [ 0xd12, ['unsigned char']],
- 'PersistHKLMRunName' : [ 0xe12, ['String', dict(length = 255)]]
- }]
- })
-
-# This simple signature is based on string constants. It it easy to find, easy
-# to explain - and easy to break! Therefore you're advised to develop robust,
-# code based signatures for daily work.
-signatures = {
- 'namespace1' : 'rule pivars {strings: $a = { \
- 53 74 75 62 50 61 74 68 ?? 53 4F 46 54 57 41 52\
- 45 5C 43 6C 61 73 73 65 73 5C 68 74 74 70 5C 73\
- 68 65 6C 6C 5C 6F 70 65 6E 5C 63 6F 6D 6D 61 6E\
- 64 [22] 53 6F 66 74 77 61 72 65 5C 4D 69 63 72 6F\
- 73 6F 66 74 5C 41 63 74 69 76 65 20 53 65 74 75\
- 70 5C 49 6E 73 74 61 6C 6C 65 64 20 43 6F 6D 70\
- 6F 6E 65 6E 74 73 5C } condition: $a}'
-}
-
-class PoisonIvyScan(taskmods.DllList):
- "Detect processes infected with Poison Ivy"
-
- @staticmethod
- def is_valid_profile(profile):
- return (profile.metadata.get('os', 'unknown') == 'windows' and
- profile.metadata.get('memory_model', '32bit') == '32bit')
-
- def get_vad_base(self, task, address):
- """ Get the VAD starting address """
-
- for vad in task.VadRoot.traverse():
- if address >= vad.Start and address < vad.End:
- return vad.Start
-
- # This should never really happen
- return None
-
- def calculate(self):
-
- if not has_yara:
- debug.error("Yara must be installed for this plugin")
-
- addr_space = utils.load_as(self._config)
-
- if not self.is_valid_profile(addr_space.profile):
- debug.error("This command does not support the selected profile.")
-
- rules = yara.compile(sources = signatures)
-
- for task in self.filter_tasks(tasks.pslist(addr_space)):
- scanner = malfind.VadYaraScanner(task = task, rules = rules)
-
- for hit, address in scanner.scan():
- vad_base_addr = self.get_vad_base(task, address)
- if address - vad_base_addr > 0x1000:
- continue
-
- yield task, vad_base_addr
-
- def render_text(self, outfd, data):
-
- self.table_header(outfd, [("Name", "20"),
- ("PID", "8"),
- ("Data VA", "[addrpad]")])
-
- for task, start in data:
- self.table_row(outfd, task.ImageFileName, task.UniqueProcessId, start)
-
-class PoisonIvyConfig(PoisonIvyScan):
- "Locate and parse the Poison Ivy configuration"
-
- def render_text(self, outfd, data):
-
- delim = '-' * 80
-
- for task, start in data:
-
- outfd.write("{0}\n".format(delim))
-
- proc_addr_space = task.get_process_address_space()
-
- config = obj.Object('PICONFIG', offset = start, vm = proc_addr_space)
-
- outfd.write('Process: {0} ({1})\n\n'.format(task.ImageFileName, task.UniqueProcessId))
- outfd.write('Infection:\n')
-
- if config.IsAdmin == 1:
- outfd.write('\tPoisonIvy has ADMIN privileges!\n')
- else:
- outfd.write('\tPoisonIvy has user privileges.\n')
-
- outfd.write('\tVersion: {0}\n'.format(config.var_Version))
- outfd.write('\tBase VA: {0:#x}\n'.format(config.func_Main))
- outfd.write('\tExtra VA: {0:#x}\n'.format(config.func_Extra))
- outfd.write('\tData VA: {0:#x}\n'.format(start))
- outfd.write('\tMutex: {0}\n'.format(config.Mutex))
- outfd.write('\tOriginal file: {0}\n'.format(config.CurrentFile))
- outfd.write('\tMelt original file: {0}\n\n'.format(config.Melt == 1))
-
- outfd.write("Command and Control:\n")
- for i, host in enumerate(config.get_hosts()):
- outfd.write('\tHost {0}: {1}:{2} ({3})\n'.format(i, host.hostname, host.port, host.proto))
-
- # secret (either password or keyfile)
- if config.Secret.isalnum():
- outfd.write('\tPassword: {0}\n'.format(config.Secret))
- else:
- outfd.write('\tKey (from file): 0x{0}'.format(config.Secret.encode('hex')))
-
- # management info
- outfd.write('\tId: {0}\n'.format(config.ServerId))
- outfd.write('\tGroup: {0}\n\n'.format(config.ServerGroup))
-
- outfd.write('Keylogger:\n')
- outfd.write('\tKeylogger: {0}\n'.format(config.Keylogger == 1))
- if config.Keylogger == 1:
- outfd.write('\tKeylogger TID: {0}\n'.format(config.KeyloggerTID))
- outfd.write('\tKeylogger Setup: {0:#x}\n'.format(config.func_Keylogger))
- outfd.write('\tKeylogger Routine: {0:#x}\n'.format(config.func_Keylogger_Hook))
- outfd.write('\tKeylogger logfile: {0}\n'.format(config.KeyloggerLogfile))
-
- outfd.write("\nCopy file:\n")
- outfd.write('\tCopy routine: {0:#x}\n'.format(config.func_CopyFile))
- outfd.write('\tDestination: {0}\n'.format(config.CopyDestFile))
-
- outfd.write("\nPersistence:\n")
- outfd.write('\tActive Setup: {0}\n'.format(config.PersistActiveSetupOn == 1))
- if config.PersistActiveSetupOn == 1:
- outfd.write('\tActive Setup key: {0}\n'.format(config.PersistActiveSetupKey))
- outfd.write('\tActive Setup name: {0}\n'.format(config.PersistActiveSetupName))
- outfd.write('\tSetup routine: {0:#x}\n'.format(config.func_Persist_ActiveSetup))
-
- outfd.write("\tHKLM Run: {0}\n".format(bool(config.PersistHKLMRun == 1)))
- if config.PersistHKLMRun == 1:
- outfd.write("\tHKLM Run name: {0}\n".format(config.PersistHKLMRunName))
- outfd.write("\tSetup routine: {0:#x}\n".format(config.func_Persist_HKLMRun))
-
- outfd.write("\nInjector:\n")
- outfd.write("\tInject into other processes: {0}\n".format(config.Inject == 1))
- if config.Inject == 1:
- outfd.write('\tPersistently: {0}\n'.format(config.InjectPersist == 1))
- outfd.write('\tInjector TID: {0}\n'.format(config.InjectorTID))
- outfd.write('\tInjector Routine: {0:#x}\n'.format(config.func_Injector))
- outfd.write('\tTarget process name: {0}\n'.format(config.InjectIntoProcessName))
- outfd.write('\tTarget default browser: {0}\n'.format(config.InjectIntoDefaultBrowser == 1))
-
- outfd.write("\nProxy:\n")
- outfd.write('\tUse Proxy: {0}\n'.format(config.UseProxy == 1))
- if config.UseProxy == 1:
- outfd.write('\tPersistently: {0}\n'.format(config.ProxyNoPersist == 0))
- for i, proxy in enumerate(config.get_proxies()):
- outfd.write('\tHost {0}: {1}:{2} ({3})\n'.format(i, proxy.hostname, proxy.port, proxy.proto))
-
- outfd.write("\nDecrypt: {0:#x}\n".format(config.func_Decrypt))
diff --git a/contrib/plugins/malware/psempire.py b/contrib/plugins/malware/psempire.py
deleted file mode 100644
index d98e59eae..000000000
--- a/contrib/plugins/malware/psempire.py
+++ /dev/null
@@ -1,97 +0,0 @@
-"""
-@author: Slavi Parpulev
-"""
-import re
-import base64
-import volatility.plugins.common as common
-import volatility.utils as utils
-import volatility.win32.tasks as tasks
-import volatility.plugins.malware.malfind as malfind
-import volatility.plugins.taskmods as taskmods
-
-try:
- import yara
- has_yara = True
-except ImportError:
- has_yara = False
-
-signatures = {
- 'namespace1' : 'rule pivars {strings: $command = { \
- 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 20 2d\
- 4e 6f 50 20 2d 4e 6f 6e 49 20 2d 57 20 48 69 64\
- 64 65 6e 20 2d 45 6e 63 20}\
- condition: $command}'
-}
-
-# signatures = {
-# 'namespace1' : 'rule pivars {strings: $a = /powershell.exe.-NoP.-NonI.-W.Hidden.-Enc.([a-zA-Z0-9]+)/ condition: $a}'
-# }
-
-
-class PSEmpire(taskmods.DllList):
- """A plugin detecting the presence of PowerShell Empire. Idally run against a PID of powershell.exe"""
-
-
- def get_vad_base(self, task, address):
- """ Get the VAD starting address """
-
- for vad in task.VadRoot.traverse():
- if address >= vad.Start and address < vad.End:
- return vad.Start
-
- # This should never really happen
- return None
-
- def calculate(self):
- if not has_yara:
- debug.error("Yara must be installed for this plugin")
-
- addr_space = utils.load_as(self._config)
-
- if not self.is_valid_profile(addr_space.profile):
- debug.error("This command does not support the selected profile.")
- # For each process in the list
- for task in self.filter_tasks(tasks.pslist(addr_space)):
- # print task.ImageFileName
- for vad, address_space in task.get_vads(vad_filter = task._injection_filter):
- # Injected code detected if there's values returned
- rules = yara.compile(sources = signatures)
- scanner = malfind.VadYaraScanner(task = task, rules = rules)
- # print 'before'
- for hit, address in scanner.scan():
- vad_base_addr = self.get_vad_base(task, address)
-
- # Get a chuck of memory of size 2048 next to where the string was detected
- content = address_space.zread(address, 2048)
- yield task, address, vad_base_addr, content
- break
- # break # Show only 1 instance of detected injection per process
-
- def render_text(self, outfd, data):
- for task, address, vad_base_addr, content in data:
- finalstring = []
- # hex dump returns 16 bytes at a time, walk the entire dump and get all values in finalstring
- for offset,h,c in utils.Hexdump(content):
- finalstring.append(''.join(c))
- # Get only the base64 part of the string and decode utf16 otherwise next regex fails to interpret the value as ascii
- obfuscated = base64.b64decode(re.findall(r'.+-Enc\.([a-zA-Z0-9]+)', "".join(finalstring))[0]).decode('utf16')
- # Get server value and port from the string
- try:
- server = re.findall(r'http.+//(.+):', obfuscated)[0]
- except:
- server = "Not detected"
- try:
- port = re.findall(r'http.+:(.+)/', obfuscated)[0]
- except:
- port = "Not found"
-
- outfd.write("Process: {0} Pid: {1} Vad_base: {2:#x} Detected at Address: {3:#x}\n".format(
- task.ImageFileName, task.UniqueProcessId, vad_base_addr, address))
-
- outfd.write("Connecting to - Server: {0} Port: {1}\n".format(
- server, port))
-
- outfd.write("{0}\n".format("\n".join(
- ["{0:#010x} {1:<48} {2}".format(address + o, h, ''.join(c))
- for o, h, c in utils.Hexdump(content[:64])
- ])))
diff --git a/contrib/plugins/malware/zeusscan.py b/contrib/plugins/malware/zeusscan.py
deleted file mode 100644
index 11bc22850..000000000
--- a/contrib/plugins/malware/zeusscan.py
+++ /dev/null
@@ -1,600 +0,0 @@
-# Volatility
-#
-# Zeus support:
-# Michael Hale Ligh
-#
-# Citadel support:
-# Santiago Vicente
-#
-# This file is part of Volatility.
-#
-# Volatility is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Volatility is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Volatility. If not, see .
-#
-
-import struct, hashlib
-import volatility.utils as utils
-import volatility.obj as obj
-import volatility.commands as commands
-import volatility.debug as debug
-import volatility.win32.tasks as tasks
-import volatility.plugins.malware.impscan as impscan
-import volatility.plugins.taskmods as taskmods
-import volatility.plugins.procdump as procdump
-import volatility.addrspace as addrspace
-import volatility.plugins.vadinfo as vadinfo
-import volatility.exceptions as exceptions
-
-try:
- import yara
- has_yara = True
-except ImportError:
- has_yara = False
-
-RC4_KEYSIZE = 0x102
-
-#--------------------------------------------------------------------------------
-# Profile Modifications
-#--------------------------------------------------------------------------------
-
-class ZeusVTypes(obj.ProfileModification):
-
- conditions = {'os': lambda x: x == 'windows',
- 'memory_model': lambda x: x == "32bit"}
-
- def modification(self, profile):
- profile.vtypes.update({
- '_ZEUS2_CONFIG' : [ 0x1E6, {
- 'struct_size' : [ 0x0, ['unsigned int']],
- 'guid' : [ 0x4, ['array', 0x30, ['unsigned short']]],
- 'guid2' : [ 0x7C, ['array', 0x10, ['unsigned char']]],
- 'rc4key' : [ 0x8C, ['array', 0x100, ['unsigned char']]],
- 'exefile' : [ 0x18E, ['String', dict(length = 0x14)]],
- 'datfile' : [ 0x1A2, ['String', dict(length = 0x14)]],
- 'keyname' : [ 0x1B6, ['String', dict(length = 0xA)]],
- 'value1' : [ 0x1C0, ['String', dict(length = 0xA)]],
- 'value2' : [ 0x1CA, ['String', dict(length = 0xA)]],
- 'value3' : [ 0x1D4, ['String', dict(length = 0xA)]],
- 'guid_xor_key' : [ 0x1DE, ['unsigned int']],
- 'xorkey' : [ 0x1E2, ['unsigned int']],
- }],
- '_CITADEL1345_CONFIG' : [ 0x11C, {
- 'struct_size' : [ 0x0, ['unsigned int']],
- 'guid' : [ 0x4, ['array', 0x30, ['unsigned short']]],
- 'guid2' : [ 0x7C, ['array', 0x10, ['unsigned char']]],
- 'exefile' : [ 0x9C, ['String', dict(length = 0x14)]],
- 'datfile' : [ 0xB0, ['String', dict(length = 0x14)]],
- 'keyname' : [ 0xEC, ['String', dict(length = 0xA)]],
- 'value1' : [ 0xF6, ['String', dict(length = 0xA)]],
- 'value2' : [ 0x100, ['String', dict(length = 0xA)]],
- 'value3' : [ 0x10A, ['String', dict(length = 0xA)]],
- 'guid_xor_key' : [ 0x114, ['unsigned int']],
- 'xorkey' : [ 0x118, ['unsigned int']],
- }],
- })
-
-#--------------------------------------------------------------------------------
-# Scanner for Zeus > 1.20 and < 2.0
-#--------------------------------------------------------------------------------
-
-class ZeusScan1(taskmods.DllList):
- """Locate and Decrypt Zeus > 1.20 and < 2.0 Configs"""
-
- @staticmethod
- def is_valid_profile(profile):
- return (profile.metadata.get('os', 'unknown') == 'windows' and
- profile.metadata.get('memory_model', '32bit') == '32bit')
-
- def _zeus_filter(self, vad):
- """
- This is a callback that's executed by get_vads()
- when searching for zeus injections.
-
- @param vad: an MMVAD object.
-
- @returns: True if the MMVAD looks like it might
- contain a zeus image.
-
- We want the memory to be executable, but right now we
- can only get the original protection not the current
- protection...and the original protection can be
- anything. This version of zeus happens to use
- PAGE_NOACCESS so that's what we'll look for instead.
- """
-
- prot = vad.u.VadFlags.Protection.v()
- prot = vadinfo.PROTECT_FLAGS.get(prot, "")
-
- return (vad.u.VadFlags.PrivateMemory == 0 and
- prot == "PAGE_NO_ACCESS" and
- vad.Tag == "VadS")
-
- def calculate(self):
-
- addr_space = utils.load_as(self._config)
-
- if not self.is_valid_profile(addr_space.profile):
- debug.error("This command does not support the selected profile.")
-
- for task in self.filter_tasks(tasks.pslist(addr_space)):
- task_space = task.get_process_address_space()
-
- # We must have a process AS
- if not task_space:
- continue
-
- winsock = None
-
- # Locate the winsock DLL
- for mod in task.get_load_modules():
- if str(mod.BaseDllName or '').lower() == "ws2_32.dll":
- winsock = mod
- break
-
- if not winsock:
- continue
-
- # Resolve the closesocket API
- closesocket = winsock.getprocaddress("closesocket")
-
- if not closesocket:
- continue
-
- for vad, process_space in task.get_vads(
- vad_filter = self._zeus_filter,
- ):
-
- if obj.Object("_IMAGE_DOS_HEADER", offset = vad.Start,
- vm = process_space).e_magic != 0x5A4D:
- continue
-
- data = process_space.zread(vad.Start, vad.Length)
-
- scanner = impscan.ImpScan(self._config).call_scan
- calls = list(scanner(task_space, vad.Start, data))
-
- for (_, iat_loc, call_dest) in calls:
- if call_dest != closesocket:
- continue
-
- # Read the DWORD directly after closesocket
- struct_base = obj.Object('Pointer',
- offset = iat_loc + 4, vm = task_space)
-
- # To be valid, it must point within the vad segment
- if (struct_base < vad.Start or
- struct_base > (vad.Start + vad.End)):
- continue
-
- # Grab the key data
- key = task_space.read(struct_base + 0x2a, RC4_KEYSIZE)
-
- # Greg's sanity check
- if len(key) != RC4_KEYSIZE or key[-2:] != "\x00\x00":
- continue
-
- yield task, struct_base, key
-
- def render_text(self, outfd, data):
-
- for task, struct_base, key in data:
- hex = "\n".join(["{0:#010x} {1:<48} {2}".format(
- struct_base + 0x2a + o,
- h, ''.join(c)) for o, h, c in utils.Hexdump(key)
- ])
- outfd.write("Process: {0} {1}\n".format(
- task.UniqueProcessId, task.ImageFileName))
- outfd.write(hex)
- outfd.write("\n")
-
-#--------------------------------------------------------------------------------
-# Scanner for Zeus >= 2.0
-#--------------------------------------------------------------------------------
-
-class ZeusScan2(procdump.ProcDump):
- """Locate and Decrypt Zeus >= 2.0 Configs"""
-
- signatures = {
- 'namespace1':'rule z1 {strings: $a = {56 BA ?? ?? 00 00 52 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B 0D ?? ?? ?? ??} condition: $a}',
- 'namespace5':'rule z5 {strings: $a = {56 BA ?? ?? 00 00 52 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 03 0D ?? ?? ?? ??} condition: $a}',
- 'namespace2':'rule z2 {strings: $a = {55 8B EC 51 A1 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 56 8D 34 01 A1 ?? ?? ?? ?? 8B 0D ?? ?? ?? ??} condition: $a}',
- 'namespace3':'rule z3 {strings: $a = {68 02 01 00 00 8D 84 24 ?? ?? ?? ?? 50 8D 44 24 ?? 50 E8 ?? ?? ?? ?? B8 E6 01 00 00 50 68 ?? ?? ?? ??} condition: $a}',
- 'namespace4':'rule z4 {strings: $a = {68 02 01 00 00 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? B8 E6 01 00 00 50 68 ?? ?? ?? ??} condition: $a}'
- }
-
- magic_struct = '_ZEUS2_CONFIG'
-
- params = dict(
- # This contains the C2 URL, RC4 key for decoding
- # local.ds and the magic buffer
- decoded_config = None,
- # This contains the hardware lock info, the user.ds
- # RC4 key, and XOR key
- encoded_magic = None,
- # The decoded version of the magic structure
- decoded_magic = None,
- # The key for decoding the configuration
- config_key = None,
- # The login key (citadel only)
- login_key = None,
- # The AES key (citadel only)
- aes_key = None,
- )
-
- @staticmethod
- def is_valid_profile(profile):
- return (profile.metadata.get('os', 'unknown') == 'windows' and
- profile.metadata.get('memory_model', '32bit') == '32bit')
-
- def rc4(self, key, encoded):
- """Perform a basic RC4 operation"""
- # Turn the buffers into lists so the elements are mutable
- key_copy = [ord(c) for c in key]
- enc_copy = [ord(c) for c in encoded]
- # Start with the last two bytes in the key
- var1 = key_copy[0x100]
- var2 = key_copy[0x101]
- # Do the RC4 algorithm
- for i in range(0, len(enc_copy)):
- var1 += 1
- a = var1 & 0xFF
- b = key_copy[a]
- var2 += b
- var2 &= 0xFF
- key_copy[a] = key_copy[var2]
- key_copy[var2] = b
- enc_copy[i] ^= key_copy[(key_copy[a] + b) & 0xFF]
- # Return the decoded bytes as a string
- decoded = [chr(c) for c in enc_copy]
- return ''.join(decoded)
-
- def rc4_init(self, data):
- """Initialize the RC4 keystate"""
- # The key starts off as a mutable list
- key = list()
- for i in range(0, 256):
- key.append(i)
- # Add the trailing two bytes
- key.append(0)
- key.append(0)
- # Make a copy of the data so its mutable also
- data_copy = [ord(c) for c in data]
- var1 = 0
- var2 = 0
- for i in range(0, 256):
- a = key[i]
- var2 += (data_copy[var1] + a)
- var2 &= 0xFF
- var1 += 1
- key[i] = key[var2]
- key[var2] = a
- # Return a copy of the key as a string
- return ''.join([chr(c) for c in key])
-
- def decode_config(self, encoded_config, last_sec_data):
- """Decode the config with data from the last PE section.
-
- @param encoded_config: the encoded configuration
- @param last_sec_data: last PE section data.
- """
-
- return ''.join([chr(ord(last_sec_data[i]) ^ ord(encoded_config[i]))
- for i in range(len(encoded_config))])
-
- def check_matches(self, task_space, vad, matches, last_sec_data):
- """Check the Yara matches and derive the encoded/decoded
- config objects and magic structures.
-
- @param task_space: the process AS
- @param vad: the containing MMVAD
- @param matches: list of YARA hits
- @param last_sec_data: buffer of the last PE section's data
- """
-
- hits = dict((m.rule, m.strings[0][0] + vad.Start) for m in matches)
-
- ## Do the magic
- if 'z3' in hits:
- addr = obj.Object('unsigned long', offset = hits['z3'] + 30, vm = task_space)
- size = task_space.profile.get_obj_size(self.magic_struct)
- self.params['encoded_magic'] = task_space.read(addr, size)
- elif 'z4' in hits:
- addr = obj.Object('unsigned long', offset = hits['z4'] + 31, vm = task_space)
- size = task_space.profile.get_obj_size(self.magic_struct)
- self.params['encoded_magic'] = task_space.read(addr, size)
- else:
- return False
-
- ## Do the config
- if 'z1' in hits:
- addr = obj.Object('unsigned long', offset = hits['z1'] + 8, vm = task_space)
- size = obj.Object('unsigned long', offset = hits['z1'] + 2, vm = task_space)
- encoded_config = task_space.read(addr, size)
- self.params['decoded_config'] = self.decode_config(encoded_config, last_sec_data)
- elif 'z2' in hits:
- addr = obj.Object('Pointer', offset = hits['z2'] + 26, vm = task_space)
- encoded_config = task_space.read(addr.dereference(), 0x3c8)
- rc4_init = self.rc4_init(encoded_config)
- self.params['decoded_config'] = self.rc4(rc4_init, last_sec_data[2:])
- elif 'z5' in hits:
- addr = obj.Object('unsigned long', offset = hits['z5'] + 8, vm = task_space)
- size = obj.Object('unsigned long', offset = hits['z5'] + 2, vm = task_space)
- encoded_config = task_space.read(addr, size)
- self.params['decoded_config'] = self.decode_config(encoded_config, last_sec_data)
- else:
- return False
-
- ## We found at least one of each category
- return True
-
- def decode_magic(self, config_key):
- """Decode the magic structure using the configuration key.
-
- @param config_key: the config RC4 key.
- """
-
- return self.rc4(config_key, self.params['encoded_magic'])
-
- def scan_key(self, task_space):
- """Find the offset of the RC4 key and use it to
- decode the magic buffer.
-
- @param task_space: the process AS
- """
-
- offset = 0
- found = False
-
- while offset < len(self.params['decoded_config']) - RC4_KEYSIZE:
-
- config_key = self.params['decoded_config'][offset:offset + RC4_KEYSIZE]
- decoded_magic = self.decode_magic(config_key)
-
- # When the first four bytes of the decoded magic buffer
- # equal the size of the magic buffer, then we've found
- # a winning RC4 key
- (struct_size,) = struct.unpack("=I", decoded_magic[0:4])
-
- if struct_size == task_space.profile.get_obj_size(self.magic_struct):
- found = True
- self.params['config_key'] = config_key
- self.params['decoded_magic'] = decoded_magic
- break
-
- offset += 1
-
- return found
-
- def calculate(self):
-
- if not has_yara:
- debug.error("You must install yara")
-
- addr_space = utils.load_as(self._config)
-
- if not self.is_valid_profile(addr_space.profile):
- debug.error("This command does not support the selected profile.")
-
- rules = yara.compile(sources = self.signatures)
-
- for task in self.filter_tasks(tasks.pslist(addr_space)):
- task_space = task.get_process_address_space()
-
- # We must have a process AS
- if not task_space:
- continue
-
- for vad, process_space in task.get_vads():
-
- if obj.Object("_IMAGE_DOS_HEADER", offset = vad.Start,
- vm = process_space).e_magic != 0x5A4D:
- continue
-
- # a zeus range will never be more than 5 MB
- if vad.Length > 0x500000:
- continue
-
- data = process_space.zread(vad.Start, vad.Length)
-
- # check for the signature with YARA, both hits must be present
- matches = rules.match(data = data)
-
- if len(matches) < 2:
- continue
-
- try:
- dos_header = obj.Object("_IMAGE_DOS_HEADER",
- offset = vad.Start, vm = task_space)
- nt_header = dos_header.get_nt_header()
- except (ValueError, exceptions.SanityCheckException):
- continue
-
- # There must be more than 2 sections
- if nt_header.FileHeader.NumberOfSections < 2:
- continue
-
- # Get the last PE section's data
- sections = list(nt_header.get_sections())
- last_sec = sections[-1]
- last_sec_data = task_space.zread(
- (last_sec.VirtualAddress + vad.Start),
- last_sec.Misc.VirtualSize
- )
-
- success = self.check_matches(task_space, vad, matches,
- last_sec_data)
-
- if not success:
- continue
-
- success = self.scan_key(task_space)
-
- if not success:
- continue
-
- yield task, vad, self.params
-
- def render_extra(self, outfd, task, vad, params):
- """Show any Zeus specific fields"""
-
- rc4_offset = task.obj_vm.profile.get_obj_offset(self.magic_struct, 'rc4key')
- creds_key = params['decoded_magic'][rc4_offset:rc4_offset + RC4_KEYSIZE]
-
- outfd.write("{0:<30} : \n{1}\n".format("Credential RC4 key",
- "\n".join(
- ["{0:#010x} {1:<48} {2}".format(vad.Start + o, h, ''.join(c))
- for o, h, c in utils.Hexdump(creds_key)
- ])))
-
- def render_text(self, outfd, data):
- """Render the plugin's default text output"""
-
- for task, vad, params in data:
-
- # Get a magic object from the buffer
- buffer_space = addrspace.BufferAddressSpace(
- config = self._config,
- data = params['decoded_magic'])
-
- magic_obj = obj.Object(self.magic_struct,
- offset = 0, vm = buffer_space)
-
- outfd.write("*" * 50 + "\n")
- outfd.write("{0:<30} : {1}\n".format("Process", task.ImageFileName))
- outfd.write("{0:<30} : {1}\n".format("Pid", task.UniqueProcessId))
- outfd.write("{0:<30} : {1}\n".format("Address", vad.Start))
-
- # grab the URLs from the decoded buffer
- decoded_config = params['decoded_config']
- urls = []
- while "http" in decoded_config:
- url = decoded_config[decoded_config.find("http"):]
- urls.append(url[:url.find('\x00')])
- decoded_config = url[url.find('\x00'):]
- for i, url in enumerate(urls):
- outfd.write("{0:<30} : {1}\n".format("URL {0}".format(i), url))
-
- outfd.write("{0:<30} : {1}\n".format("Identifier",
- ''.join([chr(c) for c in magic_obj.guid if c != 0])))
- outfd.write("{0:<30} : {1}\n".format("Mutant key", magic_obj.guid_xor_key))
- outfd.write("{0:<30} : {1}\n".format("XOR key", magic_obj.xorkey))
- outfd.write("{0:<30} : {1}\n".format("Registry",
- "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\{0}".format(magic_obj.keyname)))
- outfd.write("{0:<30} : {1}\n".format(" Value 1", magic_obj.value1))
- outfd.write("{0:<30} : {1}\n".format(" Value 2", magic_obj.value2))
- outfd.write("{0:<30} : {1}\n".format(" Value 3", magic_obj.value3))
- outfd.write("{0:<30} : {1}\n".format("Executable", magic_obj.exefile))
- outfd.write("{0:<30} : {1}\n".format("Data file", magic_obj.datfile))
-
- outfd.write("{0:<30} : \n{1}\n".format("Config RC4 key",
- "\n".join(
- ["{0:#010x} {1:<48} {2}".format(vad.Start + o, h, ''.join(c))
- for o, h, c in utils.Hexdump(params['config_key'])
- ])))
-
- self.render_extra(outfd, task, vad, params)
-
-class CitadelScan1345(ZeusScan2):
- """Locate and Decrypt Citadel 1.3.4.5 Configs"""
-
- signatures = {
- 'namespace1':'rule z1 {strings: $a = {8B EC 83 EC 0C 8A 82 ?? ?? ?? ?? 88 45 FE 8A 82 01 01 00 00 88 45 FD 8A 82 02 01 00 00 B9 ?? ?? ?? ?? 88 45 FF E8 ?? ?? ?? ??} condition: $a}',
- 'namespace2':'rule z2 {strings: $a = {56 BA ?? ?? 00 00 52 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 03 0D ?? ?? ?? ?? 8B F2 2B C8} condition: $a}',
- 'namespace3':'rule z3 {strings: $a = {68 ?? ?? 00 00 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? B8 ?? ?? 00 00 50 68 ?? ?? ?? ??} condition: $a}'
- }
-
- magic_struct = '_CITADEL1345_CONFIG'
-
- def rc4(self, key, encoded, login_key):
- """Perform a basic RC4 operation.
-
- Same as Zeus, but with incorporation of
- a LOGIN_KEY value."""
- # Turn the buffers into lists so the elements are mutable
- key_copy = [ord(c) for c in key]
- enc_copy = [ord(c) for c in encoded]
- # Start with the last two bytes in the key
- var1 = key_copy[0x100]
- var2 = key_copy[0x101]
- var3 = 0
- login_key_len = len(login_key);
- # Do the RC4 algorithm
- for i in range(0, len(enc_copy)):
- var1 += 1
- a = var1 & 0xFF
- b = key_copy[a]
- var2 += b
- var2 &= 0xFF
- key_copy[a] = key_copy[var2]
- key_copy[var2] = b
- enc_copy[i] ^= key_copy[(key_copy[a] + b) & 0xFF]
- enc_copy[i] ^= ord(login_key[var3])
- var3 += 1
- if (var3 == login_key_len):
- var3 = 0
-
- # Return the decoded bytes as a string
- decoded = [chr(c) for c in enc_copy]
- return ''.join(decoded)
-
- def decode_magic(self, config_key):
- """Decode the magic buffer using RC4 and
- the LOGIN_KEY."""
-
- return self.rc4(config_key, self.params['encoded_magic'],
- self.params['login_key'])
-
- def check_matches(self, task_space, vad, matches, last_sec_data):
- """Check the Yara matches and derive the encoded/decoded
- config objects and magic structures.
-
- @param task_space: the process AS
- @param vad: the containing MMVAD
- @param matches: list of YARA hits
- @param last_sec_data: buffer of the last PE section's data
- """
-
- hits = dict((m.rule, m.strings[0][0] + vad.Start) for m in matches)
-
- if 'z1' in hits:
- addr = obj.Object('unsigned long', offset = hits['z1'] + 30, vm = task_space)
- self.params['login_key'] = task_space.read(addr, 0x20)
- else:
- return False
-
- if 'z2' in hits:
- addr = obj.Object('unsigned long', offset = hits['z2'] + 8, vm = task_space)
- size = obj.Object('unsigned long', offset = hits['z2'] + 2, vm = task_space)
- encoded_config = task_space.read(addr, size)
- self.params['decoded_config'] = self.decode_config(encoded_config, last_sec_data)
- else:
- return False
-
- if 'z3' in hits:
- addr = obj.Object('unsigned long', offset = hits['z3'] + 31, vm = task_space)
- size = task_space.profile.get_obj_size(self.magic_struct)
- self.params['encoded_magic'] = task_space.read(addr, size)
- else:
- return False
-
- return True
-
- def render_extra(self, outfd, task, vad, params):
- """Show Citadel specific fields"""
-
- aes_key = self.rc4(params['config_key'],
- hashlib.md5(params['login_key']).digest(),
- params['login_key'])
-
- outfd.write("{0:<30} : {1}\n".format("Login key", params['login_key'].upper()))
- outfd.write("{0:<30} : {1}\n".format("AES key", str(aes_key).encode('hex').upper()))
diff --git a/contrib/plugins/pagecheck.py b/contrib/plugins/pagecheck.py
deleted file mode 100644
index cea7898cf..000000000
--- a/contrib/plugins/pagecheck.py
+++ /dev/null
@@ -1,42 +0,0 @@
-# Volatility
-#
-# This file is part of Volatility.
-#
-# Volatility is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Volatility is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Volatility. If not, see .
-#
-
-import volatility.commands as commands
-import volatility.utils as utils
-
-class PageCheck(commands.Command):
- """Reads the available pages and reports if any are inaccessible"""
-
- def render_text(self, outfd, data):
- """Displays any page errors"""
- found = False
- for page, vtop, size, pde, pte in data:
- found = True
- outfd.write("(V): 0x{0:08x} [PDE] 0x{3:08x} [PTE] 0x{4:08x} (P): 0x{1:08x} Size: 0x{2:08x}\n".format(page, vtop, size, pde, pte))
- if not found:
- outfd.write("No page failures found!")
-
- def calculate(self):
- """Calculate returns the results of the available pages validity"""
- addr_space = utils.load_as(self._config)
- for page, size in addr_space.get_available_pages():
- output = addr_space.read(page, size)
- if output == None:
- pde_value = addr_space.get_pde(page)
- pte_value = addr_space.get_pte(page, pde_value)
- yield page, addr_space.vtop(page), size, pde_value, pte_value
diff --git a/contrib/plugins/psdispscan.py b/contrib/plugins/psdispscan.py
deleted file mode 100644
index a4911aaeb..000000000
--- a/contrib/plugins/psdispscan.py
+++ /dev/null
@@ -1,182 +0,0 @@
-# Volatility
-#
-# Authors:
-# Michael Cohen
-#
-# This file is part of Volatility.
-#
-# Volatility is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Volatility is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Volatility. If not, see .
-#
-
-"""
-This module implements the slow thorough process scanning
-
-@author: Michael Cohen
-@license: GNU General Public License 2.0 or later
-@contact: scudette@users.sourceforge.net
-@organization: Volatile Systems
-"""
-
-#pylint: disable-msg=C0111
-
-import volatility.commands as commands
-import volatility.cache as cache
-import volatility.utils as utils
-import volatility.obj as obj
-import volatility.scan as scan
-
-class DispatchHeaderCheck(scan.ScannerCheck):
- """ A very fast check for an _EPROCESS.Pcb.Header.
-
- This check assumes that the type and size of
- _EPROCESS.Pcb.Header are unsigned chars, but allows their
- offsets to be determined from vtypes (so they could change
- between OS versions).
- """
- order = 10
-
- def __init__(self, address_space, **_kwargs):
- ## Because this checks needs to be super fast we first
- ## instantiate the _EPROCESS and work out the offsets of the
- ## type and size members. Then in the check we just read those
- ## offsets directly.
- eprocess = obj.Object("_EPROCESS", vm = address_space, offset = 0)
- self.type = eprocess.Pcb.Header.Type
- self.size = eprocess.Pcb.Header.Size
- self.buffer_size = max(self.size.obj_offset, self.type.obj_offset) + 2
- scan.ScannerCheck.__init__(self, address_space)
-
- def check(self, offset):
- data = self.address_space.read(offset + self.type.obj_offset, self.buffer_size)
- return data[self.type.obj_offset] == "\x03" and data[self.size.obj_offset] == "\x1b"
-
- def skip(self, data, offset):
- try:
- nextval = data.index("\x03", offset + 1)
- return nextval - self.type.obj_offset - offset
- except ValueError:
- ## Substring is not found - skip to the end of this data buffer
- return len(data) - offset
-
-class CheckThreadList(scan.ScannerCheck):
- """ Checks that _EPROCESS thread list points to the kernel Address Space """
- def check(self, offset):
- eprocess = obj.Object("_EPROCESS", vm = self.address_space,
- offset = offset)
- kernel = 0x80000000
-
- list_head = eprocess.ThreadListHead
-
- if list_head.Flink > kernel and list_head.Blink > kernel:
- return True
-
-class CheckDTBAligned(scan.ScannerCheck):
- """ Checks that _EPROCESS.Pcb.DirectoryTableBase is aligned to 0x20 """
- def check(self, offset):
- eprocess = obj.Object("_EPROCESS", vm = self.address_space,
- offset = offset)
-
- return eprocess.Pcb.DirectoryTableBase % 0x20 == 0
-
-class CheckSynchronization(scan.ScannerCheck):
- """ Checks that _EPROCESS.WorkingSetLock and _EPROCESS.AddressCreationLock look valid """
- def check(self, offset):
- eprocess = obj.Object("_EPROCESS", vm = self.address_space,
- offset = offset)
-
- event = eprocess.WorkingSetLock.Event.Header
- if event.Type != 0x1 or event.Size != 0x4:
- return False
-
- event = eprocess.AddressCreationLock.Event.Header
- if event.Size == 0x4 and event.Type == 0x1:
- return True
-
-class PSDispScanner(scan.BaseScanner):
- """ This scanner carves things that look like _EPROCESS structures.
-
- Since the _EPROCESS does not need to be linked to the process
- list, this scanner is useful to recover terminated or cloaked
- processes.
- """
- checks = [ ("DispatchHeaderCheck", {}),
- ("CheckDTBAligned", {}),
- ("CheckThreadList", {}),
- ("CheckSynchronization", {})
- ]
-
-class PSDispScan(commands.Command, cache.Testable):
- """ Scan Physical memory for _EPROCESS objects based on their Dispatch Headers"""
-
- # Declare meta information associated with this plugin
-
- meta_info = dict(
- author = 'Brendan Dolan-Gavitt',
- copyright = 'Copyright (c) 2007,2008 Brendan Dolan-Gavitt',
- contact = 'bdolangavitt@wesleyan.edu',
- license = 'GNU General Public License 2.0 or later',
- url = 'http://moyix.blogspot.com/',
- os = 'WIN_32_XP_SP2',
- version = '1.0',
- )
-
- @cache.CacheDecorator("tests/psscan")
- def calculate(self):
- address_space = utils.load_as(self._config, astype = 'physical')
-
- for offset in PSDispScanner().scan(address_space):
- yield obj.Object('_EPROCESS', vm = address_space, offset = offset)
-
- def render_dot(self, outfd, data):
- objects = set()
- links = set()
-
- for eprocess in data:
- label = "{0} | {1} |".format(eprocess.UniqueProcessId,
- eprocess.ImageFileName)
- if eprocess.ExitTime:
- label += "exited\\n{0}".format(eprocess.ExitTime)
- options = ' style = "filled" fillcolor = "lightgray" '
- else:
- label += "running"
- options = ''
-
- objects.add('pid{0} [label="{1}" shape="record" {2}];\n'.format(eprocess.UniqueProcessId,
- label, options))
- links.add("pid{0} -> pid{1} [];\n".format(eprocess.InheritedFromUniqueProcessId,
- eprocess.UniqueProcessId))
-
- ## Now write the dot file
- outfd.write("digraph processtree { \ngraph [rankdir = \"TB\"];\n")
- for link in links:
- outfd.write(link)
-
- for item in objects:
- outfd.write(item)
- outfd.write("}")
-
- def render_text(self, outfd, data):
- ## Just grab the AS and scan it using our scanner
- outfd.write(" Offset Name PID PPID PDB Time created Time exited \n" +
- "---------- ---------------- ------ ------ ---------- ------------------------ ------------------------ \n")
-
- for eprocess in data:
- outfd.write("{0:#010x} {1:16} {2:6} {3:6} {4:#010x} {5:24} {6:24}\n".format(
- eprocess.obj_offset,
- eprocess.ImageFileName,
- eprocess.UniqueProcessId,
- eprocess.InheritedFromUniqueProcessId,
- eprocess.Pcb.DirectoryTableBase,
- eprocess.CreateTime or '',
- eprocess.ExitTime or ''))
diff --git a/contrib/plugins/saveconfig.py b/contrib/plugins/saveconfig.py
deleted file mode 100644
index 1504bc4b8..000000000
--- a/contrib/plugins/saveconfig.py
+++ /dev/null
@@ -1,163 +0,0 @@
-# Volatility
-#
-# Author:
-# Andrew Cook
-#
-# This file is part of Volatility./
-#
-# Volatility is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Volatility is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Volatility. If not, see .
-#
-
-import os
-import volatility.plugins.common as common
-import volatility.conf as conf
-import volatility.win32.tasks as tasks
-import volatility.utils as utils
-import volatility.plugins.kdbgscan as kdbgscan
-import volatility.obj as obj
-import volatility.cache as cache
-import volatility.registry as registry
-import ConfigParser
-
-class SaveConfig(kdbgscan.KDBGScan): # common.AbstractWindowsCommand):
- """Generates Volatility configuration files"""
- def __init__(self, config, *args, **kwargs):
- common.AbstractWindowsCommand.__init__(self, config, *args, **kwargs)
-
- config.add_option("DEST", default = "./volatilityrc", short_option = "D",
- help = "File to save the generated configuration")
-
- config.add_option("EXCLUDE-CONF", default = False, short_option = "E",
- action = "store_true", help = "Save only options specified on the command line (rather than configuration files)")
-
- config.add_option("MODIFY", default = False, short_option = "M",
- action = "store_true", help = "Modify (rather than override) the generated configuration file")
-
- config.add_option("OFFSETS", default = False,
- action = "store_true", help = "Get offsets, like KDBG and DTB")
-
- config.add_option("AUTO", default = False,
- action = "store_true", help = "Attempt to automatically determine profile")
-
-
- ## Used to make sure we do not save our own options and options that are already saved
- self._exclude_options = ["dest", "exclude_conf", "modify", "offsets", "auto"]
-
- ## Used to store suggested profiles based on kdbg search
- self.suglist = []
-
- ## Used to save the generated configuration
- self.new_config = ConfigParser.RawConfigParser()
-
- ## Where to output the generated configuration file
- self.save_location = self._config.DEST
-
- ## Used if we 'aborted' due to not wanting to overwrite an existing file
- self.abort = False
-
-
- def calculate(self):
- ## Stop executing if the user did not mean to overwrite the file
- if os.path.isfile(self.save_location):
- resp = raw_input("Are you sure you want to overwrite {}? [Y/n] ".format(self.save_location))
- if resp.upper() == 'N':
- self.abort = True
- return # Not continuing
-
- ## Read from existing target configuration (if modifying)
- if self._config.MODIFY:
- self.new_config.read(self.save_location)
-
-
- ## Attempt to automatically determine profile
- if self._config.AUTO:
- print("Determining profile based on KDBG search...")
- self.suglist = [ s for s, _ in kdbgscan.KDBGScan.calculate(self)]
- if self.suglist:
- self.new_config.set("DEFAULT", "profile", self.suglist[0])
- ## Update profile so --offsets will work
- self._config.PROFILE = self.suglist[0]
- self._exclude_options.append('profile')
- else:
- print("Failed to determine profile")
-
- ## Read in current command line (precedence over settings in configs)
- for key in self._config.opts:
- if key not in self._exclude_options:
- self.new_config.set("DEFAULT", key, self._config.opts[key])
- ## Add to excluded list so we do not overwrite them later
- self._exclude_options.append(key)
-
- ## Save options from configuration files (unless excluded by user)
- if self._config.EXCLUDE_CONF == False:
- for key in self._config.cnf_opts:
- if key not in self._exclude_options:
- self.new_config.set("DEFAULT", key, self._config.cnf_opts[key])
-
- ## Get offsets (KDBG and DTB)
- if self._config.OFFSETS:
- addr_space = utils.load_as(self._config)
- kdbg = tasks.get_kdbg(addr_space)
- self.new_config.set("DEFAULT", "kdbg", str(kdbg.v()))
- if hasattr(addr_space, "dtb"):
- self.new_config.set("DEFAULT", "dtb", str(addr_space.dtb))
-
-
- ## Ensure DTB and KDBG are converted properly at the last moment:
- ## Note, volatility will convert these to int when read from CNF_OPTS
- try:
- kdbg = self.new_config.get("DEFAULT", "kdbg")
- self.new_config.set("DEFAULT", "kdbg", str(hex(int(kdbg))))
- except ConfigParser.NoOptionError:
- pass
- try:
- dtb = self.new_config.get("DEFAULT", "dtb")
- self.new_config.set("DEFAULT", "dtb", str(hex(int(dtb))))
- except ConfigParser.NoOptionError:
- pass
-
-
- ## Write the new configuration file
- with open(self.save_location, "wb") as configfile:
- self.new_config.write(configfile)
-
-
- def max_width(self):
- """ Return length of the longest key and longest value """
- max_key_width = 0
- max_val_width = 0
-
- for key, val in self.new_config.items("DEFAULT"):
- max_key_width = max(len(str(key)), max_key_width)
- max_val_width = max(len(str(val)), max_val_width)
-
- return (str(max_key_width), str(max_val_width))
-
- def render_text(self, outfd, data):
- outfd.write("\n")
- if self.abort:
- print ("No configuration file created")
- else:
- if len(self.suglist) > 1:
- outfd.write("Suggested profiles: {}\n".format(", ".join(self.suglist)))
- if self.suglist:
- outfd.write("Selected profile: {}\n\n".format(self.suglist[0]))
-
- print ("Saved configuration options:")
- self.table_header(outfd, [("Option", self.max_width()[0]), ("Value", self.max_width()[1])])
- ## Print out the final saved configuration
- for opt, val in self.new_config.items("DEFAULT"):
- self.table_row(outfd, opt, val)
-
- outfd.write("\nConfiguration saved to {}\n".format(self.save_location))
diff --git a/contrib/plugins/scanprof.py b/contrib/plugins/scanprof.py
deleted file mode 100644
index 59fd70bc2..000000000
--- a/contrib/plugins/scanprof.py
+++ /dev/null
@@ -1,58 +0,0 @@
-# Volatility
-#
-# Authors:
-# Mike Auty
-#
-# This file is part of Volatility.
-#
-# Volatility is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Volatility is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Volatility. If not, see .
-#
-
-import sys
-import itertools
-import timeit
-
-class ScanProfInstance(object):
- def __init__(self, func, *args):
- self.func = func
- self.args = args
- self.results = []
-
- def __call__(self):
- self.results = self.func(*self.args)
-
-def permscan(self, address_space, offset = 0, maxlen = None):
- times = []
- # Run a warm-up scan to ensure the file is cached as much as possible
- self.oldscan(address_space, offset, maxlen)
-
- perms = list(itertools.permutations(self.checks))
- for i in range(len(perms)):
- self.checks = perms[i]
- print "Running scan {0}/{1}...".format(i + 1, len(perms))
- profobj = ScanProfInstance(self.oldscan, address_space, offset, maxlen)
- value = timeit.timeit(profobj, number = self.repeats)
- times.append((value, len(list(profobj.results)), i))
-
- print "Scan results"
- print "{0:20} | {1:7} | {2:6} | {3}".format("Time", "Results", "Perm #", "Ordering")
- for val, l, ordering in sorted(times):
- print "{0:20} | {1:7} | {2:6} | {3}".format(val, l, ordering, perms[ordering])
- sys.exit(1)
-
-def ScanProfiler(cls, repeats = 3):
- cls.repeats = repeats
- cls.oldscan = cls.scan
- cls.scan = permscan
- return cls
diff --git a/pyinstaller/hook-distorm3.py b/pyinstaller/hook-distorm3.py
index 254f9c708..65cf61fa5 100755
--- a/pyinstaller/hook-distorm3.py
+++ b/pyinstaller/hook-distorm3.py
@@ -15,6 +15,8 @@
datas = []
for path in sys.path:
- datas.append((os.path.join(path, "distorm3", "distorm3.dll"), ""))
- datas.append((os.path.join(path, "distorm3", "libdistorm3.so"), ""))
+ if os.path.exists(os.path.join(path, "distorm3", "distorm3.dll")):
+ datas.append((os.path.join(path, "distorm3", "distorm3.dll"), "."))
+ if os.path.exists(os.path.join(path, "distorm3", "libdistorm3.so")):
+ datas.append((os.path.join(path, "distorm3", "libdistorm3.so"), "."))
diff --git a/pyinstaller/hook-openpyxl.py b/pyinstaller/hook-openpyxl.py
index bf81de55c..9d8b69346 100755
--- a/pyinstaller/hook-openpyxl.py
+++ b/pyinstaller/hook-openpyxl.py
@@ -15,5 +15,5 @@
datas = []
for path in sys.path:
- datas.append((os.path.join(path, "openpyxl", ".constants.json"), ""))
-
+ if os.path.exists(os.path.join(path, "openpyxl", ".constants.json")):
+ datas.append((os.path.join(path, "openpyxl", ".constants.json"), "."))
diff --git a/pyinstaller/hook-yara.py b/pyinstaller/hook-yara.py
index a59943e7f..405e76230 100644
--- a/pyinstaller/hook-yara.py
+++ b/pyinstaller/hook-yara.py
@@ -4,5 +4,7 @@
datas = []
for path in sys.path:
- datas.append(("yara.pyd", ""))
- datas.append(("yara.so", ""))
\ No newline at end of file
+ if os.path.exists(os.path.join(path, "yara.pyd")):
+ datas.append((os.path.join(path, "yara.pyd"), "."))
+ if os.path.exists(os.path.join(path, "yara.so")):
+ datas.append((os.path.join(path, "yara.so"), "."))
diff --git a/tools/linux/module.c b/tools/linux/module.c
index 30a1eff73..cd9410d65 100644
--- a/tools/linux/module.c
+++ b/tools/linux/module.c
@@ -17,6 +17,10 @@ symbols and then read the DWARF symbols from it.
#include
#include
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,20,0)
+struct xa_node xa;
+#endif
+
#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,11,0)
#include
struct lockref lockref;
@@ -60,7 +64,9 @@ struct xt_table xt_table;
#include
#include
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
struct atomic_notifier_head atomic_notifier_head;
+#endif
#include
struct tty_driver tty_driver;
@@ -86,10 +92,12 @@ struct unix_sock unix_sock;
struct pid pid;
struct radix_tree_root radix_tree_root;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,12)
#ifdef CONFIG_NET_SCHED
#include
struct Qdisc qdisc;
#endif
+#endif
struct inet_protosw inet_protosw;
@@ -177,7 +185,12 @@ struct rt_hash_bucket {
} rt_hash_bucket;
#ifndef RADIX_TREE_MAP_SHIFT
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,18)
+#define RADIX_TREE_MAP_SHIFT 6
+#else
#define RADIX_TREE_MAP_SHIFT (CONFIG_BASE_SMALL ? 4 : 6)
+#endif
#define RADIX_TREE_MAP_SIZE (1UL << RADIX_TREE_MAP_SHIFT)
#define RADIX_TREE_MAP_MASK (RADIX_TREE_MAP_SIZE-1)
#define RADIX_TREE_TAG_LONGS ((RADIX_TREE_MAP_SIZE + BITS_PER_LONG - 1) / BITS_PER_LONG)
@@ -225,6 +238,18 @@ struct module_sections module_sect_attrs;
struct module_kobject module_kobject;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,2,0)
+// we can't get the defintion of mod_tree_root directly
+// because it is declared in module.c as a static struct
+// the latch_tree_root struct has the variables we want
+// immediately after it though
+
+#include
+
+struct latch_tree_root ltr;
+
+#endif
+
#ifdef CONFIG_SLAB
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,31)
@@ -554,26 +579,51 @@ struct mount {
#endif
#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,13,0)
-struct proc_dir_entry {
- unsigned int low_ino;
- umode_t mode;
- nlink_t nlink;
- kuid_t uid;
- kgid_t gid;
- loff_t size;
- const struct inode_operations *proc_iops;
- const struct file_operations *proc_fops;
- struct proc_dir_entry *next, *parent, *subdir;
- void *data;
- atomic_t count; /* use count */
- atomic_t in_use; /* number of callers into module in progress; */
- /* negative -> it's going away RSN */
- struct completion *pde_unload_completion;
- struct list_head pde_openers; /* who did ->open, but not ->release */
- spinlock_t pde_unload_lock; /* proc_fops checks and pde_users bumps */
- u8 namelen;
- char name[];
-};
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3,19,0)
+ struct proc_dir_entry {
+ unsigned int low_ino;
+ umode_t mode;
+ nlink_t nlink;
+ kuid_t uid;
+ kgid_t gid;
+ loff_t size;
+ const struct inode_operations *proc_iops;
+ const struct file_operations *proc_fops;
+ struct proc_dir_entry *next, *parent, *subdir;
+ void *data;
+ atomic_t count; /* use count */
+ atomic_t in_use; /* number of callers into module in progress; */
+ /* negative -> it's going away RSN */
+ struct completion *pde_unload_completion;
+ struct list_head pde_openers; /* who did ->open, but not ->release */
+ spinlock_t pde_unload_lock; /* proc_fops checks and pde_users bumps */
+ u8 namelen;
+ char name[];
+ };
+#else
+ struct proc_dir_entry {
+ unsigned int low_ino;
+ umode_t mode;
+ nlink_t nlink;
+ kuid_t uid;
+ kgid_t gid;
+ loff_t size;
+ const struct inode_operations *proc_iops;
+ const struct file_operations *proc_fops;
+ struct proc_dir_entry *parent;
+ struct rb_root subdir;
+ struct rb_node subdir_node;
+ void *data;
+ atomic_t count; /* use count */
+ atomic_t in_use; /* number of callers into module in progress; */
+ /* negative -> it's going away RSN */
+ struct completion *pde_unload_completion;
+ struct list_head pde_openers; /* who did ->open, but not ->release */
+ spinlock_t pde_unload_lock; /* proc_fops checks and pde_users bumps */
+ u8 namelen;
+ char name[];
+ };
+#endif
#endif
struct resource resource;
diff --git a/tools/mac/convert.py b/tools/mac/convert.py
index 270bf9169..0583c1c53 100755
--- a/tools/mac/convert.py
+++ b/tools/mac/convert.py
@@ -32,6 +32,7 @@ class DWARFParser(object):
'signed char': 'signed char',
'unsigned char': 'unsigned char',
'unsigned int': 'unsigned int',
+ 'unsigned __int128' : 'unsigned char', ### not sure if Vol 2 can represent 128-bit values natively??
}
def __init__(self):
@@ -46,12 +47,13 @@ def __init__(self):
self.all_local_vars = []
self.local_vars = []
self.anons = 0
+ self.typedefs = {}
def resolve(self, memb):
"""Lookup anonymouse member and replace it with a well known one."""
# Reference to another type
+
if isinstance(memb, str) and memb.startswith('<'):
-
try:
resolved = self.id_to_name[memb[1:]]
except:
@@ -67,6 +69,22 @@ def resolve(self, memb):
return ret
+ def fix_typedefs(self):
+ tmp_types = self.vtypes.copy()
+
+ for vname,vdata in tmp_types.items():
+ if vname.startswith("__unnamed_"):
+ statement_id = vname.split("_")[3]
+
+ if statement_id in self.typedefs:
+ tmp_types[self.typedefs[statement_id]] = vdata
+ else:
+ tmp_types[vname] = vdata
+ else:
+ tmp_types[vname] = vdata
+
+ return tmp_types
+
def resolve_refs(self):
"""Replace references with types."""
for v in self.vtypes:
@@ -133,6 +151,19 @@ def feed_line(self, line):
#else:
# print "line %s does not match" % line.strip()
+ def get_offset(self, data):
+ if 'AT_data_member_location' in data:
+ loc = data['AT_data_member_location']
+ if loc[0] == "x":
+ off = int(loc[1:], 16)
+ else:
+ off = int(loc)
+ else:
+ off = 0
+
+
+ return off
+
def process_statement(self, kind, level, data, statement_id):
"""Process a single parsed statement."""
new_level = int(level)
@@ -228,6 +259,7 @@ def process_statement(self, kind, level, data, statement_id):
elif kind == 'TAG_typedef':
try:
self.id_to_name[statement_id] = data['AT_type']
+ self.typedefs[data['AT_type'].replace("<","").replace(">","")] = data['AT_name']
except:
self.id_to_name[statement_id] = ['void']
@@ -235,11 +267,9 @@ def process_statement(self, kind, level, data, statement_id):
self.id_to_name[statement_id] = ['void'] # Don't need these
elif kind == 'TAG_variable' and level == '1':
- if 'AT_location' in data:
- split = data['AT_location'].split()
- if len(split) > 1:
- loc = int(split[1], 0)
- self.vars[data['AT_name']] = [loc, data['AT_type']]
+ loc = self.get_offset(data)
+ if loc != None:
+ self.vars[data['AT_name']] = [loc, data['AT_type']]
elif kind == 'TAG_subprogram':
# IDEK
@@ -247,16 +277,29 @@ def process_statement(self, kind, level, data, statement_id):
elif kind == 'TAG_member' and parent_kind == 'TAG_structure_type':
name = data.get('AT_name', "__unnamed_%s" % statement_id)
- off = int(data['AT_data_member_location'])
-
- if 'AT_bit_size' in data and 'AT_bit_offset' in data:
- full_size = int(data['AT_byte_size'])*8
- stbit = int(data['AT_bit_offset'])
- edbit = stbit + int(data['AT_bit_size'])
- stbit = full_size - stbit
- edbit = full_size - edbit
- stbit, edbit = edbit, stbit
- assert stbit < edbit
+
+ off = self.get_offset(data)
+
+ if 'AT_bit_size' in data and ('AT_bit_offset' in data or 'AT_data_bit_offset' in data):
+
+ if 'AT_bit_offset' in data:
+ stbit = int(data['AT_bit_offset'])
+ edbit = stbit + int(data['AT_bit_size'])
+ full_size = int(data['AT_byte_size'])*8
+ stbit = full_size - stbit
+ edbit = full_size - edbit
+ stbit, edbit = edbit, stbit
+ assert stbit < edbit
+
+ # high sierra +
+ else:
+ stbit = int(data['AT_data_bit_offset'], 16)
+
+ off = stbit / 8
+ stbit = stbit % 8
+
+ edbit = stbit + int(data['AT_bit_size'], 16)
+
memb_tp = ['BitField', dict(start_bit = stbit, end_bit = edbit)]
else:
memb_tp = data['AT_type']
@@ -266,19 +309,28 @@ def process_statement(self, kind, level, data, statement_id):
elif kind == 'TAG_member' and parent_kind == 'TAG_class_type':
name = data.get('AT_name', "__unnamed_%s" % statement_id)
- try:
- off = int(data['AT_data_member_location'])
- except:
- off = 0
-
- if 'AT_bit_size' in data and 'AT_bit_offset' in data:
- full_size = int(data['AT_byte_size'])*8
- stbit = int(data['AT_bit_offset'])
- edbit = stbit + int(data['AT_bit_size'])
- stbit = full_size - stbit
- edbit = full_size - edbit
- stbit, edbit = edbit, stbit
- assert stbit < edbit
+ off = self.get_offset(data)
+
+ if 'AT_bit_size' in data and ('AT_bit_offset' in data or 'AT_data_bit_offset' in data):
+
+ if 'AT_bit_offset' in data:
+ stbit = int(data['AT_bit_offset'])
+ edbit = stbit + int(data['AT_bit_size'])
+ full_size = int(data['AT_byte_size'])*8
+ stbit = full_size - stbit
+ edbit = full_size - edbit
+ stbit, edbit = edbit, stbit
+ assert stbit < edbit
+
+ # high sierra +
+ else:
+ stbit = int(data['AT_data_bit_offset'], 16)
+
+ off = stbit / 8
+ stbit = stbit % 8
+
+ edbit = stbit + int(data['AT_bit_size'], 16)
+
memb_tp = ['BitField', dict(start_bit = stbit, end_bit = edbit)]
else:
memb_tp = data['AT_type']
@@ -333,6 +385,7 @@ def process_variable(self, data):
def finalize(self):
"""Finalize the output."""
if self.vtypes:
+ self.vtypes = self.fix_typedefs()
self.vtypes = self.resolve_refs()
self.all_vtypes.update(self.vtypes)
if self.vars:
@@ -528,9 +581,11 @@ def convert_file(mac_file, outfile):
val = "%d" % int(val, 16)
if name == "AT_data_member_location":
- # skip +
- val = val[1:]
-
+ if val.startswith("+"):
+ val = int(val, 10)
+ else:
+ val = int(val, 16)
+
if name == "AT_type":
# convert {0x00000550} ( queue_chain_t )
# to decimal of int
diff --git a/volatility/constants.py b/volatility/constants.py
index 6d1044fe1..15e5f3963 100644
--- a/volatility/constants.py
+++ b/volatility/constants.py
@@ -23,7 +23,7 @@
import os, sys
-VERSION = "2.6"
+VERSION = "2.6.1"
SCAN_BLOCKSIZE = 1024 * 1024 * 10
diff --git a/volatility/dwarf.py b/volatility/dwarf.py
index 211cdb42b..01164f861 100644
--- a/volatility/dwarf.py
+++ b/volatility/dwarf.py
@@ -49,6 +49,7 @@ class DWARFParser(object):
'unsigned char': 'unsigned char',
'unsigned int': 'unsigned int',
'sizetype' : 'unsigned long',
+ 'ssizetype' : 'long',
}
@@ -195,14 +196,20 @@ def process_statement(self, kind, level, data, statement_id):
# If it's just a forward declaration, we want the name around,
# but there won't be a size
if 'DW_AT_declaration' not in data:
- self.vtypes[name] = [ int(data['DW_AT_byte_size'], self.base), {} ]
+ if 'DW_AT_byte_size' in data:
+ self.vtypes[name] = [ int(data['DW_AT_byte_size'], self.base), {} ]
+ else:
+ self.vtypes[name] = [ 0, {} ]
elif kind == 'DW_TAG_union_type':
name = data.get('DW_AT_name', "__unnamed_%s" % statement_id).strip('"')
self.name_stack[-1][1] = name
self.id_to_name[statement_id] = [name]
if 'DW_AT_declaration' not in data:
- self.vtypes[name] = [ int(data['DW_AT_byte_size'], self.base), {} ]
+ if 'DW_AT_byte_size' in data:
+ self.vtypes[name] = [ int(data['DW_AT_byte_size'], self.base), {} ]
+ else:
+ self.vtypes[name] = [ 0, {} ]
elif kind == 'DW_TAG_array_type':
self.name_stack[-1][1] = statement_id
@@ -216,7 +223,11 @@ def process_statement(self, kind, level, data, statement_id):
# If it's just a forward declaration, we want the name around,
# but there won't be a size
if 'DW_AT_declaration' not in data:
- sz = int(data['DW_AT_byte_size'], self.base)
+ if 'DW_AT_byte_size' in data:
+ sz = int(data['DW_AT_byte_size'], self.base)
+ else:
+ sz = 0
+
self.enums[name] = [sz, {}]
elif kind == 'DW_TAG_pointer_type':
diff --git a/volatility/plugins/addrspaces/amd64.py b/volatility/plugins/addrspaces/amd64.py
index 6c6b6bc5f..0abeb58c8 100644
--- a/volatility/plugins/addrspaces/amd64.py
+++ b/volatility/plugins/addrspaces/amd64.py
@@ -339,24 +339,24 @@ def entry_present(self, entry):
# Thus, we will treat it as present.
return present or ((entry & (1 << 11)) and not (entry & (1 << 10)))
-class Win10AMD64PagedMemory(WindowsAMD64PagedMemory):
- """Windows 10-specific AMD 64-bit address space.
+class SkipDuplicatesAMD64PagedMemory(WindowsAMD64PagedMemory):
+ """Windows 8/10-specific AMD 64-bit address space.
This class is used to filter out large sections of kernel mappings that are
- duplicates in recent versions of Windows 10.
+ duplicates in recent versions of Windows 8/10.
"""
order = 53
skip_duplicate_entries = True
def is_valid_profile(self, profile):
'''
- This address space should only be used with recent Windows 10 profiles
+ This address space should only be used with recent Windows 8/10 profiles
'''
valid = WindowsAMD64PagedMemory.is_valid_profile(self, profile)
major = profile.metadata.get('major', 0)
minor = profile.metadata.get('minor', 0)
- return valid and major >= 6 and minor >= 4
+ return valid and major >= 6 and minor >= 2
class LinuxAMD64PagedMemory(AMD64PagedMemory):
diff --git a/volatility/plugins/addrspaces/lime.py b/volatility/plugins/addrspaces/lime.py
index 9341e68b1..17b05e346 100644
--- a/volatility/plugins/addrspaces/lime.py
+++ b/volatility/plugins/addrspaces/lime.py
@@ -79,13 +79,3 @@ def parse_lime(self):
header = obj.Object("lime_header", offset = offset, vm = self.base)
- def translate(self, addr):
- """Find the offset in the file where a memory address can be found.
- @param addr: a memory address
- """
- firstram = self.runs[0][0]
-
- if addr < firstram:
- addr = firstram + addr
-
- return addrspace.AbstractRunBasedMemory.translate(self, addr)
diff --git a/volatility/plugins/addrspaces/macho.py b/volatility/plugins/addrspaces/macho.py
index 58f006b8e..10ddb1dbd 100644
--- a/volatility/plugins/addrspaces/macho.py
+++ b/volatility/plugins/addrspaces/macho.py
@@ -86,5 +86,10 @@ def parse_macho(self):
self.segs.append(seg)
# Since these values will be used a lot, make sure they aren't reread (ie, no objects in the runs list)
run = (int(seg.vmaddr), int(seg.fileoff), int(seg.vmsize))
+
+ self.as_assert(seg.vmaddr > 4096, "Invalid run address")
+ self.as_assert(self.vmsize >= 4096, "Invalid run size")
+
self.runs.append(run)
+
offset = offset + seg.cmdsize
diff --git a/volatility/plugins/bigpagepools.py b/volatility/plugins/bigpagepools.py
index 6341d860d..00755da32 100644
--- a/volatility/plugins/bigpagepools.py
+++ b/volatility/plugins/bigpagepools.py
@@ -31,6 +31,8 @@ class PoolTrackTypeOverlay(obj.ProfileModification):
# This ensures _POOL_DESCRIPTOR will be available,
# so we can copy the PoolType enumeration
+ # Win10 19041 (May 2020) removed _POOL_DESCRIPTOR, so switch to
+ # _OBJECT_TYPE_INITIALIZER instead
before = ['WindowsVTypes']
# PoolType didn't exist until Vista
@@ -38,9 +40,18 @@ class PoolTrackTypeOverlay(obj.ProfileModification):
'major': lambda x : x >= 6}
def modification(self, profile):
+ minor = profile.metadata.get("minor", 0)
+ build = profile.metadata.get("build", 0)
+
+ if minor < 4 or (minor == 4 and build < 19041):
+ pool_type_name = "_POOL_DESCRIPTOR"
+ else:
+ pool_type_name = "_OBJECT_TYPE_INITIALIZER"
+
+
profile.merge_overlay({
'_POOL_TRACKER_BIG_PAGES': [ None, {
- 'PoolType': [ None, profile.vtypes['_POOL_DESCRIPTOR'][1]['PoolType'][1]],
+ 'PoolType': [ None, profile.vtypes[pool_type_name][1]['PoolType'][1]],
'Key': [ None, ['String', dict(length = 4)]],
}],
})
@@ -68,8 +79,8 @@ def modification(self, profile):
(6, 2, '32bit') : [[92, 88]],
(6, 2, '64bit') : [[-5200, -5224]],
(6, 3, '32bit') : [[116, 120]],
- (6, 4, '64bit') : [[208, 184], [168, 192], [176, 168], [48, 40], [32, 24], [24, 48], [56, 32]],
- (6, 4, '32bit') : [[-168, -164]],
+ (6, 4, '64bit') : [[-72, -64], [-48, -10328], [208, 184], [168, 192], [176, 168], [48, 40], [32, 24], [24, 48], [56, 32], [-56, -10328], [24, 32], [-10344, -10336], [-10328, -10288], [-48, -10344], [-5208, -5200], [-188, -200], [40, 32], [-5200, -5208], [64, 24], [-10328, -10320], [32, 40], [-56, -64], [-10312, -10320], [24, 64], [-10304, -10344], [-64, -72], [-10328, -10336], [40, 48], [10304, 10296], [10304, 16], [-5192, -5184], [10320, 10312], [-64, -56], [-40, -64], [-10320, -10344], [-48, -72], [-72, -64], [-10304, -10328], [-56, -48], [-5224, -5216], [-10336, -10312], [-5168, -5208], [10304, 24], [10288, 24], [32, 72], [10336, 10328], [-56, -10344], [-10352, -10344]],
+ (6, 4, '32bit') : [[-168, -164], [-160, -172]],
}
version = (m.get('major', 0), m.get('minor', 0), m.get('memory_model', '32bit'))
@@ -78,7 +89,7 @@ def modification(self, profile):
if distance == None:
if version == (6, 3, '64bit'):
if m.get('build', 0) == 9601:
- distance = [[-5192, -5200], [-5224, -5232]]
+ distance = [[-5192, -5200], [-5224, -5232], [-5192, -5216]]
else:
distance = [[-5200, -5176], [-5224, -5232], [-5192, -5200]]
@@ -116,8 +127,12 @@ def generate_suggestions(self):
table_size = obj.Object("address",
offset = track_table - pair[1],
vm = self.obj_vm)
-
- if table_size != 0 and self.obj_vm.is_valid_address(table_base):
+
+ if (table_base % 0x1000 == 0 and
+ self.obj_vm.is_valid_address(table_base) and
+ table_size != 0 and
+ table_size % 0x1000 == 0 and
+ table_size < 0x1000000):
break
debug.debug("Distance Map: {0}".format(repr(self.distance)))
diff --git a/volatility/plugins/drivermodule.py b/volatility/plugins/drivermodule.py
index 008218b00..4e84ba205 100644
--- a/volatility/plugins/drivermodule.py
+++ b/volatility/plugins/drivermodule.py
@@ -33,7 +33,7 @@ class drivermodule(common.AbstractWindowsCommand):
def __init__(self, config, *args, **kwargs):
common.AbstractWindowsCommand.__init__(self, config, *args, **kwargs)
config.add_option('ADDR', short_option = 'a', default = None,
- help = 'Show info on module at or containing this address',
+ help = 'Show info on module at or containing this (base) address',
action = 'store', type = 'int')
def calculate(self):
@@ -44,24 +44,28 @@ def calculate(self):
mod_addrs = sorted(mods.keys())
drivers = dtree.DriverIrp(self._config).calculate()
- found_driver = "UNKNOWN"
+ driver_name = "UNKNOWN"
+ service_key = "UNKNOWN"
+ driver_name3 = "UNKNOWN"
+ module_name = "UNKNOWN"
if self._config.ADDR:
find_address = self._config.ADDR
- found_module = tasks.find_module(mods, mod_addrs, mods.values()[0].obj_vm.address_mask(find_address))
- if found_module:
- found_module = found_module.BaseDllName or found_module.FullDllName
- else:
- found_module = "UNKNOWN"
+ module_name = tasks.find_module(mods, mod_addrs, mods.values()[0].obj_vm.address_mask(find_address))
+ if module_name:
+ module_name = module_name.BaseDllName or module_name.FullDllName
for driver in drivers:
if driver.DriverStart <= find_address < driver.DriverStart + driver.DriverSize:
header = driver.get_object_header()
- found_driver = header.NameInfo.Name
+ driver_name = header.NameInfo.Name
+ driver_name = str(driver.get_object_header().NameInfo.Name or '')
+ service_key = str(driver.DriverExtension.ServiceKeyName or '')
+ driver_name3 = str(driver.DriverName or '')
break
- yield (found_module, found_driver)
+ yield (module_name, driver_name, service_key, driver_name3)
else:
for driver in drivers:
@@ -70,10 +74,9 @@ def calculate(self):
driver_name3 = str(driver.DriverName or '')
owning_module = tasks.find_module(mods, mod_addrs, mods.values()[0].obj_vm.address_mask(driver.DriverStart))
+ module_name = "UNKNOWN"
if owning_module:
module_name = owning_module.BaseDllName or owning_module.FullDllName
- else:
- module_name = "UNKNOWN"
yield (module_name, driver_name, service_key, driver_name3)
diff --git a/volatility/plugins/dumpfiles.py b/volatility/plugins/dumpfiles.py
index 5f5fdc7c5..e480665db 100644
--- a/volatility/plugins/dumpfiles.py
+++ b/volatility/plugins/dumpfiles.py
@@ -1076,7 +1076,7 @@ def generator(self, data):
summaryfo.write("\n")
yield(0, ["DataSectionObject",
Address(summaryinfo['fobj']),
- int(summaryinfo['pid']),
+ int(summaryinfo['pid']) if summaryinfo['pid'] else -1,
str(summaryinfo['name']),
str(summaryinfo['ofpath']),
Bytes(of.getvalue())])
@@ -1143,7 +1143,7 @@ def generator(self, data):
summaryfo.write("\n")
yield(0, ["SharedCacheMap",
Address(summaryinfo['fobj']),
- int(summaryinfo['pid']),
+ int(summaryinfo['pid']) if summaryinfo['pid'] else -1,
str(summaryinfo['name']),
str(summaryinfo['ofpath']),
Bytes(of.getvalue())])
diff --git a/volatility/plugins/filescan.py b/volatility/plugins/filescan.py
index 6b67da21b..d3fa58022 100644
--- a/volatility/plugins/filescan.py
+++ b/volatility/plugins/filescan.py
@@ -273,11 +273,14 @@ def unified_output(self, data):
def generator(self, data):
for mutant in data:
header = mutant.get_object_header()
+ name = str(header.NameInfo.Name or '')
+ CID = ""
if mutant.OwnerThread.is_valid():
thread = mutant.OwnerThread.dereference_as('_ETHREAD')
CID = "{0}:{1}".format(thread.Cid.UniqueProcess, thread.Cid.UniqueThread)
- else:
- CID = ""
+
+ if self._config.SILENT and not CID and not name:
+ continue
yield (0, [Address(mutant.obj_offset),
int(header.PointerCount),
@@ -285,7 +288,7 @@ def generator(self, data):
str(mutant.Header.SignalState),
Address(mutant.OwnerThread),
str(CID),
- str(header.NameInfo.Name or '')])
+ name])
def render_text(self, outfd, data):
self.table_header(outfd, [(self.offset_column(), '#018x'),
@@ -299,12 +302,14 @@ def render_text(self, outfd, data):
for mutant in data:
header = mutant.get_object_header()
-
+ name = str(header.NameInfo.Name or '')
+ CID = ""
if mutant.OwnerThread.is_valid():
thread = mutant.OwnerThread.dereference_as('_ETHREAD')
CID = "{0}:{1}".format(thread.Cid.UniqueProcess, thread.Cid.UniqueThread)
- else:
- CID = ""
+
+ if self._config.SILENT and not CID and not name:
+ continue
self.table_row(outfd,
mutant.obj_offset,
@@ -312,7 +317,7 @@ def render_text(self, outfd, data):
header.HandleCount,
mutant.Header.SignalState,
mutant.OwnerThread, CID,
- str(header.NameInfo.Name or ''))
+ name)
class PoolScanProcess(poolscan.PoolScanner):
diff --git a/volatility/plugins/gui/editbox.py b/volatility/plugins/gui/editbox.py
index 51204da2a..e3025da35 100644
--- a/volatility/plugins/gui/editbox.py
+++ b/volatility/plugins/gui/editbox.py
@@ -39,6 +39,7 @@
import volatility.plugins.common as common
import volatility.plugins.gui.messagehooks as messagehooks
import volatility.win32 as win32
+from volatility.renderers import TreeGrid
supported_controls = {
'edit' : 'COMCTL_EDIT',
@@ -444,6 +445,45 @@ def render_table(self, outfd, data):
# context, atom_class and is_wow64 are ignored
self.table_row(outfd, pid, proc_name, str(ctrl))
+ def unified_output(self, data):
+ #output as volatility json format
+ return TreeGrid([("Wnd Context", str),
+ ("Process ID", int),
+ ("ImageFileName", str),
+ ("IsWow64", str),
+ ("atom_class", str),
+ ("value-of WndExtra", str),
+ ("nChars", int),
+ ("selStart", int),
+ ("selEnd", int),
+ ("isPwdControl", int),
+ ("undoPos", int),
+ ("undoLen", int),
+ ("address-of undoBuf", str),
+ ("undoBuf", str),
+ ("Data", str),
+ ], self.generator(data))
+
+ def generator(self, data):
+ for context, atom_class, pid, proc_name, is_wow64, ctrl in data:
+ yield (0, [
+ str(context),
+ int(pid),
+ str(proc_name),
+ str('Yes' if is_wow64 else 'No'),
+ str(atom_class),
+ str(hex(int(ctrl.v()))),
+ int(ctrl.nChars),
+ int(ctrl.selStart),
+ int(ctrl.is_pwd()),
+ int(ctrl.undoPos),
+ int(ctrl.undoLen),
+ int(ctrl.selEnd),
+ str(ctrl.undoBuf),
+ str(ctrl.get_undo(no_crlf=True)),
+ str(ctrl.get_text()),
+ ])
+
def render_text(self, outfd, data):
"""Output the results as a text report
diff --git a/volatility/plugins/gui/vtypes/win10.py b/volatility/plugins/gui/vtypes/win10.py
new file mode 100644
index 000000000..6732d1974
--- /dev/null
+++ b/volatility/plugins/gui/vtypes/win10.py
@@ -0,0 +1,95 @@
+# Volatility
+# Copyright (C) 2007-2017 Volatility Foundation
+# Copyright (C) 2017 Michael Hale Ligh
+#
+# This file is part of Volatility.
+#
+# Volatility is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Volatility is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Volatility. If not, see .
+#
+
+import volatility.obj as obj
+
+class Win10x86_Gui(obj.ProfileModification):
+
+ before = ["XP2003x86BaseVTypes", "Win32Kx86VTypes", "AtomTablex86Overlay", "Win32KCoreClasses", "Win8x86Gui"]
+
+ conditions = {'os': lambda x: x == 'windows',
+ 'memory_model': lambda x: x == '32bit',
+ 'major': lambda x: x == 6,
+ 'minor': lambda x: x == 4}
+
+ def modification(self, profile):
+ build = profile.metadata.get('build', 0)
+
+ if build >= 15063:
+ profile.merge_overlay({
+ 'tagDESKTOP': [None, {
+ 'rpdeskNext': [0x10, ['pointer', ['tagDESKTOP']]],
+ 'rpwinstaParent': [0x14, ['pointer', ['tagWINDOWSTATION']]],
+ 'pheapDesktop': [0x40, ['pointer', ['tagWIN32HEAP']]],
+ 'PtiList': [0x5c, ['_LIST_ENTRY']],
+ }],
+ 'tagTHREADINFO': [None, {
+ 'ppi': [0xe0, ['pointer', ['tagPROCESSINFO']]],
+ 'PtiLink': [0x188, ['_LIST_ENTRY']],
+ }],
+ 'tagWND': [None, {
+ 'spwndNext': [0x34, ['pointer', ['tagWND']]],
+ 'spwndPrev': [0x38, ['pointer', ['tagWND']]],
+ 'spwndParent': [0x3c, ['pointer', ['tagWND']]],
+ 'spwndChild': [0x40, ['pointer', ['tagWND']]],
+ 'lpfnWndProc': [0x68, ['pointer', ['void']]], #?
+ 'pcls': [0x6c, ['pointer', ['tagCLS']]], #?
+ 'strName': [0x8c, ['_LARGE_UNICODE_STRING']], #?
+ }],
+ })
+
+class Win10x64_Gui(obj.ProfileModification):
+
+ before = ["Win32KCoreClasses", "Win8x64Gui"]
+
+ conditions = {'os': lambda x: x == 'windows',
+ 'memory_model': lambda x: x == '64bit',
+ 'major': lambda x: x == 6,
+ 'minor': lambda x: x == 4}
+
+ def modification(self, profile):
+ build = profile.metadata.get('build', 0)
+
+ if build >= 15063:
+ profile.merge_overlay({
+ 'tagDESKTOP': [None, {
+ 'rpdeskNext': [0x20, ['pointer64', ['tagDESKTOP']]],
+ 'rpwinstaParent': [0x28, ['pointer64', ['tagWINDOWSTATION']]],
+ 'pheapDesktop': [0x80, ['pointer', ['tagWIN32HEAP']]],
+ 'PtiList': [0xA8, ['_LIST_ENTRY']],
+ }],
+ 'tagTHREADINFO': [None, {
+ 'ppi': [0x190, ['pointer', ['tagPROCESSINFO']]],
+ # zzzSetDesktop
+ # mov [rbx+1B8h], rax
+ # lea rax, [rbx+2C8h]
+ # lea rcx, [rdi+0A8h] => int 29h
+ 'PtiLink': [0x2c8, ['_LIST_ENTRY']],
+ }],
+ 'tagWND': [None, {
+ 'spwndNext': [0x58, ['pointer64', ['tagWND']]],
+ 'spwndPrev': [0x60, ['pointer64', ['tagWND']]],
+ 'spwndParent': [0x68, ['pointer64', ['tagWND']]],
+ 'spwndChild': [0x70, ['pointer64', ['tagWND']]],
+ 'lpfnWndProc': [0xa0, ['pointer64', ['void']]],
+ 'pcls': [0xa8, ['pointer64', ['tagCLS']]],
+ 'strName': [0xe8, ['_LARGE_UNICODE_STRING']],
+ }],
+ })
\ No newline at end of file
diff --git a/volatility/plugins/iehistory.py b/volatility/plugins/iehistory.py
index c7f106383..3fbd77136 100644
--- a/volatility/plugins/iehistory.py
+++ b/volatility/plugins/iehistory.py
@@ -156,8 +156,6 @@ def calculate(self):
tags.append("LEAK")
if self._config.REDR:
tags.append("REDR")
-
- tags = ["DEST"]
## Define the record type based on the tag
tag_records = {
diff --git a/volatility/plugins/linux/check_afinfo.py b/volatility/plugins/linux/check_afinfo.py
index 31f483b2e..6905daf11 100644
--- a/volatility/plugins/linux/check_afinfo.py
+++ b/volatility/plugins/linux/check_afinfo.py
@@ -32,43 +32,34 @@
class linux_check_afinfo(linux_common.AbstractLinuxCommand):
"""Verifies the operation function pointers of network protocols"""
- def check_members(self, var_ops, var_name, members, modules):
-
+ def check_members(self, var_ops, members, modules):
for (hooked_member, hook_address) in self.verify_ops(var_ops, members, modules):
yield (hooked_member, hook_address)
def check_afinfo(self, var_name, var, op_members, seq_members, modules):
-
- for (hooked_member, hook_address) in self.check_members(var.seq_fops, var_name, op_members, modules):
+ for (hooked_member, hook_address) in self.check_members(var.seq_fops, op_members, modules):
yield (var_name, hooked_member, hook_address)
-
+
# newer kernels
if hasattr(var, "seq_ops"):
- for (hooked_member, hook_address) in self.check_members(var.seq_ops, var_name, seq_members, modules):
+ for (hooked_member, hook_address) in self.check_members(var.seq_ops, seq_members, modules):
yield (var_name, hooked_member, hook_address)
elif not self.is_known_address(var.seq_show, modules):
yield (var_name, "show", var.seq_show)
- def calculate(self):
- linux_common.set_plugin_members(self)
-
- modules = linux_lsmod.linux_lsmod(self._config).get_modules()
+ def _pre_4_18(self, modules, seq_members):
op_members = self.profile.types['file_operations'].keywords["members"].keys()
- seq_members = self.profile.types['seq_operations'].keywords["members"].keys()
tcp = ("tcp_seq_afinfo", ["tcp6_seq_afinfo", "tcp4_seq_afinfo"])
udp = ("udp_seq_afinfo", ["udplite6_seq_afinfo", "udp6_seq_afinfo", "udplite4_seq_afinfo", "udp4_seq_afinfo"])
protocols = [tcp, udp]
- for proto in protocols:
-
+ for proto in protocols:
struct_type = proto[0]
for global_var_name in proto[1]:
-
global_var_addr = self.addr_space.profile.get_symbol(global_var_name)
-
if not global_var_addr:
continue
@@ -76,6 +67,35 @@ def calculate(self):
for (name, member, address) in self.check_afinfo(global_var_name, global_var, op_members, seq_members, modules):
yield (name, member, address)
+
+ # https://lore.kernel.org/patchwork/patch/901043/
+ def _4_18_plus(self, modules, seq_members):
+ ops_structs = ["raw_seq_ops", "udp_seq_ops", "arp_seq_ops", "unix_seq_ops", "udp6_seq_ops"
+ "raw6_seq_ops", "tcp_seq_ops", "tcp4_seq_ops", "tcp6_seq_ops", "packet_seq_ops"]
+
+ for op_struct in ops_structs:
+ var_addr = self.profile.get_symbol(op_struct)
+ if var_addr == None:
+ continue
+
+ var = obj.Object("seq_operations", offset = var_addr, vm = self.addr_space)
+
+ for hooked_member, hook_address in self.check_members(var, seq_members, modules):
+ yield op_struct, hooked_member, hook_address
+
+ def calculate(self):
+ linux_common.set_plugin_members(self)
+
+ modules = linux_lsmod.linux_lsmod(self._config).get_modules()
+ seq_members = self.profile.types['seq_operations'].keywords["members"].keys()
+
+ if self.addr_space.profile.obj_has_member("tcp_seq_afinfo", "seq_fops"):
+ func = self._pre_4_18
+ else:
+ func = self._4_18_plus
+
+ for name, member, address in func(modules, seq_members):
+ yield name, member, address
def render_text(self, outfd, data):
diff --git a/volatility/plugins/linux/check_fops.py b/volatility/plugins/linux/check_fops.py
index d9ef2013b..78d054671 100644
--- a/volatility/plugins/linux/check_fops.py
+++ b/volatility/plugins/linux/check_fops.py
@@ -43,6 +43,8 @@ class linux_check_fop(linux_common.AbstractLinuxCommand):
def __init__(self, config, *args, **kwargs):
linux_common.AbstractLinuxCommand.__init__(self, config, *args, **kwargs)
self._config.add_option('INODE', short_option = 'i', default = None, help = 'inode to check', action = 'store', type='int')
+ # to prevent multiple plugins from walking the process list
+ self.tasks = []
def check_file_cache(self, f_op_members, modules):
for (_, _, file_path, file_dentry) in find_file.linux_find_file(self._config).walk_sbs():
@@ -53,6 +55,7 @@ def check_open_files_fop(self, f_op_members, modules):
# get all the members in file_operations, they are all function pointers
tasks = linux_pslist.linux_pslist(self._config).calculate()
for task in tasks:
+ self.tasks.append(task)
for filp, i in task.lsof():
for (hooked_member, hook_address) in self.verify_ops(filp.f_op, f_op_members, modules):
name = "{0:s} {1:d} {2:s}".format(task.comm, i, linux_common.get_path(task, filp))
@@ -60,53 +63,138 @@ def check_open_files_fop(self, f_op_members, modules):
def check_proc_fop(self, f_op_members, modules):
proc_mnt_addr = self.addr_space.profile.get_symbol("proc_mnt")
- if not proc_mnt_addr:
- return
+
+ if proc_mnt_addr:
+ proc_mnt_ptr = obj.Object("Pointer", offset = proc_mnt_addr, vm = self.addr_space)
+ proc_mnts = [proc_mnt_ptr.dereference_as("vfsmount")]
+ else:
+ proc_mnts = []
+ seen_pids = {}
+
+ if self.addr_space.profile.obj_has_member("nsproxy", "pid_ns"):
+ ns_member = "pid_ns"
+ else:
+ ns_member = "pid_ns_for_children"
- proc_mnt_ptr = obj.Object("Pointer", offset = proc_mnt_addr, vm = self.addr_space)
- proc_mnt = proc_mnt_ptr.dereference_as("vfsmount")
+ for task in self.tasks:
+ nsp = task.nsproxy
+ pidns = nsp.m(ns_member)
- root = proc_mnt.mnt_root
+ if pidns.v() in seen_pids:
+ continue
- for (hooked_member, hook_address) in self.verify_ops(root.d_inode.i_fop, f_op_members, modules):
- yield ("proc_mnt: root", hooked_member, hook_address)
+ seen_pids[pidns.v()] = 1
- # only check the root directory
- for dentry in root.d_subdirs.list_of_type("dentry", "d_u"):
- name = dentry.d_name.name.dereference_as("String", length = 255)
-
- for (hooked_member, hook_address) in self.verify_ops(dentry.d_inode.i_fop, f_op_members, modules):
- yield("proc_mnt: {0}".format(name), hooked_member, hook_address)
-
- def walk_proc(self, cur, f_op_members, modules, parent = ""):
+ proc_mnts.append(pidns.proc_mnt)
+
+ for proc_mnt in proc_mnts:
+ root = proc_mnt.mnt_root
+
+ for (hooked_member, hook_address) in self.verify_ops(root.d_inode.i_fop, f_op_members, modules):
+ yield ("proc_mnt: root: %x" % root.v(), hooked_member, hook_address)
+
+ # only check the root directory
+ if self.addr_space.profile.obj_has_member("dentry", "d_child"):
+ walk_member = "d_child"
+ else:
+ walk_member = "d_u"
+
+ for dentry in root.d_subdirs.list_of_type("dentry", walk_member):
+ name = dentry.d_name.name.dereference_as("String", length = 255)
+
+ for (hooked_member, hook_address) in self.verify_ops(dentry.d_inode.i_fop, f_op_members, modules):
+ yield("proc_mnt: {0:x}:{1}".format(root.v(), name), hooked_member, hook_address)
+
+ def _get_name(self, pde, parent):
+ if type(pde.name) == obj.Pointer:
+ s = pde.name.dereference_as("String", length = 255)
+ else:
+ s = pde.obj_vm.read(pde.name.obj_offset, pde.namelen)
+
+ return str(parent + "/" + str(s))
+
+ def _walk_proc_old(self, cur, f_op_members, modules, parent):
last_cur = None
+
while cur:
if cur.obj_offset in self.seen_proc:
if cur.obj_offset == last_cur:
break
+ if cur == cur.next:
+ break
cur = cur.next
- continue
+ if cur.obj_offset in self.seen_proc:
+ break
+ else:
+ continue
self.seen_proc[cur.obj_offset] = 1
+
+ name = self._get_name(cur, parent)
- name = cur.name.dereference_as("String", length = 255)
-
- fops = cur.proc_fops
-
- for (hooked_member, hook_address) in self.verify_ops(fops, f_op_members, modules):
+ for (hooked_member, hook_address) in self.verify_ops(cur.proc_fops, f_op_members, modules):
yield (name, hooked_member, hook_address)
subdir = cur.subdir
while subdir:
- for (name, hooked_member, hook_address) in self.walk_proc(subdir, f_op_members, modules):
- yield (name, hooked_member, hook_address)
+ for (subname, hooked_member, hook_address) in self._walk_proc_old(subdir, f_op_members, modules, name):
+ yield (subname, hooked_member, hook_address)
subdir = subdir.next
last_cur = cur.obj_offset
+ if cur == cur.next:
+ break
cur = cur.next
+ def _walk_rb(self, rb):
+ nodes = []
+
+ if not rb.is_valid():
+ return nodes
+
+ rboff = self.addr_space.profile.get_obj_offset("proc_dir_entry", "subdir_node")
+ pde = obj.Object("proc_dir_entry", offset = rb.v() - rboff, vm = self.addr_space)
+
+ nodes.append(pde)
+
+ for pde2 in self._walk_rb(rb.rb_left):
+ nodes.append(pde2)
+
+ for pde3 in self._walk_rb(rb.rb_right):
+ nodes.append(pde3)
+
+ return nodes
+
+ def _do_walk_proc_current(self, cur, f_op_members, modules, parent):
+ nodes = []
+
+ for pde in self._walk_rb(cur.subdir.rb_node):
+ name = self._get_name(pde, parent)
+
+ nodes.append((pde, name))
+
+ nodes = nodes + self._do_walk_proc_current(pde, f_op_members, modules, name)
+
+ return nodes
+
+ def _walk_proc_current(self, cur, f_op_members, modules, parent):
+ proc_entries = self._do_walk_proc_current(cur, f_op_members, modules, parent)
+
+ for (pde, name) in proc_entries:
+ for (hooked_member, hook_address) in self.verify_ops(pde.proc_fops, f_op_members, modules):
+ yield (name, hooked_member, hook_address)
+
+ def _walk_proc_dir(self, proc_root, f_op_members, modules, parent):
+ if self.addr_space.profile.obj_has_member("proc_dir_entry", "subdir_node"):
+ walk_proc = self._walk_proc_current
+ else:
+ walk_proc = self._walk_proc_old
+
+ for (name, hooked_member, hook_address) in walk_proc(proc_root, f_op_members, modules, parent):
+ yield (name, hooked_member, hook_address)
+
def check_proc_root_fops(self, f_op_members, modules):
self.seen_proc = {}
@@ -115,9 +203,21 @@ def check_proc_root_fops(self, f_op_members, modules):
for (hooked_member, hook_address) in self.verify_ops(proc_root.proc_fops, f_op_members, modules):
yield("proc_root", hooked_member, hook_address)
+
+ for (name, hooked_member, hook_address) in self._walk_proc_dir(proc_root, f_op_members, modules, "/proc"):
+ yield(name, hooked_member, hook_address)
- for (name, hooked_member, hook_address) in self.walk_proc(proc_root, f_op_members, modules):
- yield (name, hooked_member, hook_address)
+ def check_proc_net_fops(self, f_op_members, modules):
+ nslist_addr = self.addr_space.profile.get_symbol("net_namespace_list")
+ # < 2.6.23
+ if not nslist_addr:
+ return
+
+ nethead = obj.Object("list_head", offset = nslist_addr, vm = self.addr_space)
+
+ for net in nethead.list_of_type("net", "list"):
+ for (name, hooked_member, hook_address) in self._walk_proc_dir(net.proc_net, f_op_members, modules, "/proc/net"):
+ yield (name, hooked_member, hook_address)
def calculate(self):
linux_common.set_plugin_members(self)
@@ -126,6 +226,8 @@ def calculate(self):
f_op_members = self.profile.types['file_operations'].keywords["members"].keys()
f_op_members.remove('owner')
+ if 'mmap_supported_flags' in f_op_members:
+ f_op_members.remove('mmap_supported_flags')
if self._config.INODE:
inode = obj.Object("inode", offset=self._config.INODE, vm=self.addr_space)
@@ -136,8 +238,9 @@ def calculate(self):
yield("inode at {0:x}".format(inode.obj_offset), hooked_member, hook_address)
else:
- funcs = [self.check_open_files_fop, self.check_proc_fop, self.check_proc_root_fops, self.check_file_cache]
-
+ funcs = [self.check_open_files_fop, self.check_proc_fop, self.check_proc_root_fops, \
+ self.check_proc_net_fops, self.check_file_cache]
+
for func in funcs:
for (name, member, address) in func(f_op_members, modules):
yield (name, member, address)
diff --git a/volatility/plugins/linux/check_idt.py b/volatility/plugins/linux/check_idt.py
index b9887db65..311472641 100644
--- a/volatility/plugins/linux/check_idt.py
+++ b/volatility/plugins/linux/check_idt.py
@@ -70,10 +70,15 @@ def calculate(self):
check_idxs = list(range(0, 20)) + [128]
if self.profile.metadata.get('memory_model', '32bit') == "32bit":
- idt_type = "desc_struct"
+ if self.profile.has_type("gate_struct"):
+ idt_type = "gate_struct"
+ else:
+ idt_type = "desc_struct"
else:
if self.profile.has_type("gate_struct64"):
idt_type = "gate_struct64"
+ elif self.profile.has_type("gate_struct"):
+ idt_type = "gate_struct"
else:
idt_type = "idt_desc"
@@ -95,7 +100,11 @@ def calculate(self):
else:
low = ent.offset_low
middle = ent.offset_middle
- high = ent.offset_high
+
+ if hasattr(ent, "offset_high"):
+ high = ent.offset_high
+ else:
+ high = 0
idt_addr = (high << 32) | (middle << 16) | low
diff --git a/volatility/plugins/linux/check_inline_kernel.py b/volatility/plugins/linux/check_inline_kernel.py
index 1fc4c3bac..6d046123d 100644
--- a/volatility/plugins/linux/check_inline_kernel.py
+++ b/volatility/plugins/linux/check_inline_kernel.py
@@ -170,6 +170,8 @@ def check_proc_fop(self, f_op_members, modules):
def walk_proc(self, cur, f_op_members, modules, parent = ""):
while cur:
if cur.obj_offset in self.seen_proc:
+ if cur == cur.next:
+ break
cur = cur.next
continue
@@ -192,6 +194,8 @@ def walk_proc(self, cur, f_op_members, modules, parent = ""):
yield (sub_name, hooked_member, hook_type, hook_address)
subdir = subdir.next
+ if cur == cur.next:
+ break
cur = cur.next
def check_proc_root_fops(self, f_op_members, modules):
diff --git a/volatility/plugins/linux/check_modules.py b/volatility/plugins/linux/check_modules.py
index fd586ceec..493625683 100644
--- a/volatility/plugins/linux/check_modules.py
+++ b/volatility/plugins/linux/check_modules.py
@@ -50,7 +50,7 @@ def get_kset_modules(self):
mod = mod_kobj.mod
name = kobj.name.dereference_as("String", length = 32)
- if name.is_valid() and kobj.kref.refcount.counter > 2:
+ if name.is_valid() and kobj.reference_count() > 2:
ret[str(name)] = mod
return ret
diff --git a/volatility/plugins/linux/check_syscall.py b/volatility/plugins/linux/check_syscall.py
index 8055998aa..7e468d01f 100644
--- a/volatility/plugins/linux/check_syscall.py
+++ b/volatility/plugins/linux/check_syscall.py
@@ -45,11 +45,6 @@
class linux_check_syscall(linux_common.AbstractLinuxCommand):
""" Checks if the system call table has been altered """
-
- def __init__(self, config, *args, **kwargs):
- linux_common.AbstractLinuxCommand.__init__(self, config, *args, **kwargs)
- self._config.add_option('syscall-indexes', short_option = 'I', default = None, help = 'Path to unistd_{32,64}.h from the target machine', action = 'store', type = 'str')
-
def _get_table_size(self, table_addr, table_name):
"""
Returns the size of the table based on the next symbol
@@ -95,23 +90,25 @@ def _get_table_info_distorm(self):
if memory_model == '32bit':
mode = distorm3.Decode32Bits
- func = "sysenter_do_call"
+ funcs = ["sysenter_do_call"]
else:
mode = distorm3.Decode64Bits
- func = "system_call_fastpath"
+ funcs = ["system_call_fastpath", "do_int80_syscall_32"]
- func_addr = self.addr_space.profile.get_symbol(func)
+ for func in funcs:
+ func_addr = self.addr_space.profile.get_symbol(func)
+ if func_addr:
+ data = self.addr_space.read(func_addr, 64)
- if func_addr:
- data = self.addr_space.read(func_addr, 6)
-
- for op in distorm3.Decompose(func_addr, data, mode):
- if not op.valid:
- continue
+ for op in distorm3.Decompose(func_addr, data, mode):
+ if not op.valid:
+ continue
- if op.mnemonic == 'CMP':
- table_size = (op.operands[1].value) & 0xffffffff
- break
+ if op.mnemonic == 'CMP':
+ table_size = (op.operands[1].value) & 0xffffffff
+ break
+
+ break
return table_size
@@ -129,7 +126,6 @@ def _get_table_info(self, table_name):
return [table_addr, table_size]
-
def _compute_hook_sym_name(self, visible_mods, hidden_mods, call_addr):
mod_found = 0
for (module, _, __) in visible_mods:
@@ -151,8 +147,12 @@ def _compute_hook_sym_name(self, visible_mods, hidden_mods, call_addr):
return sym_name
- def _index_name(self, index_names, i):
- if i in index_names:
+ def _index_name(self, table_name, index_info, i):
+ index_names = index_info[table_name]
+
+ if len(index_names.keys()) == 0:
+ ret = ""
+ elif i in index_names:
ret = index_names[i]
else:
ret = "" % i
@@ -176,40 +176,21 @@ def _find_index(self, index_names, line_index):
return ret
- def get_syscalls(self, index_lines = None, get_hidden = False):
+ def get_syscalls(self, index_info = None, get_hidden = False, compute_name = True):
linux_common.set_plugin_members(self)
if get_hidden:
hidden_mods = list(linux_hidden_modules.linux_hidden_modules(self._config).calculate())
else:
hidden_mods = []
-
- visible_mods = linux_lsmod.linux_lsmod(self._config).calculate()
-
- if not index_lines:
- index_lines = self._find_and_parse_index_file()
-
- if index_lines:
- index_names = {}
- for line in index_lines.split("\n"):
- ents = line.split()
-
- if len(ents) == 3 and ents[0] == "#define":
- name = ents[1].replace("__NR_", "")
-
- # "(__NR_timer_create+1)"
- index = ents[2]
- if index[0] == "(":
- index = self._find_index(index_names, index)
- else:
- try:
- index = int(index)
- except ValueError:
- index = 999999 #well beyond any valid table index
-
- index_names[index] = name
+
+ if compute_name:
+ visible_mods = linux_lsmod.linux_lsmod(self._config).calculate()
else:
- index_names = None
+ visible_mods = []
+
+ if index_info == None:
+ index_info = self._find_and_parse_index_file()
table_name = self.addr_space.profile.metadata.get('memory_model', '32bit')
sym_addrs = self.profile.get_all_addresses()
@@ -223,57 +204,95 @@ def get_syscalls(self, index_lines = None, get_hidden = False):
addrs.append(("32bit", ia32_info))
for (table_name, (tableaddr, tblsz)) in addrs:
- table = obj.Object(theType = 'Array', offset = tableaddr, vm = self.addr_space, targetType = 'unsigned long', count = tblsz)
+ table = obj.Object(theType = 'Array', offset = tableaddr, vm = self.addr_space, targetType = 'unsigned long', count = tblsz + 1)
for (i, call_addr) in enumerate(table):
if not call_addr:
continue
- if index_names:
- idx_name = self._index_name(index_names, i)
- else:
- idx_name = ""
+ idx_name = self._index_name(table_name, index_info, i)
call_addr = int(call_addr)
if not call_addr in sym_addrs:
hooked = 1
-
sym_name = self._compute_hook_sym_name(visible_mods, hidden_mods, call_addr)
else:
hooked = 0
sym_name = self.profile.get_symbol_by_address("kernel", call_addr)
yield (tableaddr, table_name, i, idx_name, call_addr, sym_name, hooked)
-
- def _find_and_parse_index_file(self):
- memory_model = self.addr_space.profile.metadata.get('memory_model', '32bit')
- if memory_model == '32bit':
- header_path = "unistd_32.h"
+ def get_unistd_paths(self):
+ linux_common.set_plugin_members(self)
+
+ if self.profile.metadata.get('memory_model', '32bit') == "32bit":
+ is_32 = True
+ paths32 = ["/usr/include/i386-linux-gnu/asm/unistd_32.h", "/usr/include/asm/unistd_32.h"]
+ paths64 = []
else:
- header_path = "unistd_64.h"
+ is_32 = False
+ paths32 = ["/usr/include/x86_64-linux-gnu/asm/unistd_32.h", "/usr/include/asm/unistd_32.h"]
+ paths64 = ["/usr/include/x86_64-linux-gnu/asm/unistd_64.h", "/usr/include/asm/unistd_64.h"]
- find_file = linux_find_file.linux_find_file(self._config)
+ return is_32, paths32, paths64
+
+ def parse_index_file(self, index_lines):
+ index_names = {}
- inodes = []
+ for line in index_lines.split("\n"):
+ ents = line.split()
+
+ if len(ents) == 3 and ents[0] == "#define":
+ name = ents[1].replace("__NR_", "")
+
+ index = ents[2]
+ if index[0] == "(":
+ index = self._find_index(index_names, index)
+ else:
+ try:
+ index = int(index)
+ except ValueError:
+ index = 999999 #well beyond any valid table index
+
+ index_names[index] = name
+
+ return index_names
+
+ def _find_and_parse_index_file(self):
+ is_32, paths32, paths64 = self.get_unistd_paths()
+
+ index_tables = {"32bit" : {}, "64bit" : {}}
+
+ find_file = linux_find_file.linux_find_file(self._config)
for (_, _, file_path, file_dentry) in find_file.walk_sbs():
- ents = file_path.split("/")
- if len(ents) > 1 and ents[-1] == header_path:
- inode = file_dentry.d_inode
- inodes.append(inode)
+ # stop enumerating files (slow) once we find our wanted information
+ if (is_32 and len(index_tables["32bit"].keys()) > 0) or \
+ (len(index_tables["32bit"].keys()) > 0 and len(index_tables["64bit"].keys()) > 0):
+ break
+
+ elif file_path in paths32:
+ table = "32bit"
+ paths32.remove(file_path)
+
+ elif file_path in paths64:
+ table = "64bit"
+ paths64.remove(file_path)
+
+ else:
+ continue
- ret = None
- for inode in inodes:
buf = ""
+ inode = file_dentry.d_inode
for page in find_file.get_file_contents(inode):
buf = buf + page
- if len(buf) > 4096:
- ret = buf
- break
+ if len(buf) < 1024:
+ continue
- return ret
+ index_tables[table] = self.parse_index_file(buf)
+
+ return index_tables
def calculate(self):
"""
@@ -285,15 +304,7 @@ def calculate(self):
if not has_distorm:
debug.warning("distorm not installed. The best method to calculate the system call table size will not be used.")
- if self._config.SYSCALL_INDEXES:
- if not os.path.exists(self._config.SYSCALL_INDEXES):
- debug.error("Given syscall indexes file does not exist!")
-
- index_lines = open(self._config.SYSCALL_INDEXES, "r").read()
- else:
- index_lines = None
-
- for (tableaddr, table_name, i, idx_name, call_addr, sym_name, hooked) in self.get_syscalls(index_lines, True):
+ for (tableaddr, table_name, i, idx_name, call_addr, sym_name, hooked) in self.get_syscalls(None, True, True):
yield (tableaddr, table_name, i, idx_name, call_addr, sym_name, hooked)
def unified_output(self, data):
diff --git a/volatility/plugins/linux/common.py b/volatility/plugins/linux/common.py
index 037cecb33..958fa12aa 100644
--- a/volatility/plugins/linux/common.py
+++ b/volatility/plugins/linux/common.py
@@ -102,6 +102,10 @@ def verify_ops(self, ops, op_members, modules):
return
for check in op_members:
+ # redhat-specific garbage
+ if check.startswith("__UNIQUE_ID_rh_kabi_hide"):
+ continue
+
addr = int(ops.m(check))
if addr and addr != 0 and addr != -1:
@@ -149,16 +153,16 @@ def do_get_path(rdentry, rmnt, dentry, vfsmnt):
return []
while (dentry != rdentry or vfsmnt != rmnt) and dentry.d_name.name.is_valid():
- dname = dentry.d_name.name.dereference_as("String", length = MAX_STRING_LENGTH)
-
- ret_path.append(dname.strip('/'))
-
if dentry == vfsmnt.mnt_root or dentry == dentry.d_parent:
+ ret_path.append('')
if vfsmnt.mnt_parent == vfsmnt.v():
break
dentry = vfsmnt.mnt_mountpoint
vfsmnt = vfsmnt.mnt_parent
continue
+
+ dname = dentry.d_name.name.dereference_as("String", length = MAX_STRING_LENGTH)
+ ret_path.append(dname.strip('/'))
parent = dentry.d_parent
dentry = parent
@@ -186,8 +190,13 @@ def _get_path_file(task, filp):
rmnt = task.fs.get_root_mnt()
dentry = filp.dentry
vfsmnt = filp.vfsmnt
-
- return do_get_path(rdentry, rmnt, dentry, vfsmnt)
+
+ key = "%x|%x|%x|%x" % (rdentry.v(), rmnt.v(), dentry.v(), vfsmnt.v())
+
+ if not key in task.obj_vm.profile.dentry_cache:
+ task.obj_vm.profile.dentry_cache[key] = do_get_path(rdentry, rmnt, dentry, vfsmnt)
+
+ return task.obj_vm.profile.dentry_cache[key]
def get_new_sock_pipe_path(task, filp):
dentry = filp.dentry
diff --git a/volatility/plugins/linux/dentry_cache.py b/volatility/plugins/linux/dentry_cache.py
index c5845c3c3..b4fbfd2cf 100644
--- a/volatility/plugins/linux/dentry_cache.py
+++ b/volatility/plugins/linux/dentry_cache.py
@@ -47,7 +47,7 @@ def make_body(self, dentry):
i = dentry.d_inode
if i:
- ret = [0, path, i.i_ino, 0, i.i_uid, i.i_gid, i.i_size, i.i_atime, i.i_mtime, 0, i.i_ctime]
+ ret = [0, path, i.i_ino, 0, i.uid, i.gid, i.i_size, i.i_atime, i.i_mtime, 0, i.i_ctime]
else:
ret = [0, path] + [0] * 8
diff --git a/volatility/plugins/linux/find_file.py b/volatility/plugins/linux/find_file.py
index fa9665098..0a69a62a0 100644
--- a/volatility/plugins/linux/find_file.py
+++ b/volatility/plugins/linux/find_file.py
@@ -44,7 +44,10 @@ def __init__(self, config, *args, **kwargs):
config.remove_option("LIST_SBS")
config.add_option('LISTFILES', short_option = 'L', default = None, help = 'list all files cached in memory', action = 'count')
-
+
+ self.ptr_size = -1
+ self.seen_dents = set()
+
def _walk_sb(self, dentry_param, parent):
ret = []
@@ -54,22 +57,35 @@ def _walk_sb(self, dentry_param, parent):
walk_member = "d_u"
for dentry in dentry_param.d_subdirs.list_of_type("dentry", walk_member):
+ dentry_addr = dentry.v()
+
# corruption
- if dentry.v() == dentry_param.v():
+ if dentry_addr == dentry_param.v():
continue
+ if dentry_addr in self.seen_dents:
+ break
+
+ self.seen_dents.add(dentry_addr)
+
if not dentry.d_name.name.is_valid():
continue
+ inode = dentry.d_inode
+
+ ivalid = False
+ if inode and inode.is_valid():
+ if inode.i_ino == 0 or inode.i_ino > 100000000000:
+ continue
+ ivalid = True
+
# do not use os.path.join
# this allows us to have consistent paths from the user
name = dentry.d_name.name.dereference_as("String", length = 255)
new_file = parent + "/" + name
ret.append((new_file, dentry))
- inode = dentry.d_inode
-
- if inode and inode.is_valid() and inode.is_dir():
+ if ivalid and inode.is_dir():
ret = ret + self._walk_sb(dentry, new_file)
return ret
@@ -82,10 +98,10 @@ def _get_sbs(self):
return ret
- def walk_sbs(self):
- linux_common.set_plugin_members(self)
-
- sbs = self._get_sbs()
+ def walk_sbs(self, sbs = []):
+ if sbs == []:
+ linux_common.set_plugin_members(self)
+ sbs = self._get_sbs()
for (sb, sb_path) in sbs:
if sb_path != "/":
@@ -96,7 +112,7 @@ def walk_sbs(self):
rname = sb.s_root.d_name.name.dereference_as("String", length = 255)
if rname and len(rname) > 0:
yield (sb, sb_path, sb_path, sb.s_root)
-
+
for (file_path, file_dentry) in self._walk_sb(sb.s_root, parent):
yield (sb, sb_path, file_path, file_dentry)
@@ -147,12 +163,77 @@ def render_text(self, outfd, data):
self.table_row(outfd, inode_num, inode, file_path)
# from here down is code to walk the page cache and mem_map / mem_section page structs#
+ def radix_tree_is_internal_node(self, ptr):
+ if hasattr(ptr, "v"):
+ ptr = ptr.v()
+
+ return ptr & 3 == 1
+
def radix_tree_is_indirect_ptr(self, ptr):
return ptr & 1
def radix_tree_indirect_to_ptr(self, ptr):
return obj.Object("radix_tree_node", offset = ptr & ~1, vm = self.addr_space)
+ def index_is_valid(self, root, index):
+ node = root.rnode
+ if self.radix_tree_is_internal_node(node):
+ maxindex = (self.RADIX_TREE_MAP_SIZE << node.shift) - 1
+ else:
+ maxindex = 0
+
+ if index > maxindex:
+ node = None
+
+ return node
+
+ def is_sibling_entry(self, parent, node):
+ parent_ptr = parent.slots.obj_offset
+ node_ptr = node
+
+ return (parent_ptr <= node_ptr) and \
+ (node_ptr < parent_ptr + (self.ptr_size * self.RADIX_TREE_MAP_SIZE))
+
+ def get_slot_offset(self, parent, slot):
+ return (slot.v() - parent.slots.obj_offset) / self.ptr_size
+
+ def radix_tree_descend(self, parent, node, index):
+ offset = (index >> parent.shift) & self.RADIX_TREE_MAP_MASK
+ ent_ptr = parent.slots.obj_offset + (self.ptr_size * offset)
+ entry = obj.Object(theType="Pointer", targetType="unsigned long", offset = ent_ptr, vm = self.addr_space)
+
+ if 1: # TODO - multi order
+ if self.radix_tree_is_internal_node(entry):
+ print "multi internal"
+ if self.is_sibling_entry(parent, entry):
+ print "sibling ptr"
+ sibentry = self.radix_tree_indirect_to_ptr(entry)
+ offset = self.get_slot_offset(parent, sibentry)
+ entry = sibentry.v()
+
+ node = entry
+
+ return offset, node
+
+ def find_slot_post_4_11(self, root, index):
+ node = self.index_is_valid(root, index)
+ if node == None:
+ return None
+
+ slot = root.rnode.v()
+
+ while self.radix_tree_is_internal_node(node):
+ if node == 1:
+ return None
+ else:
+ parent = self.radix_tree_indirect_to_ptr(node)
+ offset, node = self.radix_tree_descend(parent, node, index)
+ slot_addr = parent.slots.obj_offset + (offset * self.ptr_size)
+ slot = obj.Object(theType="Pointer", targetType="unsigned long", offset = slot_addr, vm = self.addr_space)
+ slot = slot.v()
+
+ return slot
+
def radix_tree_lookup_slot(self, root, index):
self.RADIX_TREE_MAP_SHIFT = 6
self.RADIX_TREE_MAP_SIZE = 1 << self.RADIX_TREE_MAP_SHIFT
@@ -160,53 +241,121 @@ def radix_tree_lookup_slot(self, root, index):
node = root.rnode
- if self.radix_tree_is_indirect_ptr(node) == 0:
-
- if index > 0:
- return None
+ if not node.is_valid():
+ return None
- off = root.obj_offset + self.profile.get_obj_offset("radix_tree_root", "rnode")
- page = obj.Object("Pointer", offset = off, vm = self.addr_space)
- return page
+ post_4_11 = False
- node = self.radix_tree_indirect_to_ptr(node)
-
if hasattr(node, "height"):
height = node.height
- else:
+
+ height = height & 0xfff
+ # this check is needed as gcc seems to produce a 0 value when a shift value is negative
+ # Python throws a backtrace in this situation though
+ # setting to 0 will cause the later -1 to equal 0, and match the runtime behaviour of the kernel
+ if height == 0:
+ height = 1
+
+ elif hasattr(node, "path"):
height = node.path
-
- if hasattr(node, "shift"):
- shift = node.shift
+
+ height = height & 0xfff
+ # this check is needed as gcc seems to produce a 0 value when a shift value is negative
+ # Python throws a backtrace in this situation though
+ # setting to 0 will cause the later -1 to equal 0, and match the runtime behaviour of the kernel
+ if height == 0:
+ height = 1
+
else:
- shift = (height - 1) * self.RADIX_TREE_MAP_SHIFT
+ post_4_11 = True
- slot = -1
+ if post_4_11:
+ slot = self.find_slot_post_4_11(root, index)
+ else:
+ if self.radix_tree_is_indirect_ptr(node) == 0:
+ if index > 0:
+ return None
- while 1:
- idx = (index >> shift) & self.RADIX_TREE_MAP_MASK
- slot = node.slots[idx]
- node = self.radix_tree_indirect_to_ptr(slot)
- shift = shift - self.RADIX_TREE_MAP_SHIFT
- height = height - 1
- if height <= 0:
- break
+ off = root.obj_offset + self.profile.get_obj_offset("radix_tree_root", "rnode")
+ page = obj.Object("Pointer", offset = off, vm = self.addr_space)
+ return page
- if slot == -1:
- return None
+ node = self.radix_tree_indirect_to_ptr(node)
+
+ if hasattr(node, "shift"):
+ shift = node.shift
+ else:
+ shift = (height - 1) * self.RADIX_TREE_MAP_SHIFT
+
+ slot = -1
+
+ while 1:
+ idx = (index >> shift) & self.RADIX_TREE_MAP_MASK
+ slot = node.slots[idx]
+ node = self.radix_tree_indirect_to_ptr(slot)
+ shift = shift - self.RADIX_TREE_MAP_SHIFT
+ height = height - 1
+ if height <= 0:
+ break
+
+ if slot == -1:
+ return None
return slot
def SHMEM_I(self, inode):
offset = self.profile.get_obj_offset("shmem_inode_info", "vfs_inode")
return obj.Object("shmem_inode_info", offset = inode.obj_offset - offset, vm = self.addr_space)
+
+ def xa_is_internal(self, entry):
+ return (int(entry) & 3) == 2
- def find_get_page(self, inode, offset):
- page = self.radix_tree_lookup_slot(inode.i_mapping.page_tree, offset)
+ def xa_is_node(self, entry):
+ return entry and self.xa_is_internal(entry) and int(entry) > 4096
+
+ def xa_get_offset(self, index, node):
+ return (index >> node.shift) & 63
+
+ def xa_get_entry_from_offset(self, offset, node):
+ ent_ptr = node.slots.obj_offset + (8 * offset)
+ return obj.Object(theType="Pointer", targetType="unsigned long", offset = ent_ptr, vm = self.addr_space)
+
+ def xas_descend(self, offset, node):
+ offset = self.xa_get_offset(offset, node)
+
+ entry = self.xa_get_entry_from_offset(offset, node)
+ if entry == None:
+ return entry
+
+ p = entry.v()
+ if p & 3 == 2 and p < 250:
+ offset = p >> 2
+ entry = self.xa_get_entry_from_offset(offset, node)
+ if entry == None:
+ return entry
+
+ return entry
+
+ def walk_xarray(self, inode, offset):
+ entry = inode.i_mapping.i_pages.xa_head #.obj_offset
+
+ while self.xa_is_node(entry):
+ node = obj.Object("xa_node", offset = entry - 2, vm = self.addr_space)
+
+ if node.shift < 0:
+ break
+
+ entry = self.xas_descend(offset, node)
- #if not page:
- # FUTURE swapper_space support
- # print "no page"
+ return entry
+
+ def find_get_page(self, inode, offset):
+ if hasattr(inode.i_mapping, "page_tree"):
+ page = self.radix_tree_lookup_slot(inode.i_mapping.page_tree, offset)
+ elif hasattr(inode.i_mapping.i_pages, "rnode"):
+ page = self.radix_tree_lookup_slot(inode.i_mapping.i_pages, offset)
+ else:
+ page = self.walk_xarray(inode, offset)
return page
@@ -216,7 +365,8 @@ def get_page_contents(self, inode, idx):
if page_addr:
page = obj.Object("page", offset = page_addr, vm = self.addr_space)
phys_offset = page.to_paddr()
- if phys_offset > 0:
+
+ if page and phys_offset > 0:
phys_as = utils.load_as(self._config, astype = 'physical')
data = phys_as.zread(phys_offset, 4096)
else:
@@ -230,6 +380,11 @@ def get_page_contents(self, inode, idx):
# and handles the last page not being page_size aligned
def get_file_contents(self, inode):
linux_common.set_plugin_members(self)
+ if self.addr_space.profile.metadata.get('memory_model', '32bit') == "32bit":
+ self.ptr_size = 4
+ else:
+ self.ptr_size = 8
+
data = ""
file_size = inode.i_size
@@ -245,7 +400,7 @@ def get_file_contents(self, inode):
if idxs > 1000000000:
raise StopIteration
-
+
for idx in range(0, idxs):
data = self.get_page_contents(inode, idx)
diff --git a/volatility/plugins/linux/hidden_modules.py b/volatility/plugins/linux/hidden_modules.py
index 346b055eb..a78308d18 100644
--- a/volatility/plugins/linux/hidden_modules.py
+++ b/volatility/plugins/linux/hidden_modules.py
@@ -27,6 +27,7 @@
import re
import volatility.obj as obj
+import volatility.debug as debug
import volatility.plugins.linux.common as linux_common
import volatility.plugins.linux.lsmod as linux_lsmod
from volatility.renderers import TreeGrid
@@ -38,13 +39,19 @@ class linux_hidden_modules(linux_common.AbstractLinuxCommand):
def walk_modules_address_space(self, addr_space):
list_mods = [x[0].obj_offset for x in linux_lsmod.linux_lsmod(self._config).calculate()]
- # this for is for pre-2008 kernels:
- # https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/kernel/module.c?id=3a642e99babe0617febb6f402e1e063479f489db)
- if addr_space.profile.get_symbol("module_addr_min") == None:
- return
+ if addr_space.profile.get_symbol("module_addr_min"):
+ min_addr_sym = obj.Object("unsigned long", offset = addr_space.profile.get_symbol("module_addr_min"), vm = addr_space)
+ max_addr_sym = obj.Object("unsigned long", offset = addr_space.profile.get_symbol("module_addr_max"), vm = addr_space)
+
+ elif addr_space.profile.get_symbol("mod_tree"):
+ skip_size = addr_space.profile.get_obj_size("latch_tree_root")
+ addr = addr_space.profile.get_symbol("mod_tree")
+ ulong_size = addr_space.profile.get_obj_size("unsigned long")
- min_addr_sym = obj.Object("unsigned long", offset = addr_space.profile.get_symbol("module_addr_min"), vm = addr_space)
- max_addr_sym = obj.Object("unsigned long", offset = addr_space.profile.get_symbol("module_addr_max"), vm = addr_space)
+ min_addr_sym = obj.Object("unsigned long", offset = addr + skip_size, vm = addr_space)
+ max_addr_sym = obj.Object("unsigned long", offset = addr + skip_size + ulong_size, vm = addr_space)
+ else:
+ debug.error("Unsupport kernel verison. Please file a bug ticket that includes your kernel version and distribution.")
min_addr = min_addr_sym & ~0xfff
max_addr = (max_addr_sym & ~0xfff) + 0x1000
diff --git a/volatility/plugins/linux/keyboard_notifiers.py b/volatility/plugins/linux/keyboard_notifiers.py
index 60736c161..4faae4885 100644
--- a/volatility/plugins/linux/keyboard_notifiers.py
+++ b/volatility/plugins/linux/keyboard_notifiers.py
@@ -55,11 +55,6 @@ def calculate(self):
if not sym_name:
sym_name = "HOOKED"
- module = obj.Object("module", offset = 0xffffffffa03a15d0, vm = self.addr_space)
- sym = module.get_symbol_for_address(call_addr)
-
- sym_name = "%s: %s/%s" % (sym_name, module.name, sym)
-
hooked = 1
symbol_cache[call_addr] = sym_name
diff --git a/volatility/plugins/linux/linux_yarascan.py b/volatility/plugins/linux/linux_yarascan.py
index 2b84d5050..06ac48d96 100644
--- a/volatility/plugins/linux/linux_yarascan.py
+++ b/volatility/plugins/linux/linux_yarascan.py
@@ -103,14 +103,14 @@ def calculate(self):
address_space = self.addr_space)
for hit, address in scanner.scan(start_offset = kernel_start):
- yield (None, address, hit,
+ yield (None, address - self._config.REVERSE, hit,
scanner.address_space.zread(address - self._config.REVERSE, self._config.SIZE))
else:
tasks = self.filter_tasks()
for task in tasks:
scanner = VmaYaraScanner(task = task, rules = rules)
for hit, address in scanner.scan():
- yield (task, address, hit,
+ yield (task, address - self._config.REVERSE, hit,
scanner.address_space.zread(address - self._config.REVERSE, self._config.SIZE))
def render_text(self, outfd, data):
diff --git a/volatility/plugins/linux/lsmod.py b/volatility/plugins/linux/lsmod.py
index c07e11bad..0e383f9a0 100644
--- a/volatility/plugins/linux/lsmod.py
+++ b/volatility/plugins/linux/lsmod.py
@@ -274,7 +274,6 @@ def _parse_sections(self, module):
sort_idx = sorted_ents[address]
if name == ".symtab":
- print "FIXING"
str_section_data = self._fix_sym_table(module, sect_sa)
str_size = len(str_section_data)
size = str_size
@@ -282,11 +281,9 @@ def _parse_sections(self, module):
try:
next_addr = addrs[sort_idx+1]
size = next_addr - address
- #print "%x | %x | %8x | %d | %s" % (next_addr, address, size, sort_idx, name)
except IndexError:
# the last one
size = 0x4000 # guess?
- #print "one: size 0x4000 for %s" % name
sect_sa.append((name, address, size))
@@ -296,21 +293,16 @@ def _parse_sections(self, module):
try:
next_addr = addrs[sort_idx+1]
size = next_addr - address
- #print "%x | %x | %8x | %d | %s" % (next_addr, address, size, sort_idx, name)
except IndexError:
# the last one
size = 0x4000 # guess?
if name == ".symtab":
- print "FIXING 2"
size = str_size
section_data = str_section_data
else:
section_data = module.obj_vm.zread(address, size)
- #print "reading %d bytes from %x for section %s : got %d" % (size, address, name, len(section_data))
- print "adding section %s | %d with size %d | %d" % (name, sect_bytes, size, len(section_data))
-
updated_sections.append((name, address, size, sect_bytes, section_data))
sect_bytes = sect_bytes + size
@@ -431,8 +423,6 @@ def _make_sect_header_64(self, name, address, size, file_off, strtab_idx, symtab
return data
def _make_sect_header_32(self, name, address, size, file_off, strtab_idx, symtab_idx):
- #print "trying: %-30s | %.16x | %.8x | %d" % (name, address, size, file_off)
-
int_sh_type = self._calc_sect_type(name)
sh_name = struct.pack(" 126 or n == 63: # 63 = ?
+ new_name = True
+ break
+
+ if new_name == True:
+ s = obj.Object("Pointer", offset = mnt.mnt_devname.obj_offset + 16, vm = self.addr_space)
+ if not s.is_valid():
+ return ret
+
+ dev_name = s.dereference_as("String", length = linux_common.MAX_STRING_LENGTH)
+ if not dev_name.is_valid() or len(dev_name) < 3:
+ return ret
+
+ for nn in str(dev_name)[:3]:
+ n = ord(nn)
+ if n < 32 or n > 126 or n == 63: # 63 = ?
+ return ret
+
fstype = mnt.mnt_sb.s_type.name.dereference_as("String", length = linux_common.MAX_STRING_LENGTH)
- if not fstype.is_valid():
+ if not fstype.is_valid() or len(fstype) < 3:
return ret
- #print fs_types
- #if str(fstype) not in fs_types:
- # return ret
+ for nn in str(fstype)[:3]:
+ n = ord(nn)
+ if n < 32 or n > 126 or n == 63: # 63 = ?
+ return ret
path = linux_common.do_get_path(mnt.mnt_sb.s_root, mnt.mnt_parent, mnt.mnt_root, mnt)
-
- if path == []:
+ if path == [] or len(path) > 4096:
return ret
mnt_string = self._calc_mnt_string(mnt)
@@ -93,6 +118,7 @@ def calculate(self):
continue
seen = {}
+ mseen = {}
for mnt in outerlist.list_of_type(mnttype, "mnt_hash"):
if mnt.v() in seen:
break
@@ -103,20 +129,30 @@ def calculate(self):
break
if mnt.is_valid():
- hash_mnts[mnt] = 1
+ mkey = mnt.v()
+ if not mkey in mseen:
+ hash_mnts[mnt] = 1
+ mseen[mkey] = 1
else:
break
if mnt.mnt_parent.is_valid():
- hash_mnts[mnt.mnt_parent] = 1
-
- if mnt.mnt_parent.mnt_parent.is_valid():
- hash_mnts[mnt.mnt_parent.mnt_parent] = 1
+ mkey = mnt.mnt_parent.v()
+ if not mkey in mseen:
+ hash_mnts[mnt.mnt_parent] = 1
+ mseen[mkey] = 1
+
+ if mnt.mnt_parent.mnt_parent.is_valid():
+ mkey = mnt.mnt_parent.mnt_parent.v()
+ if not mkey in mseen:
+ hash_mnts[mnt.mnt_parent.mnt_parent] = 1
+ mseen[mkey] = 1
child_mnts = {}
for mnt in hash_mnts:
cseen = {}
for child_mnt in mnt.mnt_child.list_of_type(mnttype, "mnt_child"):
+
if not child_mnt.is_valid():
break
@@ -125,6 +161,9 @@ def calculate(self):
if child_mnt.v() in cseen:
break
+ if len(child_mnts.keys()) > 1024:
+ break
+
cseen[child_mnt.v()] = 1
if child_mnt.mnt_parent.is_valid():
@@ -139,8 +178,7 @@ def calculate(self):
for t in tmp_mnts:
tt = t.mnt_devname.dereference_as("String", length = linux_common.MAX_STRING_LENGTH)
if tt:
- tmp = str(tt)
- if len(str(tmp)) > 2 and (str(tmp)[0] == '/' or tmp in ['devtmpfs', 'proc', 'sysfs', 'nfsd', 'tmpfs', 'sunrpc', 'devpts', 'none']):
+ if len(str(tt)) > 2 or (len(str(tt)) > 1 and str(tt)[0] == '/'):
all_mnts.append(t)
list_mnts = {}
diff --git a/volatility/plugins/linux/netstat.py b/volatility/plugins/linux/netstat.py
index fd815540c..ce17a26b1 100644
--- a/volatility/plugins/linux/netstat.py
+++ b/volatility/plugins/linux/netstat.py
@@ -29,6 +29,7 @@
import volatility.plugins.linux.common as linux_common
import volatility.plugins.linux.lsof as linux_lsof
import volatility.plugins.linux.pslist as linux_pslist
+from volatility.renderers import TreeGrid
class linux_netstat(linux_pslist.linux_pslist):
"""Lists open sockets"""
@@ -36,8 +37,52 @@ class linux_netstat(linux_pslist.linux_pslist):
def __init__(self, config, *args, **kwargs):
linux_pslist.linux_pslist.__init__(self, config, *args, **kwargs)
self._config.add_option('IGNORE_UNIX', short_option = 'U', default = None, help = 'ignore unix sockets', action = 'store_true')
-
+
+ def unified_output(self,data):
+ return TreeGrid([("Proto", str),
+ ("Local IP", str),
+ ("Local Port", int),
+ ("Remote IP", str),
+ ("Remote Port", int),
+ ("State", str),
+ ("Process", str),
+ ("PID", str),
+ ("Name", str),
+ ],
+ self.generator(data))
+
+ def generator(self, data):
+ for task in data:
+ for ents in task.netstat():
+ if ents[0] == socket.AF_INET:
+ (_, proto, saddr, sport, daddr, dport, state) = ents[1]
+ yield(0, [
+ str(proto),
+ str(saddr),
+ int(sport),
+ str(daddr),
+ int(dport),
+ str(state),
+ str(task.comm),
+ str(task.pid),
+ str(name),
+ ])
+
+ elif ents[0] == 1 and not self._config.IGNORE_UNIX:
+ (name, inum) = ents[1]
+ yield(0, [
+ str("UNIX "+str(inum)),
+ "-",
+ 0,
+ "-",
+ 0,
+ "-",
+ str(task.comm),
+ str(task.pid),
+ str(name),
+ ])
# its a socket!
+
def render_text(self, outfd, data):
linux_common.set_plugin_members(self)
diff --git a/volatility/plugins/linux/pidhashtable.py b/volatility/plugins/linux/pidhashtable.py
index ba54d91ce..d41341100 100644
--- a/volatility/plugins/linux/pidhashtable.py
+++ b/volatility/plugins/linux/pidhashtable.py
@@ -29,6 +29,7 @@
import volatility.plugins.linux.common as linux_common
import volatility.plugins.linux.pslist as linux_pslist
+import volatility.plugins.linux.find_file as find_file
PIDTYPE_PID = 0
@@ -50,7 +51,7 @@ def _task_for_pid(self, upid, pid):
chained = 0
pid_tasks_0 = pid.tasks[0].first
-
+
if pid_tasks_0 == 0:
chained = 1
pnext_addr = upid.obj_offset + self.profile.get_obj_offset("upid", "pid_chain") + self.profile.get_obj_offset("hlist_node", "next")
@@ -65,8 +66,9 @@ def _task_for_pid(self, upid, pid):
yield task
def _walk_upid(self, upid):
-
- while upid:
+ seen = set()
+ while upid and upid.is_valid() and upid.v() not in seen:
+ seen.add(upid.v())
pid = self.get_obj(upid.obj_offset, "pid", "numbers")
@@ -100,6 +102,8 @@ def calculate_v3(self):
pidhash = self._get_pidhash_array()
+ seen_upid = set()
+
for hlist in pidhash:
# each entry in the hlist is a upid which is wrapped in a pid
ent = hlist.first
@@ -107,6 +111,10 @@ def calculate_v3(self):
while ent.v():
upid = self.get_obj(ent.obj_offset, "upid", "pid_chain")
+ if upid.v() in seen_upid:
+ break
+ seen_upid.add(upid.v())
+
for task in self._walk_upid(upid):
if not task.obj_offset in self.seen_tasks:
self.seen_tasks[task.obj_offset] = 1
@@ -191,10 +199,163 @@ def get_both(self):
return func
+ def radix_tree_is_internal_node(self, ptr):
+ if hasattr(ptr, "v"):
+ ptr = ptr.v()
+
+ return ptr & 3 == 1
+
+ def radix_tree_is_indirect_ptr(self, ptr):
+ return ptr & 1
+
+ def radix_tree_indirect_to_ptr(self, ptr):
+ return obj.Object("radix_tree_node", offset = ptr & ~1, vm = self.addr_space)
+
+
+ def _walk_idr_node(self, node, height, idx):
+ for i in range(self.RADIX_TREE_MAP_SIZE):
+ shift = (height - 1) * self.RADIX_TREE_MAP_SHIFT
+
+ slot = node.slots[i]
+
+ if slot == 0:
+ continue
+
+ slot = self.radix_tree_indirect_to_ptr(slot)
+
+ if height == 1:
+ yield slot
+ else:
+ child_index = idx | (i << shift)
+ for child_slot in self._walk_idr_node(slot, height - 1, child_index):
+ yield child_slot
+
+ # adapted from tools.c of crash
+ def _walk_pid_ns_idr(self):
+ self.RADIX_TREE_MAP_SHIFT = 6
+ self.RADIX_TREE_MAP_SIZE = 1 << self.RADIX_TREE_MAP_SHIFT
+ self.RADIX_TREE_MAP_MASK = self.RADIX_TREE_MAP_SIZE - 1
+
+ ns_addr = self.addr_space.profile.get_symbol("init_pid_ns")
+ ns = obj.Object("pid_namespace", offset = ns_addr, vm = self.addr_space)
+
+ root = ns.idr.idr_rt
+
+ node = root.rnode
+ if not node.is_valid():
+ return
+
+ height = 0
+
+ if hasattr(node, "height"):
+ height = node.height
+
+ if height == 0:
+ height = 1
+
+ is_indirect = self.radix_tree_is_indirect_ptr(node)
+ node = self.radix_tree_indirect_to_ptr(node)
+
+ if is_indirect and hasattr(node, "shift"):
+ height = (node.shift / self.RADIX_TREE_MAP_SHIFT) + 1
+
+ if height == 0:
+ yield node
+ else:
+ for child_node in self._walk_idr_node(node, height, 0):
+ yield child_node
+
+ def _task_for_radix_pid_node(self, node):
+ pid = obj.Object("pid", offset = node.v(), vm = self.addr_space)
+
+ pid_tasks_0 = pid.tasks[0].first
+
+ if pid_tasks_0 == 0:
+ task = None
+ else:
+ if self.addr_space.profile.obj_has_member("task_struct", "pids"):
+ offset = self.addr_space.profile.get_obj_offset("task_struct", "pids")
+ elif self.addr_space.profile.obj_has_member("task_struct", "pid_links"):
+ offset = self.addr_space.profile.get_obj_offset("task_struct", "pid_links")
+ else:
+ debug.error("Unable to determine task_struct pids member")
+
+ task = obj.Object("task_struct", offset = pid_tasks_0 - offset, vm = self.addr_space)
+
+ return task
+
+ def _do_walk_xarray(self, ff, node, height, index):
+ shift = (height - 1) * self.XA_CHUNK_SHIFT
+
+ for i in range(self.XA_CHUNK_SIZE):
+ slot = ff.xa_get_entry_from_offset(i, node)
+ if slot == None:
+ continue
+
+ if (slot.v() & self.XARRAY_TAG_MASK) == self.XARRAY_TAG_INTERNAL:
+ slot = obj.Object("xa_node", offset = slot.v() & ~self.XARRAY_TAG_INTERNAL, vm = self.addr_space)
+
+ if height == 1:
+ yield slot
+ else:
+ new_index = index | (i << shift)
+ for new_slot in self._do_walk_xarray(ff, slot, height - 1, new_index):
+ yield new_slot
+
+ def _walk_xarray_pids(self):
+ ff = find_file.linux_find_file(self._config)
+ linux_common.set_plugin_members(ff)
+
+ self.XARRAY_TAG_MASK = 3
+ self.XARRAY_TAG_INTERNAL = 2
+
+ self.XA_CHUNK_SHIFT = 6
+ self.XA_CHUNK_SIZE = 1 << self.XA_CHUNK_SHIFT
+ self.XA_CHUNK_MASK = self.XA_CHUNK_SIZE - 1
+
+ ns_addr = self.addr_space.profile.get_symbol("init_pid_ns")
+ ns = obj.Object("pid_namespace", offset = ns_addr, vm = self.addr_space)
+
+ xarray = ns.idr.idr_rt
+
+ if not xarray.is_valid():
+ return
+
+ root = xarray.xa_head.v()
+
+ is_internal = ff.xa_is_internal(root)
+
+ if root & self.XARRAY_TAG_MASK != 0:
+ root = root & ~self.XARRAY_TAG_MASK
+
+ height = 0
+ node = obj.Object("xa_node", offset = root, vm = self.addr_space)
+
+ if is_internal and hasattr(node, "shift"):
+ height = (node.shift / self.XA_CHUNK_SHIFT) + 1
+
+ for node in self._do_walk_xarray(ff, node, height, 0):
+ if node and node.is_valid():
+ yield node
+
+ def pid_namespace_idr(self):
+ if not self.addr_space.profile.has_type("radix_tree_root"):
+ func = self._walk_xarray_pids
+ elif self.addr_space.profile.obj_has_member("radix_tree_root", "rnode"):
+ func = self._walk_pid_ns_idr
+ else:
+ func = self._walk_xarray_pids
+
+ for node in func():
+ task = self._task_for_radix_pid_node(node)
+ if task != None:
+ yield task
+
def determine_func(self):
pidhash = self.addr_space.profile.get_symbol("pidhash")
pid_hash = self.addr_space.profile.get_symbol("pid_hash")
pidhash_shift = self.addr_space.profile.get_symbol("pidhash_shift")
+ pid_idr = self.profile.obj_has_member("pid_namespace", "idr")
if pid_hash and pidhash_shift:
func = self.get_both()
@@ -205,14 +366,22 @@ def determine_func(self):
elif pidhash:
func = self.refresh_pid_hash_task_table
+ elif pid_idr:
+ func = self.pid_namespace_idr
+
+ else:
+ self.profile_unsupported("determine_func")
+
return func
def calculate(self):
linux_common.set_plugin_members(self)
func = self.determine_func()
-
+
for task in func():
- yield task
+ if 0 < task.pid < 66000:
+ if task.parent.is_valid():
+ yield task
diff --git a/volatility/plugins/linux/psscan.py b/volatility/plugins/linux/psscan.py
index 3064ca6d9..e5b7e3762 100644
--- a/volatility/plugins/linux/psscan.py
+++ b/volatility/plugins/linux/psscan.py
@@ -61,32 +61,21 @@ def calculate(self):
needles.append(struct.pack(fmt, addr))
if len(needles) == 0:
- debug.error("Unable to scan for processes. Please file a bug report.")
-
- back_offset = phys_addr_space.profile.get_obj_offset("task_struct", "sched_class")
-
- scanner = poolscan.MultiPoolScanner(needles)
-
- for _, offset in scanner.scan(phys_addr_space):
- ptask = obj.Object("task_struct", offset = offset - back_offset, vm = phys_addr_space)
-
- if not ptask.exit_state.v() in [0, 16, 32, 16|32]:
- continue
-
- if not (0 < ptask.pid < 66000):
- continue
-
- yield ptask
-
-
-
-
-
-
-
+ debug.warning("Unable to scan for processes. Please file a bug report.")
+ else:
+ back_offset = phys_addr_space.profile.get_obj_offset("task_struct", "sched_class")
+ scanner = poolscan.MultiPoolScanner(needles)
+ for _, offset in scanner.scan(phys_addr_space):
+ ptask = obj.Object("task_struct", offset = offset - back_offset, vm = phys_addr_space)
+ if not ptask.exit_state.v() in [0, 16, 32, 16|32]:
+ continue
+ if not (0 < ptask.pid < 66000):
+ continue
+ yield ptask
+
diff --git a/volatility/plugins/linux/recover_filesystem.py b/volatility/plugins/linux/recover_filesystem.py
index ccfc9cb70..0b5bd3d93 100644
--- a/volatility/plugins/linux/recover_filesystem.py
+++ b/volatility/plugins/linux/recover_filesystem.py
@@ -47,7 +47,7 @@ def _fix_metadata(self, file_path, file_dentry):
out_path = os.path.join(self._config.DUMP_DIR, *ents)
os.chmod(out_path, inode.i_mode & 00777)
- os.chown(out_path, inode.i_uid, inode.i_gid)
+ os.chown(out_path, inode.uid, inode.gid)
os.utime(out_path, (inode.i_atime.tv_sec, inode.i_mtime.tv_sec))
def _write_file(self, ff, file_path, file_dentry):
diff --git a/volatility/plugins/linux/tty_check.py b/volatility/plugins/linux/tty_check.py
index ac5f6652f..627f8f222 100644
--- a/volatility/plugins/linux/tty_check.py
+++ b/volatility/plugins/linux/tty_check.py
@@ -27,6 +27,8 @@
import volatility.debug as debug
import volatility.plugins.linux.common as linux_common
import volatility.plugins.linux.lsmod as linux_lsmod
+from volatility.renderers import TreeGrid
+from volatility.renderers.basic import Address
class linux_check_tty(linux_common.AbstractLinuxCommand):
"""Checks tty devices for hooks"""
@@ -70,6 +72,16 @@ def calculate(self):
yield (name, recv_buf, sym_name, hooked)
+ def unified_output(self, data):
+ return TreeGrid([("Name", str),
+ ("Address", Address),
+ ("Symbol", str)],
+ self.generator(data))
+
+ def generator(self, data):
+ for name, call_addr, sym_name, _hooked in data:
+ yield (0, [str(name), Address(call_addr), str(sym_name)])
+
def render_text(self, outfd, data):
self.table_header(outfd, [("Name", "<16"), ("Address", "[addrpad]"), ("Symbol", "<30")])
for name, call_addr, sym_name, _hooked in data:
diff --git a/volatility/plugins/mac/check_fop.py b/volatility/plugins/mac/check_fop.py
index c869e6231..d36478b0e 100644
--- a/volatility/plugins/mac/check_fop.py
+++ b/volatility/plugins/mac/check_fop.py
@@ -43,7 +43,9 @@ def _walk_vfstbllist(self, kaddr_info):
table_ptr = self.addr_space.profile.get_symbol("_vfstbllist")
table = obj.Object(theType = "Array", targetType = "vfstable", offset = table_ptr, count = table_size, vm = self.addr_space)
vfs_op_members = self.profile.types['vfsops'].keywords["members"].keys()
- vfs_op_members.remove("vfs_reserved")
+
+ if "vfs_reserved" in vfs_op_members:
+ vfs_op_members.remove("vfs_reserved")
for vfs in table:
if not vfs.is_valid():
diff --git a/volatility/plugins/mac/check_mig_table.py b/volatility/plugins/mac/check_mig_table.py
index 8c26e8e16..13e4a8283 100644
--- a/volatility/plugins/mac/check_mig_table.py
+++ b/volatility/plugins/mac/check_mig_table.py
@@ -35,18 +35,26 @@ class mac_check_mig_table(common.AbstractMacCommand):
def calculate(self):
common.set_plugin_members(self)
- # we can't use an array as the size of mig_hash_entry
- # depends on if MAC_COUNTERS is set, which changes between kernels
- # mig_table_max_displ is declared directly after mig_buckets
- # which allows us to calculate the size of each entry dynamically
-
- di_addr = self.addr_space.profile.get_symbol("_mig_table_max_displ")
+ n = 1024
mig_buckets_addr = self.addr_space.profile.get_symbol("_mig_buckets")
- ele_size = (di_addr - mig_buckets_addr) / 1024
+ if self.addr_space.profile.has_type("mig_hash_t"):
+ ele_size = self.addr_space.profile.get_obj_size("mig_hash_t")
+
+ ele_type = "mig_hash_t"
+
+ else:
+ # we can't use an array as the size of mig_hash_entry
+ # depends on if MAC_COUNTERS is set, which changes between kernels
+ # mig_table_max_displ is declared directly after mig_buckets
+ # which allows us to calculate the size of each entry dynamically
+ di_addr = self.addr_space.profile.get_symbol("_mig_table_max_displ")
+ ele_size = (di_addr - mig_buckets_addr) / n
+
+ ele_type = "mig_hash_entry"
- for i in range(1024):
- entry = obj.Object("mig_hash_entry", offset = mig_buckets_addr + (i * ele_size), vm = self.addr_space)
+ for i in range(n):
+ entry = obj.Object(ele_type, offset = mig_buckets_addr + (i * ele_size), vm = self.addr_space)
if entry.routine == 0:
continue
diff --git a/volatility/plugins/mac/dump_map.py b/volatility/plugins/mac/dump_map.py
index 150e8fbcc..3133a99a2 100644
--- a/volatility/plugins/mac/dump_map.py
+++ b/volatility/plugins/mac/dump_map.py
@@ -29,294 +29,76 @@
import volatility.obj as obj
import volatility.debug as debug
import volatility.plugins.mac.common as common
-import volatility.plugins.mac.proc_maps as proc_maps
-import struct
-import WKdm
+import volatility.plugins.mac.pstasks as pstasks
-class mac_dump_maps(proc_maps.mac_proc_maps):
- """ Dumps memory ranges of process(es), optionally including pages in compressed swap """
+class mac_dump_maps(pstasks.mac_tasks):
+ """ Dumps memory ranges of process(es) """
def __init__(self, config, *args, **kwargs):
- proc_maps.mac_proc_maps.__init__(self, config, *args, **kwargs)
+ pstasks.mac_tasks.__init__(self, config, *args, **kwargs)
self._config.add_option('MAP-ADDRESS', short_option = 's', default = None, help = 'Filter by starting address of map', action = 'store', type = 'long')
- self._config.add_option('OUTPUTFILE', short_option = 'O', default = None, help = 'Output File', action = 'store', type = 'str')
- self._config.add_option('DECOMPRESS-SWAP', default = False, help = 'Also decompress pages in compressed swap', action = 'store_true')
- self._config.add_option('ONLY-DECOMPRESSED-SWAP', default = False, help = 'Dump only successfully decompressed swap pages, nothing else', action = 'store_true')
- self._config.add_option('SKIP-WRITING', short_option = 't',
- help = 'Skip writing pages, just print stats and optionally test decompression',
- action = 'store_true', default = False)
-
- # defined in osfmk/vm/vm_compressor.h; proper decompression relies on these
- self.C_SEG_BUFSIZE = (1024 * 256)
- self.C_SEG_ALLOCSIZE = (self.C_SEG_BUFSIZE + 4096)
- self.C_SEG_SLOT_ARRAYS = 6
- self.C_SEG_SLOT_ARRAY_SIZE = 64
- self.C_SEG_SLOT_ARRAY_MASK = (self.C_SEG_SLOT_ARRAY_SIZE - 1)
- self.C_SEG_OFFSET_ALIGNMENT_MASK = 0x3
-
- # defined in osfmk/vm/vm_compressor_pager.c; proper slot lookup relies on these
-
- self.COMPRESSOR_SLOTS_CHUNK_SIZE = 512
- self.COMPRESSOR_SLOTS_PER_CHUNK = 128 # (COMPRESSOR_SLOTS_CHUNK_SIZE / sizeof (compressor_slot_t)), compressor_slot_t is a 32-bit int
-
- # WKdm decompression in Python
- self.wkdm=WKdm.WKdm()
-
- self.dest = [0] * self.wkdm.PAGE_SIZE_IN_WORDS
-
- self.successful_decompressions = 0
+ self._config.add_option('DUMP-DIR', short_option = 'D', default = None,
+ cache_invalidator = False,
+ help = 'Directory in which to dump extracted files')
# don't try to deal with maps larger than this--just skip them
- self.MAXMAPSIZE = 16000000000
-
- def compressed_page_location(self, outfd, map, addr):
- # return (seg, idx) pair that identifies the location of a
- # compressed page starting at 'addr' and belonging to a
- # vm_map_entry 'map' in the compressor store. Returns (None,
- # None) if the compressor doesn't own this page.
-
- # based on compressor_pager_slot_lookup() in osfmk/vm/vm_compressor_pager.c and
- # c_decompress_page in osfmk/vm_compressor.c
-
- vm_obj = map.object.vm_object
- if not vm_obj.is_valid() or vm_obj.pager_created == 0 or vm_obj.pager_initialized == 0 or vm_obj.pager_ready == 0:
- # compressor can't own pages from this object--object has no pager or pager isn't initialized
- (seg, idx) = (None, None)
- else:
- #print "PAGING OFFSET: " + str(vm_obj.paging_offset)
- addr += vm_obj.paging_offset
- page_num = addr / self.wkdm.PAGE_SIZE_IN_BYTES
- pager = vm_obj.pager.dereference_as("compressor_pager")
- pager_name = pager.cpgr_pager_ops.memory_object_pager_name.dereference_as("char")
- if pager_name != "c": # "compressor pager" in pager ops
- # if the pager isn't the compressor_pager, then move on
- # print " Corresponding pager " + pager_name + " isn't the compressor pager. Substituting zero page."
- (seg, idx) = (None, None)
- elif not pager.is_valid():
- # pager isn't initialized
- outfd.write(" Pager isn't initialized. Substituting zero page.\n")
- (seg, idx) = (None, None)
- # page is out of range
- elif page_num > pager.cpgr_num_slots:
- outfd.write(" page_num > pager.cpgr_num_slots: " + str(page_num) + " " + str(pager.cpgr_num_slots) + ". Substituting zero page.\n")
- (seg, idx) = (None, None)
- else:
- #print "## " + str(pager.cpgr_num_slots)
- #print "## " + str(self.COMPRESSOR_SLOTS_PER_CHUNK)
- num_chunks = (pager.cpgr_num_slots + self.COMPRESSOR_SLOTS_PER_CHUNK - 1) / self.COMPRESSOR_SLOTS_PER_CHUNK
- if num_chunks > 1:
- # array of chunks
- chunk_idx = page_num / self.COMPRESSOR_SLOTS_PER_CHUNK
- cpgr_islots = obj.Object("Array", offset = pager.cpgr_slots.cpgr_islots, targetType = "Pointer",
- count = num_chunks, vm = self.addr_space)
- chunks_ptr = cpgr_islots[chunk_idx]
- if chunks_ptr.is_valid():
- chunk = obj.Object("Array", offset = chunks_ptr, targetType = "unsigned int", # compressor_slot_t
- count = self.COMPRESSOR_SLOTS_PER_CHUNK, vm = self.addr_space)
- slot_idx = page_num % self.COMPRESSOR_SLOTS_PER_CHUNK
-
- # chunk[slot_idx] is actually a c_slot_mapping
- # struct c_slot_mapping {
- # uint32_t s_cseg:22, /* segment number + 1 */
- # s_cindx:10; /* index in the segment */
- # };
-
- # print "DOUBLE LEVEL SEGIDX bitfield is " + str(chunk[slot_idx])
-
- seg = chunk[slot_idx] & 0x3FFFFF
- idx = chunk[slot_idx] >> 22
- else:
- (seg, idx) = (None, None)
- else:
- slot_idx = page_num;
- cpgr_dslots = obj.Object("Array", offset = pager.cpgr_slots.cpgr_dslots, targetType = "unsigned int", # actually compressor_slot_t, == int;
- count = pager.cpgr_num_slots, vm = self.addr_space) # unsigned here because we have to
-
- # cpgr_dslots[slot_idx] is actually a c_slot_mapping:
- # struct c_slot_mapping {
- # uint32_t s_cseg:22, /* segment number + 1 */
- # s_cindx:10; /* index in the segment */
- # };
-
- # print "SINGLE LEVEL SEGIDX bitfield is " + str(cpgr_dslots[slot_idx])
-
- seg = cpgr_dslots[slot_idx] & 0x3FFFFF
- idx = cpgr_dslots[slot_idx] >> 22
-
- return (seg, idx)
+ self.MAXMAPSIZE = 1000000000
-
- def decompress(self, outfd, seg, idx):
- # decompress and return 4K page identified by (seg, idx). Returns None if decompression fails.
- page = None
- if seg >= self.c_segment_count or seg < 1:
- outfd.write(" Segment out of bounds: " + str(seg) + ". Must be > 0 and < c_segment_count == " + str(self.c_segment_count) + ". Substituting zero page.\n")
- else:
- c_seg = self.c_segments[seg - 1].c_seg # seg is actually segment index + 1
- if c_seg.c_ondisk == 1:
- outfd.write(" Segment " + str(seg) + " is swapped out. Substituting zero page.\n")
- else:
- j1 = idx / self.C_SEG_SLOT_ARRAY_SIZE
- j2 = idx & self.C_SEG_SLOT_ARRAY_MASK
-
- cslot_array = c_seg.c_slots[j1]
- if cslot_array.is_valid():
- cslots = obj.Object("Array", offset = cslot_array, targetType = "c_slot",
- count = self.C_SEG_SLOT_ARRAY_SIZE, vm = self.addr_space)
- cslot=cslots[j2]
- (csize, compressed, status) = (4096 / 4, False, "UNCOMPRESSED") if (cslot.c_size == 4095) else (cslot.c_size / 4, True, "COMPRESSED")
- if csize > 0:
- outfd.write(" Slot " + str(j1) + ", " + str(j2) + ": offset = " + str(cslot.c_offset * 4) + " bytes, size = " + str(csize * 4) + " bytes, " + status + "\n")
- page = obj.Object("Array", offset = c_seg.c_store.c_buffer+cslot.c_offset * 4, targetType = "int",
- count = csize, vm = self.addr_space)
- if compressed:
- # try to decompress page. Compressed data is fed to WKdm as an array of 32-bit ints.
- decompressed = self.wkdm.WKdm_decompress(page, self.dest)
- if decompressed > 0:
- page = self.dest[:]
- outfd.write(" Decompression successful.\n")
- else:
- outfd.write(" Decompression failed. Substituting zero page.\n")
- page = None
- else:
- # for uniformity, so len() will work in _read_addr_range()
- page = page[:]
- outfd.write(" Decompression successful.\n")
-
- return page
-
-
def render_text(self, outfd, data):
common.set_plugin_members(self)
- if not self._config.OUTPUTFILE:
- debug.error("Please specify an OUTPUTFILE")
- elif os.path.exists(self._config.OUTPUTFILE):
- debug.error("Cowardly refusing to overwrite an existing file.")
+ if not self._config.DUMP_DIR:
+ debug.error("Please specify an output directory.")
+ elif not os.path.exists(self._config.DUMP_DIR):
+ debug.error("Please specify a directory that exists.")
- outfile = open(self._config.OUTPUTFILE, "wb+")
map_address = self._config.MAP_ADDRESS
- size = 0
-
self.table_header(outfd, [("Pid", "8"),
("Name", "20"),
- ("Start", "#018x"),
- ("End", "#018x"),
- ("Perms", "9"),
- ("Map Name", "")])
-
- # from osfmk/vm/vm_object.h. compressor_object is the high level VM object.
- self.compressor_object = obj.Object("vm_object",
- offset = self.addr_space.profile.get_symbol("_compressor_object_store"),
- vm = self.addr_space)
-
- # from osfmk/vm/vm_compressor.c. c_segments is an array of c_segu objects, which track and store compressed pages.
- # c_segment_count is current size of c_segments array.
- self.c_segment_count = obj.Object("unsigned int",
- offset = self.addr_space.profile.get_symbol("_c_segment_count"),
- vm = self.addr_space)
-
- self.c_segments_ptr = obj.Object("Pointer", offset = self.addr_space.profile.get_symbol("_c_segments"),
- vm = self.addr_space)
-
- self.c_segments = obj.Object("Array", targetType = "c_segu", count = self.c_segment_count,
- offset = self.c_segments_ptr, vm = self.addr_space)
-
- for proc, map in data:
- self.table_row(outfd,
- str(proc.p_pid), proc.p_comm,
- map.links.start,
- map.links.end,
- map.get_perms(),
- map.get_path())
+ ("Map Name", "8"),
+ ("Output Size", ""),
+ ("Output Path", "")])
- if (map.links.end - map.links.start) > self.MAXMAPSIZE:
- outfd.write("Skipping suspiciously large map, smearing is suspected. Adjust MAXMAPSIZE to override.\n")
+ for proc in data:
+ pas = proc.get_process_address_space()
+ if pas == None:
continue
- if not map_address or map_address == map.links.start:
- for page in self._read_addr_range(outfd, proc, map):
- if not page is None:
- size += self.wkdm.PAGE_SIZE_IN_BYTES
- if not self._config.SKIP_WRITING:
- for k in range(0, self.wkdm.PAGE_SIZE_IN_WORDS):
- outfile.write(struct.pack(' self.MAXMAPSIZE:
+ outfd.write("Skipping suspiciously large map, smearing is suspected. Adjust MAXMAPSIZE to override.\n")
+ continue
+
+ fname = "%d.%#x.%#x.dmp" % (pid, start, end)
+ of_path = os.path.join(self._config.DUMP_DIR, fname)
+ outfile = open(of_path, "wb")
- if not page is None:
- # ugly, but don't try to pad pages deliberately set to None
- pagelen = len(page)
- if pagelen != self.wkdm.PAGE_SIZE_IN_WORDS:
- outfd.write("Page is wrong size: " + str(pagelen) + ". Extending to " + str(self.wkdm.PAGE_SIZE_IN_BYTES) + ".\n")
- page.extend([0] * (self.wkdm.PAGE_SIZE_IN_WORDS - pagelen))
+ written_size = 0
+
+ for addr in range(start, end, 4096):
+ page = pas.zread(addr, 4096)
+ outfile.write(page)
+ written_size = written_size + 4096
- yield page
- start = start + self.wkdm.PAGE_SIZE_IN_BYTES
+ outfile.close()
+ self.table_row(outfd,
+ pid,
+ pname,
+ map.get_path(),
+ written_size,
+ of_path)
diff --git a/volatility/plugins/mac/get_profile.py b/volatility/plugins/mac/get_profile.py
index 0eb1492ba..e2a7ee348 100644
--- a/volatility/plugins/mac/get_profile.py
+++ b/volatility/plugins/mac/get_profile.py
@@ -34,6 +34,7 @@
from volatility.renderers.basic import Address
profiles = [
+["MacYosemite_10_10_1_14b25_14a389x64", 18446743523963612480, 18446743523964534784, 1],
["MacYosemite_10_10_2_14C1514x64", 18446743523963607600, 18446743523964534784, 1],
["MacYosemite_10_10_3_14D131_14D136x64", 18446743523963609408, 18446743523964534784, 1],
["MacYosemite_10_10_4_14E46x64", 18446743523963610496, 18446743523964534784, 1],
@@ -41,24 +42,76 @@
["MacYosemite_10_10_5_14F1912x64", 18446743523963609312, 18446743523964534784, 1],
["MacYosemite_10_10_5_14F2009_14F2109x64", 18446743523963609536, 18446743523964534784, 1],
["MacYosemite_10_10_5_14F2315x64", 18446743523963601344, 18446743523964534784, 1],
+["MacYosemite_10_10_5_14F2411x64", 18446743523963601536, 18446743523964534784, 1],
+["MacYosemite_10_10_5_14F2511x64", 18446743523963610096, 18446743523964534784, 1],
["MacYosemite_10_10_5_14F27x64", 18446743523963608608, 18446743523964534784, 1],
-["MacYosemite_10_10_14A389_14B25x64", 18446743523963612480, 18446743523964534784, 1],
["MacElCapitan_10_11_1_15B42x64", 18446743523963517744, 18446743523964555264, 1],
["MacElCapitan_10_11_2_15C50x64", 18446743523963517440, 18446743523964555264, 1],
["MacElCapitan_10_11_3_15D21_15D13bx64", 18446743523963520864, 18446743523964555264, 1],
+["MacElCapitan_10_11_4_15E27ex64", 18446743523963514048, 18446743523964555264, 1],
+["MacElCapitan_10_11_4_15E39dx64", 18446743523963503008, 18446743523964555264, 1],
+["MacElCapitan_10_11_4_15E49ax64", 18446743523963511504, 18446743523964555264, 1],
["MacElCapitan_10_11_4_15E65x64", 18446743523963511520, 18446743523964555264, 1],
+["MacElCapitan_10_11_5_15F18b_15F24bx64", 18446743523963513456, 18446743523964555264, 1],
["MacElCapitan_10_11_5_15F34x64", 18446743523963513456, 18446743523964555264, 1],
["MacElCapitan_10_11_6_15G1004_15G1108x64", 18446743523963516032, 18446743523964555264, 1],
["MacElCapitan_10_11_6_15G1212x64", 18446743523963503888, 18446743523964555264, 1],
["MacElCapitan_10_11_6_15G1217x64", 18446743523963503456, 18446743523964555264, 1],
+["MacElCapitan_10_11_6_15G12ax64", 18446743523963518048, 18446743523964555264, 1],
["MacElCapitan_10_11_6_15G1421x64", 18446743523963503440, 18446743523964555264, 1],
+["MacElCapitan_10_11_6_15G1510x64", 18446743523963503632, 18446743523964555264, 1],
+["MacElCapitan_10_11_6_15G1611x64", 18446743523963517424, 18446743523964555264, 1],
+["MacElCapitan_10_11_6_15G17023x64", 18446743523963518416, 18446743523964555264, 1],
+["MacElCapitan_10_11_6_15G18013x64", 18446743523963514960, 18446743523964555264, 1],
+["MacElCapitan_10_11_6_15G19009x64", 18446743523963517920, 18446743523964706816, 1],
+["MacElCapitan_10_11_6_15G19ax64", 18446743523963519296, 18446743523964555264, 1],
+["MacElCapitan_10_11_6_15G20015x64", 18446743523963517456, 18446743523964706816, 1],
+["MacElCapitan_10_11_6_15G24b_15G31x64", 18446743523963515680, 18446743523964555264, 1],
+["MacElCapitan_10_11_6_15G7ax64", 18446743523963517680, 18446743523964555264, 1],
["MacElCapitan_10_11_15A284x64", 18446743523963516960, 18446743523964547072, 1],
-["MacSierra_10_12_0_16A323x64", 18446743523963569392, 18446743523964379136, 1],
+["MacSierra_10_12_1_16B2327ex64", 18446743523963564272, 18446743523964379136, 1],
+["MacSierra_10_12_1_16B2338cx64", 18446743523963569952, 18446743523964379136, 1],
["MacSierra_10_12_1_16B2657x64", 18446743523963568512, 18446743523964379136, 1],
+["MacSierra_10_12_2_16C48bx64", 18446743523963567216, 18446743523964379136, 1],
["MacSierra_10_12_2_16C63ax64", 18446743523963567232, 18446743523964379136, 1],
["MacSierra_10_12_2_16C67x64", 18446743523963567232, 18446743523964379136, 1],
-["MacSierra_10_12_3_16D32x64", 18446743523963567520, 18446743523964379136, 1],
+["MacSierra_10_12_3_16D30a_16D32x64", 18446743523963567520, 18446743523964379136, 1],
+["MacSierra_10_12_4_16E144fx64", 18446743523963559152, 18446743523964379136, 1],
+["MacSierra_10_12_4_16E163fx64", 18446743523963558176, 18446743523964379136, 1],
+["MacSierra_10_12_4_16E183bx64", 18446743523963564384, 18446743523964379136, 1],
["MacSierra_10_12_4_16E195x64", 18446743523963564384, 18446743523964379136, 1],
+["MacSierra_10_12_5_16F73x64", 18446743523963562144, 18446743523964379136, 1],
+["MacSierra_10_12_6_16G1036x64", 18446743523963564096, 18446743523964379136, 1],
+["MacSierra_10_12_6_16G1114x64", 18446743523963562848, 18446743523964379136, 1],
+["MacSierra_10_12_6_16G1212x64", 18446743523963563696, 18446743523964538880, 1],
+["MacSierra_10_12_6_16G1314x64", 18446743523963562432, 18446743523964538880, 1],
+["MacSierra_10_12_6_16G18ax64", 18446743523963561920, 18446743523964379136, 1],
+["MacSierra_10_12_6_16G23ax64", 18446743523963561936, 18446743523964379136, 1],
+["MacSierra_10_12_6_16G29x64", 18446743523963561936, 18446743523964379136, 1],
+["MacSierra_10_12_16A323x64", 18446743523963569392, 18446743523964379136, 1],
+["MacHighSierra_10_13_1_17B25cx64", 18446743523963490896, 18446743523964391424, 1],
+["MacHighSierra_10_13_1_17B35ax64", 18446743523963490832, 18446743523964391424, 1],
+["MacHighSierra_10_13_1_17B46a_17B42a_17B45ax64", 18446743523963490832, 18446743523964391424, 1],
+["MacHighSierra_10_13_1_17B48x64", 18446743523963490832, 18446743523964391424, 1],
+["MacHighSierra_10_13_2_17C88x64", 18446743523965584448, 18446743523966648320, 1],
+["MacHighSierra_10_13_2_Seed_17C60cx64", 18446743523965574112, 18446743523966648320, 1],
+["MacHighSierra_10_13_3_17D47x64", 18446743523965582400, 18446743523966648320, 1],
+["MacHighSierra_10_13_4_17E150gx64", 18446743523965573200, 18446743523966652416, 1],
+["MacHighSierra_10_13_4_17E160ex64", 18446743523963477200, 18446743523964555264, 1],
+["MacHighSierra_10_13_4_17E170cx64", 18446743523963477952, 18446743523964555264, 1],
+["MacHighSierra_10_13_4_17E182ax64", 18446743523963484064, 18446743523964555264, 1],
+["MacHighSierra_10_13_4_17E202x64", 18446743523963484064, 18446743523964555264, 1],
+["MacHighSierra_10_13_5_17F45cx64", 18446743523963468032, 18446743523964555264, 1],
+["MacHighSierra_10_13_5_17F59bx64", 18446743523963481040, 18446743523964555264, 1],
+["MacHighSierra_10_13_5_17F66ax64", 18446743523963481088, 18446743523964555264, 1],
+["MacHighSierra_10_13_17A264cx64", 18446743523963492288, 18446743523964387328, 1],
+["MacHighSierra_10_13_17A291jx64", 18446743523963490112, 18446743523964387328, 1],
+["MacHighSierra_10_13_17A306fx64", 18446743523963487728, 18446743523964391424, 1],
+["MacHighSierra_10_13_17A315ix64", 18446743523963485344, 18446743523964391424, 1],
+["MacHighSierra_10_13_17A344bx64", 18446743523963492400, 18446743523964391424, 1],
+["MacHighSierra_10_13_17A352ax64", 18446743523963492416, 18446743523964391424, 1],
+["MacHighSierra_10_13_17A358ax64", 18446743523963492592, 18446743523964391424, 1],
+["MacHighSierra_10_13_17A360a_17A362ax64", 18446743523963492592, 18446743523964391424, 1],
["MacLeopard_10_5_3_Intelx86", 4850472, 1708032, 0],
["MacLeopard_10_5_4_Intelx86", 4850488, 1708032, 0],
["MacLeopard_10_5_5_Intelx86", 4850568, 1708032, 0],
@@ -100,16 +153,21 @@
["MacMountainLion_10_8_5_12F2518_AMDx64", 18446743523961347136, 18446743523962273792, 1],
["MacMountainLion_10_8_5_12f37_AMDx64", 18446743523961347136, 18446743523962273792, 1],
["MacMountainLion_10_8_5_12f45_AMDx64", 18446743523961347136, 18446743523962273792, 1],
-["MacMavericks_10_9_1_AMDx64", 18446743523961749984, 18446743523962273792, 1],
+["MacMavericks_10_9_1_13b42_13a603x64", 18446743523961749984, 18446743523962273792, 1],
["MacMavericks_10_9_2_13C1021_AMDx64", 18446743523961751392, 18446743523962273792, 1],
-["MacMavericks_10_9_2_13C64_AMDx64", 18446743523961753424, 18446743523962273792, 1],
-["MacMavericks_10_9_3_AMDx64", 18446743523961765744, 18446743523962273792, 1],
-["MacMavericks_10_9_4_AMDx64", 18446743523961767008, 18446743523962273792, 1],
-["MacMavericks_10_9_5_13F1077_AMDx64", 18446743523961774256, 18446743523962273792, 1],
+["MacMavericks_10_9_2_13c64x64", 18446743523961753424, 18446743523962273792, 1],
+["MacMavericks_10_9_3_13d65x64", 18446743523961765744, 18446743523962273792, 1],
+["MacMavericks_10_9_4_13e28x64", 18446743523961767008, 18446743523962273792, 1],
["MacMavericks_10_9_5_13F1911_AMDx64", 18446743523961774096, 18446743523962273792, 1],
-["MacMavericks_10_9_5_AMDx64", 18446743523961765968, 18446743523962273792, 1],
+["MacMavericks_10_9_5_13f34x64", 18446743523961765968, 18446743523962273792, 1],
+["MacMavericks_10_9_13F1077x64", 18446743523961774256, 18446743523962273792, 1],
]
+collisions_10_13_4 = {
+ "MacHighSierra_10_13_4_17E202x64" : "root:xnu-4570.51.2~1/RELEASE_X86_64",
+ "MacHighSierra_10_13_1_17B35ax64" : "root:xnu-4570.51.1~2/RELEASE_X86_64",
+}
+
collisions_10_8_5 = {
"MacMountainLion_10_8_5_12F2518_AMDx64" : "xnu-2050.48.19~1",
"MacMountainLion_10_8_5_12f37_AMDx64" : "xnu-2050.48.11~1",
@@ -121,7 +179,12 @@
"MacSierra_10_12_2_16C67x64" : "Thu Nov 17 20:23:58",
}
-collision_sets = [collisions_10_8_5, collisions_10_12_2]
+collisions_10_13_1 = {
+ "MacHighSierra_10_13_1_17B35ax64" : "1 00:46:50 PDT",
+ "MacHighSierra_10_13_1_17B48x64" : "Sep 29 18:27:05 PDT",
+}
+
+collision_sets = [collisions_10_8_5, collisions_10_12_2, collisions_10_13_1, collisions_10_13_4]
class catfishScan(scan.BaseScanner):
""" Scanner for Catfish string for Mountain Lion """
diff --git a/volatility/plugins/mac/ifconfig.py b/volatility/plugins/mac/ifconfig.py
index b83c60a4c..0736763dd 100644
--- a/volatility/plugins/mac/ifconfig.py
+++ b/volatility/plugins/mac/ifconfig.py
@@ -33,7 +33,10 @@ class mac_ifconfig(common.AbstractMacCommand):
def calculate(self):
common.set_plugin_members(self)
- list_head_addr = self.addr_space.profile.get_symbol("_dlil_ifnet_head")
+ list_head_addr = self.addr_space.profile.get_symbol("_ifnet_head")
+ if list_head_addr == None:
+ list_head_addr = self.addr_space.profile.get_symbol("_dlil_ifnet_head")
+
list_head_ptr = obj.Object("Pointer", offset = list_head_addr, vm = self.addr_space)
ifnet = list_head_ptr.dereference_as("ifnet")
diff --git a/volatility/plugins/mac/list_files.py b/volatility/plugins/mac/list_files.py
index b9a655281..a74d95aa9 100644
--- a/volatility/plugins/mac/list_files.py
+++ b/volatility/plugins/mac/list_files.py
@@ -41,6 +41,23 @@ def __init__(self, config, *args, **kwargs):
help = 'Show orphans (vnodes without a parent)',
action = 'store_true')
+ @staticmethod
+ def walk_vnodelist(listhead, loop_vnodes):
+ seen = set()
+
+ vnode = listhead.tqh_first.dereference()
+ while vnode:
+ if vnode in seen:
+ break
+
+ seen.add(vnode)
+
+ loop_vnodes.add(vnode)
+
+ vnode = vnode.v_mntvnodes.tqe_next.dereference()
+
+ return loop_vnodes
+
@staticmethod
def list_files(config):
@@ -48,11 +65,24 @@ def list_files(config):
mounts = plugin.calculate()
vnodes = {}
parent_vnodes = {}
+ loop_vnodes = set()
+ seen = set()
## build an initial table of all vnodes
for mount in mounts:
- vnode = mount.mnt_vnodelist.tqh_first.dereference()
+ loop_vnodes = mac_list_files.walk_vnodelist(mount.mnt_vnodelist, loop_vnodes)
+
+ loop_vnodes = mac_list_files.walk_vnodelist(mount.mnt_workerqueue, loop_vnodes)
+
+ loop_vnodes = mac_list_files.walk_vnodelist(mount.mnt_newvnodes, loop_vnodes)
+
+ loop_vnodes.add(mount.mnt_vnodecovered)
+
+ loop_vnodes.add(mount.mnt_realrootvp)
+ loop_vnodes.add(mount.mnt_devvp)
+
+ for vnode in loop_vnodes:
while vnode:
## abort here to prevent going in a loop
if vnode.obj_offset in vnodes:
@@ -66,7 +96,6 @@ def list_files(config):
entry = [name, None, vnode]
vnodes[vnode.obj_offset] = entry
-
else:
name = vnode.v_name.dereference()
parent = vnode.v_parent.dereference()
@@ -77,12 +106,13 @@ def list_files(config):
if config.SHOW_ORPHANS:
par_offset = None
else:
- vnode = vnode.v_mntvnodes.tqe_next.dereference()
+ vnode = vnode.v_mntvnodes.tqe_next.dereference()
+ vnodes[vnode.obj_offset] = [None, None, vnode]
continue
entry = [name, par_offset, vnode]
vnodes[vnode.obj_offset] = entry
-
+
vnode = vnode.v_mntvnodes.tqe_next.dereference()
## account for vnodes that aren't in the list but are
@@ -98,7 +128,6 @@ def list_files(config):
vm = vnode.obj_vm)
while parent:
-
if parent.obj_offset in vnodes:
break
@@ -112,9 +141,9 @@ def list_files(config):
entry = [str(name), par_offset, parent]
vnodes[parent.obj_offset] = entry
-
+
parent = next_parent
-
+
## build the full paths for all directories
for key, val in vnodes.items():
name, parent, vnode = val
@@ -132,7 +161,11 @@ def list_files(config):
full_path = parent_vnodes[parent] + "/" + name
else:
paths = [name]
- while parent:
+ seen_subs = set()
+
+ while parent and parent not in seen_subs:
+ seen_subs.add(parent)
+
entry = vnodes.get(parent)
## a vnode's parent wasn't found or
diff --git a/volatility/plugins/mac/list_zones.py b/volatility/plugins/mac/list_zones.py
index a958d9d33..07184ec76 100644
--- a/volatility/plugins/mac/list_zones.py
+++ b/volatility/plugins/mac/list_zones.py
@@ -28,7 +28,6 @@
import volatility.plugins.mac.common as common
from volatility.renderers import TreeGrid
-
class mac_list_zones(common.AbstractMacCommand):
""" Prints active zones """
@@ -36,14 +35,21 @@ def calculate(self):
common.set_plugin_members(self)
first_zone_addr = self.addr_space.profile.get_symbol("_first_zone")
+ if first_zone_addr:
+ zone_ptr = obj.Object("Pointer", offset = first_zone_addr, vm = self.addr_space)
+ zone = zone_ptr.dereference_as("zone")
- zone_ptr = obj.Object("Pointer", offset = first_zone_addr, vm = self.addr_space)
- zone = zone_ptr.dereference_as("zone")
+ while zone:
+ yield zone
+ zone = zone.next_zone
+ else:
+ zone_ptr = self.addr_space.profile.get_symbol("_zone_array")
+ zone_arr = obj.Object(theType="Array", targetType="zone", vm = self.addr_space, count = 256, offset = zone_ptr)
- while zone:
- yield zone
- zone = zone.next_zone
-
+ for zone in zone_arr:
+ if zone.is_valid():
+ yield zone
+
def unified_output(self, data):
return TreeGrid([("Name", str),
("Active Count", int),
diff --git a/volatility/plugins/mac/mac_yarascan.py b/volatility/plugins/mac/mac_yarascan.py
index bdb4b8834..cf7f0f208 100644
--- a/volatility/plugins/mac/mac_yarascan.py
+++ b/volatility/plugins/mac/mac_yarascan.py
@@ -117,7 +117,7 @@ def calculate(self):
address_space = self.addr_space)
for hit, address in scanner.scan(start_offset = kernel_start):
- yield (None, address, hit,
+ yield (None, address - self._config.REVERSE, hit,
scanner.address_space.zread(address - self._config.REVERSE, self._config.SIZE))
else:
# Scan each process memory block
@@ -128,7 +128,7 @@ def calculate(self):
continue
scanner = MapYaraScanner(task = task, rules = rules)
for hit, address in scanner.scan(max_size = self._config.MAX_SIZE):
- yield (task, address, hit,
+ yield (task, address - self._config.REVERSE, hit,
scanner.address_space.zread(address - self._config.REVERSE, self._config.SIZE))
def render_text(self, outfd, data):
diff --git a/volatility/plugins/mac/notifiers.py b/volatility/plugins/mac/notifiers.py
index 85750f822..472f8b7da 100644
--- a/volatility/plugins/mac/notifiers.py
+++ b/volatility/plugins/mac/notifiers.py
@@ -53,6 +53,9 @@ def calculate(self):
p = obj.Object("Pointer", offset = gnotify_addr, vm = self.addr_space)
gnotifications = p.dereference_as(self._struct_or_class("OSDictionary"))
+ if gnotifications.count > 1024:
+ return
+
ents = obj.Object('Array', offset = gnotifications.dictionary,
vm = self.addr_space,
targetType = self._struct_or_class("dictEntry"),
@@ -60,7 +63,6 @@ def calculate(self):
# walk the current set of notifications
for ent in ents:
-
if ent == None or not ent.is_valid():
continue
@@ -68,12 +70,17 @@ def calculate(self):
# get the value
valset = ent.value.dereference_as(self._struct_or_class("OSOrderedSet"))
+ if valset == None or valset.count > 1024:
+ continue
notifiers_ptrs = obj.Object('Array', offset = valset.array,
vm = self.addr_space,
targetType = 'Pointer',
count = valset.count)
-
+
+ if notifiers_ptrs == None:
+ continue
+
for ptr in notifiers_ptrs:
notifier = ptr.dereference_as(self._struct_or_class("_IOServiceNotifier"))
@@ -81,6 +88,8 @@ def calculate(self):
continue
matches = self.get_matching(notifier)
+ if matches == []:
+ continue
# this is the function that handles whatever the notification is for
# this should be only in the kernel or in one of the known IOKit
@@ -98,18 +107,22 @@ def calculate(self):
# returns the list of matching notifiers (serviceMatch) for a notifier as a string
def get_matching(self, notifier):
matches = []
-
+
+ if notifier.matching.count > 1024:
+ return matches
+
ents = obj.Object('Array', offset = notifier.matching.dictionary,
vm = self.addr_space,
targetType = self._struct_or_class("dictEntry"),
count = notifier.matching.count)
for ent in ents:
- if ent == None:
+ if ent == None or ent.value == None:
continue
-
+
match = ent.value.dereference_as(self._struct_or_class("OSString"))
- matches.append(str(match))
+ if len(str(match)) > 0:
+ matches.append(str(match))
return ",".join(matches)
diff --git a/volatility/plugins/mac/pslist.py b/volatility/plugins/mac/pslist.py
index e411ab097..1de712ff2 100644
--- a/volatility/plugins/mac/pslist.py
+++ b/volatility/plugins/mac/pslist.py
@@ -43,7 +43,7 @@ def virtual_process_from_physical_offset(addr_space, offset):
pspace = utils.load_as(addr_space.get_config(), astype = 'physical')
proc = obj.Object("proc", vm = pspace, offset = offset)
task = obj.Object("task", vm = addr_space, offset = proc.task)
-
+
return task.bsd_info.dereference_as("proc")
def allprocs(self):
@@ -99,6 +99,7 @@ def unified_output(self, data):
("Bits", str),
("DTB", Address),
("Start time", str),
+ ("PPID", int),
], self.generator(data))
def generator(self, data):
for proc in data:
@@ -118,6 +119,7 @@ def generator(self, data):
str(bit_string),
Address(proc.task.dereference_as("task").map.pmap.pm_cr3),
str(proc.start_time()),
+ int(proc.p_ppid),
])
def render_text(self, outfd, data):
@@ -127,9 +129,11 @@ def render_text(self, outfd, data):
("Uid", "8"),
("Gid", "8"),
("PGID", "8"),
- ("Bits", "12"),
+ ("Bits", "12"),
("DTB", "#018x"),
- ("Start Time", "")])
+ ("Start Time", ""),
+ ("Ppid", "8"),
+ ])
for proc in data:
if not proc.is_valid() or len(proc.p_comm) == 0:
@@ -146,4 +150,5 @@ def render_text(self, outfd, data):
str(proc.p_pgrpid),
bit_string,
proc.task.dereference_as("task").map.pmap.pm_cr3,
- proc.start_time())
+ proc.start_time(),
+ str(proc.p_ppid))
diff --git a/volatility/plugins/mac/pstasks.py b/volatility/plugins/mac/pstasks.py
index c7749f3f9..fbfa91e94 100644
--- a/volatility/plugins/mac/pstasks.py
+++ b/volatility/plugins/mac/pstasks.py
@@ -37,12 +37,18 @@ def allprocs(self):
tasksaddr = self.addr_space.profile.get_symbol("_tasks")
queue_entry = obj.Object("queue_entry", offset = tasksaddr, vm = self.addr_space)
- seen = [tasksaddr]
+ seen = { tasksaddr : 1 }
for task in queue_entry.walk_list(list_head = tasksaddr):
- if (task.bsd_info and task.obj_offset not in seen):
- proc = task.bsd_info.dereference_as("proc")
- yield proc
-
- seen.append(task.obj_offset)
+ if task.obj_offset not in seen:
+ seen[task.obj_offset] = 0
+
+ if task.bsd_info:
+ proc = task.bsd_info.dereference_as("proc")
+ yield proc
+ else:
+ if seen[task.obj_offset] > 3:
+ break
+
+ seen[task.obj_offset] = seen[task.obj_offset] + 1
diff --git a/volatility/plugins/mac/route.py b/volatility/plugins/mac/route.py
index 8031594ce..1167e7ee1 100644
--- a/volatility/plugins/mac/route.py
+++ b/volatility/plugins/mac/route.py
@@ -34,10 +34,15 @@ class mac_route(common.AbstractMacCommand):
def _get_table(self, tbl):
rnh = tbl #obj.Object("radix_node", offset=tbl.v(), vm=self.addr_space)
rn = rnh.rnh_treetop
-
+
+ seen = set()
while rn.is_valid() and rn.rn_bit >= 0:
- rn = rn.rn_u.rn_node.rn_L
+ if rn.v() in seen:
+ break
+ seen.add(rn.v())
+ rn = rn.rn_u.rn_node.rn_L
+
rnhash = {}
while rn.is_valid():
@@ -48,18 +53,29 @@ def _get_table(self, tbl):
rnhash[rn] = 1
+ seen = set()
while rn.is_valid() and rn.rn_parent.rn_u.rn_node.rn_R == rn and rn.rn_flags & 2 == 0:
+ if rn.v() in seen:
+ break
+ seen.add(rn.v())
+
rn = rn.rn_parent
rn = rn.rn_parent.rn_u.rn_node.rn_R
- while rn.is_valid() and rn.rn_bit >= 0:
+ i = 0
+ while i < 1024 and rn.is_valid() and rn.rn_bit >= 0:
rn = rn.rn_u.rn_node.rn_L
+ i = i + 1
nextptr = rn
+ seen = set()
while base.v() != 0:
-
+ if base.v() in seen:
+ break
+ seen.add(base.v())
+
rn = base
base = rn.rn_u.rn_leaf.rn_Dupedkey
@@ -85,7 +101,8 @@ def calculate(self):
rts = self._get_table(ipv4table)
for rt in rts:
- yield rt
+ if rt.is_valid():
+ yield rt
def unified_output(self, data):
diff --git a/volatility/plugins/mac/threads.py b/volatility/plugins/mac/threads.py
index a8e95331d..57d40fd36 100644
--- a/volatility/plugins/mac/threads.py
+++ b/volatility/plugins/mac/threads.py
@@ -216,7 +216,7 @@ def get_stack_map(self, proc, proc_threads, bit_string):
for map in proc.get_proc_maps():
vm_map_start = map.links.start
- map_type = str(dict_alias.get(int(map.alias), "UNKNOWN"))
+ map_type = str(dict_alias.get(int(map.range_alias()), "UNKNOWN"))
map_path = map.get_path()
# see if map is a STACK (not a STACK_GUARD), if so which thread it belongs to
@@ -242,13 +242,13 @@ def get_stack_map(self, proc, proc_threads, bit_string):
# Based on the vmmap command:
# current map is a stack marked as thread, then mark previous map with thread id if stack
prev_proc, prev_map, prev_map_path = maps.pop()
- if str(dict_alias.get(int(prev_map.alias), "UNKNOWN")) == "VM_MEMORY_STACK" and prev_map.get_perms() != "---" and "thread" not in prev_map_path:
+ if str(dict_alias.get(int(prev_map.range_alias()), "UNKNOWN")) == "VM_MEMORY_STACK" and prev_map.get_perms() != "---" and "thread" not in prev_map_path:
prev_map_path = "thread id {0}".format(stack_thread_id)
maps.append((prev_proc, prev_map, prev_map_path))
else:
# if previous map is a stack marked as thread, then mark current map with thread id
prev_proc, prev_map, prev_map_path = maps.pop()
- if str(dict_alias.get(int(prev_map.alias), "UNKNOWN")) == "VM_MEMORY_STACK" and prev_map.get_perms() != "---" and "thread" in prev_map_path:
+ if str(dict_alias.get(int(prev_map.range_alias()), "UNKNOWN")) == "VM_MEMORY_STACK" and prev_map.get_perms() != "---" and "thread" in prev_map_path:
map_path = "thread id {0}".format(stack_thread_id)
maps.append((prev_proc, prev_map, prev_map_path))
diff --git a/volatility/plugins/mac/threads_simple.py b/volatility/plugins/mac/threads_simple.py
index b6b599643..0fee3c76c 100644
--- a/volatility/plugins/mac/threads_simple.py
+++ b/volatility/plugins/mac/threads_simple.py
@@ -63,7 +63,7 @@ def generator(self, data):
int(proc.p_pid),
str(proc.p_comm),
str(th.start_time()),
- int(th.priority),
+ int(th.sched_pri),
Address(func_addr),
str(handler),
])
@@ -93,6 +93,6 @@ def render_text(self, outfd, data):
self.table_row(outfd, proc.p_pid, proc.p_comm,
th.start_time(),
- th.priority,
+ th.sched_pri,
func_addr, handler)
diff --git a/volatility/plugins/malware/impscan.py b/volatility/plugins/malware/impscan.py
index 60d834ae0..83f823b4b 100644
--- a/volatility/plugins/malware/impscan.py
+++ b/volatility/plugins/malware/impscan.py
@@ -62,9 +62,6 @@ def __init__(self, config, *args, **kwargs):
config.add_option('SIZE', short_option = 's', default = None,
help = 'Size of memory to scan',
action = 'store', type = 'int')
- ## FIXME. ImpScan currently does not work on wow64 processes.
- ## Add an option to override the profile's memory_model and
- ## allow 32bit disasm on x64 operating systems.
self.forwarded_imports = {
"RtlGetLastWin32Error" : "kernel32.dll!GetLastError",
@@ -117,7 +114,7 @@ def _call_or_unc_jmp(self, op):
op.mnemonic == "JMP"))
def _vicinity_scan(self, addr_space, calls_imported,
- apis, base_address, data_len, forward):
+ apis, base_address, data_len, is_wow64 = False, forward = True):
"""Scan forward from the lowest IAT entry found or
backward from the highest IAT entry found. We do this
because not every imported function will be called
@@ -129,7 +126,8 @@ def _vicinity_scan(self, addr_space, calls_imported,
@param apis: dictionary of exported functions in the AS
@param base_address: memory base address
@param data_len: size in bytes to check from base_address
- @param forwared: the direction for the vicinity scan
+ @param is_wow64: True if its a Wow64 process
+ @param forward: the direction for the vicinity scan
"""
sortedlist = calls_imported.keys()
@@ -138,7 +136,12 @@ def _vicinity_scan(self, addr_space, calls_imported,
if not sortedlist:
return
- size_of_address = addr_space.profile.get_obj_size("address")
+ if is_wow64:
+ addr_type = "int"
+ else:
+ addr_type = "address"
+
+ size_of_address = addr_space.profile.get_obj_size(addr_type)
if forward:
start_addr = sortedlist[0]
@@ -157,7 +160,7 @@ def _vicinity_scan(self, addr_space, calls_imported,
else:
next_addr = start_addr - (i * size_of_address)
- call_dest = obj.Object("address", offset = next_addr,
+ call_dest = obj.Object(addr_type, offset = next_addr,
vm = addr_space).v()
if (not call_dest or
@@ -190,7 +193,7 @@ def _original_import(self, mod_name, func_name):
else:
return mod_name, func_name
- def call_scan(self, addr_space, base_address, data):
+ def call_scan(self, addr_space, base_address, data, is_wow64 = False):
"""Disassemble a block of data and yield possible
calls to imported functions. We're looking for
instructions such as these:
@@ -211,26 +214,28 @@ def call_scan(self, addr_space, base_address, data):
@param addr_space: an AS to scan with
@param base_address: memory base address
- @param data: buffer of data found at base_address
+ @param data: buffer of data found at base_address
+ @param is_wow64: True if its a Wow64 process
"""
end_address = base_address + len(data)
memory_model = addr_space.profile.metadata.get('memory_model', '32bit')
- if memory_model == '32bit':
+ if memory_model == '32bit' or is_wow64:
mode = distorm3.Decode32Bits
+ addr_type = "int"
else:
mode = distorm3.Decode64Bits
+ addr_type = "address"
for op in distorm3.DecomposeGenerator(base_address, data, mode):
-
if not op.valid:
continue
iat_loc = None
- if memory_model == '32bit':
+ if memory_model == '32bit' or is_wow64:
if (self._call_or_unc_jmp(op) and
op.operands[0].type == 'AbsoluteMemoryAddress'):
iat_loc = (op.operands[0].disp) & 0xffffffff
@@ -246,7 +251,7 @@ def call_scan(self, addr_space, base_address, data):
continue
# This is the address being called
- call_dest = obj.Object("address", offset = iat_loc,
+ call_dest = obj.Object(addr_type, offset = iat_loc,
vm = addr_space)
if call_dest == None:
@@ -305,6 +310,9 @@ def calculate(self):
data = kernel_space.zread(base_address, size_to_read)
apis = self.enum_apis(all_mods)
addr_space = kernel_space
+
+ is_wow64 = False
+
else:
# In process mode, we find the process by PID
task = None
@@ -347,6 +355,8 @@ def calculate(self):
base_address = all_mods[0].DllBase
size_to_read = all_mods[0].SizeOfImage
+ is_wow64 = task.IsWow64
+
data = task_space.zread(base_address, size_to_read)
apis = self.enum_apis(all_mods)
addr_space = task_space
@@ -354,19 +364,17 @@ def calculate(self):
# This is a dictionary of confirmed API calls.
calls_imported = dict(
(iat, call)
- for (_, iat, call) in self.call_scan(addr_space, base_address, data)
+ for (_, iat, call) in self.call_scan(addr_space, base_address, data, is_wow64)
if call in apis
)
# Scan forward
self._vicinity_scan(addr_space,
- calls_imported, apis, base_address, len(data),
- forward = True)
+ calls_imported, apis, base_address, len(data), is_wow64, forward = True)
# Scan reverse
self._vicinity_scan(addr_space,
- calls_imported, apis, base_address, len(data),
- forward = False)
+ calls_imported, apis, base_address, len(data), is_wow64, forward = False)
for iat, call in sorted(calls_imported.items()):
yield iat, call, apis[call][0], apis[call][1]
diff --git a/volatility/plugins/malware/malfind.py b/volatility/plugins/malware/malfind.py
index c5c112467..585bab7ae 100644
--- a/volatility/plugins/malware/malfind.py
+++ b/volatility/plugins/malware/malfind.py
@@ -244,7 +244,7 @@ def _scan_process_memory(self, addr_space, rules):
for task in self.filter_tasks(tasks.pslist(addr_space)):
scanner = VadYaraScanner(task = task, rules = rules)
for hit, address in scanner.scan(maxlen = self._config.MAX_SIZE):
- yield (task, address, hit, scanner.address_space.zread(address - self._config.REVERSE, self._config.SIZE))
+ yield (task, address - self._config.REVERSE, hit, scanner.address_space.zread(address - self._config.REVERSE, self._config.SIZE))
def _scan_kernel_memory(self, addr_space, rules):
# Find KDBG so we know where kernel memory begins. Do not assume
@@ -282,7 +282,7 @@ def _scan_kernel_memory(self, addr_space, rules):
for hit, address in scanner.scan(start_offset = start):
module = tasks.find_module(mods, mod_addrs, addr_space.address_mask(address))
- yield (module, address, hit, session_space.zread(address - self._config.REVERSE, self._config.SIZE))
+ yield (module, address - self._config.REVERSE, hit, session_space.zread(address - self._config.REVERSE, self._config.SIZE))
def calculate(self):
if not has_yara:
@@ -495,13 +495,13 @@ def render_text(self, outfd, data):
data_start = vad.Start + 0x1000
outfd.write("{0}\n".format("\n".join(
- ["{0:#010x} {1:<48} {2}".format(data_start + o, h, ''.join(c))
+ ["{0:#018x} {1:<48} {2}".format(data_start + o, h, ''.join(c))
for o, h, c in utils.Hexdump(content)
])))
outfd.write("\n")
outfd.write("\n".join(
- ["{0:#010x} {1:<16} {2}".format(o, h, i)
+ ["{0:#018x} {1:<16} {2}".format(o, h, i)
for o, i, h in Disassemble(content, data_start)
]))
diff --git a/volatility/plugins/malware/svcscan.py b/volatility/plugins/malware/svcscan.py
index 94ffa86ae..5f84d1683 100644
--- a/volatility/plugins/malware/svcscan.py
+++ b/volatility/plugins/malware/svcscan.py
@@ -141,7 +141,12 @@ def Pid(self):
def is_valid(self):
"Check some fields for validity"
- return obj.CType.is_valid(self) and self.Order > 0 and self.Order < 0xFFFF
+ type_flags_max = sum([(1 << v) for v in SERVICE_TYPE_FLAGS.values()])
+ return obj.CType.is_valid(self) and self.Order > 0 and \
+ self.Order < 0xFFFF and \
+ self.State.v() in SERVICE_STATE_ENUM and \
+ self.Start.v() in SERVICE_START_ENUM and \
+ self.Type.v() < type_flags_max
def traverse(self):
@@ -299,11 +304,11 @@ def modification(self, profile):
class Service10_15063x64(obj.ProfileModification):
"""Service structures for Win10 15063 (Creators)"""
- before = ['WindowsOverlay', 'WindowsObjectClasses', 'ServiceBase', 'ServiceVista', 'Service8x64', 'ServiceVistax64']
+ before = ['WindowsOverlay', 'WindowsObjectClasses', 'ServiceBase', 'ServiceVista', 'Service8x64']
conditions = {'os': lambda x: x == 'windows',
'major': lambda x: x == 6,
'minor': lambda x: x == 4,
- 'build': lambda x: x == 15063,
+ 'build': lambda x: x >= 15063,
'memory_model': lambda x: x == '64bit'}
def modification(self, profile):
@@ -320,6 +325,69 @@ def modification(self, profile):
'Start' : [ 0x24, ['Enumeration', dict(target = 'long', choices = SERVICE_START_ENUM)]],
} ],
})
+
+class Service10_16299x64(obj.ProfileModification):
+ """Service structures for Win10 16299 (Fall Creators)"""
+
+ before = ['WindowsOverlay', 'WindowsObjectClasses', 'ServiceBase', 'ServiceVista', 'Service8x64',
+ 'Service10_15063x64']
+ conditions = {'os': lambda x: x == 'windows',
+ 'major': lambda x: x == 6,
+ 'minor': lambda x: x == 4,
+ 'build': lambda x: x >= 16299,
+ 'memory_model': lambda x: x == '64bit'}
+
+ def modification(self, profile):
+ profile.merge_overlay({
+ '_SERVICE_PROCESS': [ None, {
+ 'BinaryPath': [ 0x18, ['pointer', ['String', dict(encoding = 'utf16', length = 256)]]],
+ 'ProcessId': [ 0x28, ['unsigned int']],
+ }]})
+
+class Service10_18362x64(obj.ProfileModification):
+ """Service structures for Win10 18362 (May 2019)"""
+
+ before = ['WindowsOverlay', 'WindowsObjectClasses', 'ServiceBase', 'ServiceVista', 'Service8x64',
+ 'Service10_15063x64', 'Service10_16299x64']
+ conditions = {'os': lambda x: x == 'windows',
+ 'major': lambda x: x == 6,
+ 'minor': lambda x: x == 4,
+ 'build': lambda x: x >= 18362,
+ 'memory_model': lambda x: x == '64bit'}
+
+ def modification(self, profile):
+ profile.merge_overlay({
+ '_SERVICE_RECORD' : [ None, {
+ 'PrevEntry': [ 0x10, ['pointer', ['_SERVICE_RECORD']]],
+ 'ServiceName' : [ 0x38, ['pointer', ['String', dict(encoding = 'utf16', length = 512)]]],
+ 'DisplayName' : [ 0x40, ['pointer', ['String', dict(encoding = 'utf16', length = 512)]]],
+ 'Order' : [ 0x20, ['unsigned int']],
+ 'DriverName' : [ 0xf0, ['pointer', ['String', dict(encoding = 'utf16', length = 256)]]],
+ 'ServiceProcess' : [ 0xf0, ['pointer', ['_SERVICE_PROCESS']]],
+ 'Type' : [ 0x48, ['Flags', {'bitmap': SERVICE_TYPE_FLAGS}]],
+ 'State' : [ 0x4C, ['Enumeration', dict(target = 'long', choices = SERVICE_STATE_ENUM)]],
+ 'Start' : [ 0x24, ['Enumeration', dict(target = 'long', choices = SERVICE_START_ENUM)]],
+ } ],
+ })
+
+class Service10_19041x64(obj.ProfileModification):
+ """Service structures for Win10 19041 (May 2020)"""
+
+ before = ['WindowsOverlay', 'WindowsObjectClasses', 'ServiceBase', 'ServiceVista', 'Service8x64',
+ 'Service10_15063x64', 'Service10_16299x64', 'Service10_18362x64']
+ conditions = {'os': lambda x: x == 'windows',
+ 'major': lambda x: x == 6,
+ 'minor': lambda x: x == 4,
+ 'build': lambda x: x >= 19041,
+ 'memory_model': lambda x: x == '64bit'}
+
+ def modification(self, profile):
+ profile.merge_overlay({
+ '_SERVICE_RECORD' : [ None, {
+ 'DriverName' : [ 0x128, ['pointer', ['String', dict(encoding = 'utf16', length = 256)]]],
+ 'ServiceProcess' : [ 0x128, ['pointer', ['_SERVICE_PROCESS']]],
+ } ],
+ })
class Service8x86(obj.ProfileModification):
"""Service structures for Win8/8.1 32-bit"""
@@ -357,7 +425,7 @@ class Service10_15063x86(obj.ProfileModification):
conditions = {'os': lambda x: x == 'windows',
'major': lambda x: x == 6,
'minor': lambda x: x == 4,
- 'build': lambda x: x == 15063,
+ 'build': lambda x: x >= 15063,
'memory_model': lambda x: x == '32bit'}
def modification(self, profile):
@@ -375,6 +443,98 @@ def modification(self, profile):
'Start' : [ 0x18, ['Enumeration', dict(target = 'long', choices = SERVICE_START_ENUM)]],
} ],
})
+
+class Service10_16299x86(obj.ProfileModification):
+ """Service structures for Win10 16299 (Fall Creators)"""
+
+ before = ['WindowsOverlay', 'WindowsObjectClasses', 'ServiceBase', 'ServiceVista', 'Service8x86',
+ 'Service10_15063x86']
+ conditions = {'os': lambda x: x == 'windows',
+ 'major': lambda x: x == 6,
+ 'minor': lambda x: x == 4,
+ 'build': lambda x: x >= 16299,
+ 'memory_model': lambda x: x == '32bit'}
+
+ def modification(self, profile):
+ profile.merge_overlay({
+ '_SERVICE_PROCESS': [ None, {
+ 'BinaryPath': [ 0xc, ['pointer', ['String', dict(encoding = 'utf16', length = 256)]]],
+ 'ProcessId': [ 0x14, ['unsigned int']],
+ }]})
+
+class Service10_17763x86(obj.ProfileModification):
+ """Service structures for Win10 17763 (October 2018)"""
+
+ before = ['WindowsOverlay', 'WindowsObjectClasses', 'ServiceBase', 'ServiceVista', 'Service8x86',
+ 'Service10_15063x86', 'Service10_16299x86']
+ conditions = {'os': lambda x: x == 'windows',
+ 'major': lambda x: x == 6,
+ 'minor': lambda x: x == 4,
+ 'build': lambda x: x >= 17763,
+ 'memory_model': lambda x: x == '32bit'}
+
+ def modification(self, profile):
+ profile.vtypes.update({
+ '_SERVICE_RECORD' : [ None, {
+ 'PrevEntry': [ 0xC, ['pointer', ['_SERVICE_RECORD']]],
+ 'ServiceName' : [ 0x2C, ['pointer', ['String', dict(encoding = 'utf16', length = 512)]]],
+ 'DisplayName' : [ 0x30, ['pointer', ['String', dict(encoding = 'utf16', length = 512)]]],
+ 'Order' : [ 0x14, ['unsigned int']],
+ 'DriverName' : [ 0xA0, ['pointer', ['String', dict(encoding = 'utf16', length = 256)]]],
+ 'ServiceProcess' : [ 0xA0, ['pointer', ['_SERVICE_PROCESS']]],
+ 'Type' : [ 0x34, ['Flags', {'bitmap': SERVICE_TYPE_FLAGS}]],
+ 'State' : [ 0x38, ['Enumeration', dict(target = 'long', choices = SERVICE_STATE_ENUM)]],
+ 'Start' : [ 0x18, ['Enumeration', dict(target = 'long', choices = SERVICE_START_ENUM)]],
+ } ],
+ })
+
+class Service10_18362x86(obj.ProfileModification):
+ """Service structures for Win10 18362 (May 2019)"""
+
+ before = ['WindowsOverlay', 'WindowsObjectClasses', 'ServiceBase', 'ServiceVista', 'Service8x86',
+ 'Service10_15063x86', 'Service10_16299x86', 'Service10_17763x86']
+ conditions = {'os': lambda x: x == 'windows',
+ 'major': lambda x: x == 6,
+ 'minor': lambda x: x == 4,
+ 'build': lambda x: x >= 18362,
+ 'memory_model': lambda x: x == '32bit'}
+
+ def modification(self, profile):
+ profile.vtypes.update({
+ '_SERVICE_RECORD' : [ None, {
+ 'PrevEntry': [ 0xC, ['pointer', ['_SERVICE_RECORD']]],
+ 'ServiceName' : [ 0x2C, ['pointer', ['String', dict(encoding = 'utf16', length = 512)]]],
+ 'DisplayName' : [ 0x30, ['pointer', ['String', dict(encoding = 'utf16', length = 512)]]],
+ 'Order' : [ 0x14, ['unsigned int']],
+ 'DriverName' : [ 0xA4, ['pointer', ['String', dict(encoding = 'utf16', length = 256)]]],
+ 'ServiceProcess' : [ 0xA4, ['pointer', ['_SERVICE_PROCESS']]],
+ 'Type' : [ 0x34, ['Flags', {'bitmap': SERVICE_TYPE_FLAGS}]],
+ 'State' : [ 0x38, ['Enumeration', dict(target = 'long', choices = SERVICE_STATE_ENUM)]],
+ 'Start' : [ 0x18, ['Enumeration', dict(target = 'long', choices = SERVICE_START_ENUM)]],
+ } ],
+ })
+
+class Service10_19041x86(obj.ProfileModification):
+ """Service structures for Win10 19041 (May 2020)"""
+
+ before = ['WindowsOverlay', 'WindowsObjectClasses', 'ServiceBase', 'ServiceVista', 'Service8x86',
+ 'Service10_15063x86', 'Service10_16299x86', 'Service10_17763x86', 'Service10_18362x86']
+ conditions = {'os': lambda x: x == 'windows',
+ 'major': lambda x: x == 6,
+ 'minor': lambda x: x == 4,
+ 'build': lambda x: x >= 19041,
+ 'memory_model': lambda x: x == '32bit'}
+
+ def modification(self, profile):
+ profile.merge_overlay({
+ '_SERVICE_HEADER' : [ None, {
+ 'ServiceRecord': [0x10, ['pointer', ['_SERVICE_RECORD']]],
+ }],
+ '_SERVICE_RECORD': [None, {
+ 'DriverName': [0xc0, ['pointer', ['String', dict(encoding='utf16', length=256)]]],
+ 'ServiceProcess': [0xc0, ['pointer', ['_SERVICE_PROCESS']]],
+ }],
+ })
#--------------------------------------------------------------------------------
# svcscan plugin
@@ -491,6 +651,9 @@ def get_service_info(regapi):
image_path = regapi.reg_get_value(hive_name = "system", key = "", value = "ImagePath", given_root = subkey)
if image_path:
+ # this could be REG_SZ or REG_MULTI_SZ
+ if isinstance(image_path, list):
+ image_path = image_path[0]
path_value = utils.remove_unprintable(image_path)
failure_path = regapi.reg_get_value(hive_name = "system", key = "", value = "FailureCommand", given_root = subkey)
diff --git a/volatility/plugins/malware/timers.py b/volatility/plugins/malware/timers.py
index 8829ae08c..c317d6ae0 100644
--- a/volatility/plugins/malware/timers.py
+++ b/volatility/plugins/malware/timers.py
@@ -212,9 +212,17 @@ def calculate(self):
# at _KPCR.PrcbData.TimerTable.TimerEntries (credits to Matt Suiche
# for this one. See http://pastebin.com/FiRsGW3f).
for kpcr in tasks.get_kdbg(addr_space).kpcrs():
- for table in kpcr.ProcessorBlock.TimerTable.TimerEntries:
- for t in table.Entry.list_of_type("_KTIMER", "TimerListEntry"):
- timers.append(t)
+ # Starting with Win10 19041, there is another level of arrays holding the TimerListEntry items,
+ # along with a new TableState member in _KTIMER_TABLE
+ if hasattr(kpcr.ProcessorBlock.TimerTable, "TableState"):
+ for table in kpcr.ProcessorBlock.TimerTable.TimerEntries:
+ for table_entry in table:
+ for t in table_entry.Entry.list_of_type("_KTIMER", "TimerListEntry"):
+ timers.append(t)
+ else:
+ for table in kpcr.ProcessorBlock.TimerTable.TimerEntries:
+ for t in table.Entry.list_of_type("_KTIMER", "TimerListEntry"):
+ timers.append(t)
for timer in timers:
diff --git a/volatility/plugins/mbrparser.py b/volatility/plugins/mbrparser.py
index fb30eb0f0..8acdbd4a5 100644
--- a/volatility/plugins/mbrparser.py
+++ b/volatility/plugins/mbrparser.py
@@ -266,7 +266,8 @@ def calculate(self):
file = open(self._config.DISK, "rb")
self.disk_mbr = file.read(440)
file.close()
-
+
+ all_zeros = None
if self._config.OFFSET:
PARTITION_TABLE = obj.Object('PARTITION_TABLE', vm = address_space,
offset = self._config.OFFSET)
diff --git a/volatility/plugins/overlays/basic.py b/volatility/plugins/overlays/basic.py
index cb7f4b766..7225ce656 100644
--- a/volatility/plugins/overlays/basic.py
+++ b/volatility/plugins/overlays/basic.py
@@ -219,8 +219,12 @@ def generate_suggestions(self):
while found >= 0:
proc = obj.Object("_EPROCESS", offset = offset + found,
vm = self.obj_vm)
- if 'Idle' in proc.ImageFileName.v():
+ if 'Idle\x00\x00\x00\x00\x00\x00\x00\x00' in proc.ImageFileName.v() and \
+ int(proc.UniqueProcessId) == 0 and \
+ proc.Peb.v() in [None, 0]:
+
yield proc.Pcb.DirectoryTableBase.v()
+
found = data.find(str(self.obj_parent.DTBSignature), found + 1)
offset += len(data)
diff --git a/volatility/plugins/overlays/linux/elf.py b/volatility/plugins/overlays/linux/elf.py
index 8011d6bc1..7652f405f 100644
--- a/volatility/plugins/overlays/linux/elf.py
+++ b/volatility/plugins/overlays/linux/elf.py
@@ -314,9 +314,9 @@ def program_headers(self):
arr_start = self.obj_offset + self.e_phoff
if self.e_phnum > 128:
- phnum = self.e_phnum
- else:
phnum = 128
+ else:
+ phnum = self.e_phnum
for i in range(phnum):
# use the real size
diff --git a/volatility/plugins/overlays/linux/linux.py b/volatility/plugins/overlays/linux/linux.py
index d87f6e5a2..d0df4ecc3 100644
--- a/volatility/plugins/overlays/linux/linux.py
+++ b/volatility/plugins/overlays/linux/linux.py
@@ -212,6 +212,7 @@ def __init__(self, *args, **kwargs):
# change the name to catch any code referencing the old hash table
self.sys_map = {}
self.sym_addr_cache = {}
+ self.dentry_cache = {}
self.physical_shift = 0
self.virtual_shift = 0
obj.Profile.__init__(self, *args, **kwargs)
@@ -220,6 +221,7 @@ def clear(self):
"""Clear out the system map, and everything else"""
self.sys_map = {}
self.sym_addr_cache = {}
+ self.dentry_cache = {}
self.physical_shift = 0
self.virtual_shift = 0
obj.Profile.clear(self)
@@ -858,6 +860,24 @@ def init_size(self):
return ret
+ @property
+ def init_text_size(self):
+ if hasattr(self, "init_layout"):
+ ret = self.m("init_layout").m("text_size")
+ else:
+ ret = self.m("init_text_size")
+
+ return ret
+
+ @property
+ def core_text_size(self):
+ if hasattr(self, "core_layout"):
+ ret = self.m("core_layout").m("text_size")
+ else:
+ ret = self.m("core_text_size")
+
+ return ret
+
@property
def core_size(self):
if hasattr(self, "core_layout"):
@@ -866,7 +886,8 @@ def core_size(self):
ret = self.m("core_size")
return ret
-
+
+
def _get_sect_count(self, grp):
arr = obj.Object(theType = 'Array', offset = grp.attrs, vm = self.obj_vm, targetType = 'Pointer', count = 25)
@@ -1059,13 +1080,30 @@ def is_valid(self):
return valid
class vm_area_struct(obj.CType):
+ def is_valid(self):
+ start = self.vm_start.v()
+ end = self.vm_end.v()
+ pgoff = self.vm_pgoff.v()
+
+ valid = True
+
+ if (start > end) or \
+ (end - start > 100000000000) or \
+ (start > 0xff00000000000000) or \
+ (end > 0xff00000000000000) or \
+ (pgoff > 100000000000):
+
+ valid = False
+
+ return valid
+
def vm_name(self, task):
if self.vm_file:
fname = linux_common.get_path(task, self.vm_file)
if fname == []:
fname = ""
- elif self.vm_start <= task.mm.start_brk and self.vm_end >= task.mm.brk:
+ elif self.vm_start <= task.mm.brk and self.vm_end >= task.mm.start_brk:
fname = "[heap]"
elif self.vm_start <= task.mm.start_stack and self.vm_end >= task.mm.start_stack:
fname = "[stack]"
@@ -1145,10 +1183,14 @@ def is_suspicious(self):
def info(self, task):
if self.vm_file:
- inode = self.vm_file.dentry.d_inode
- major, minor = inode.i_sb.major, inode.i_sb.minor
- ino = inode.i_ino
pgoff = self.vm_pgoff << 12
+
+ inode = self.vm_file.dentry.d_inode
+ if inode and inode.is_valid():
+ major, minor = inode.i_sb.major, inode.i_sb.minor
+ ino = inode.i_ino
+ else:
+ major, minor, ino = [0] * 3
else:
(major, minor, ino, pgoff) = [0] * 4
@@ -1159,6 +1201,16 @@ def info(self, task):
return fname, major, minor, ino, pgoff
+class kobject(obj.CType):
+ def reference_count(self):
+ refcnt = self.kref.refcount
+ if hasattr(refcnt, "counter"):
+ ret = refcnt.counter
+ else:
+ ret = refcnt.refs.counter
+
+ return ret
+
class task_struct(obj.CType):
def is_valid_task(self):
@@ -1250,6 +1302,9 @@ def uid(self):
if type(ret) in [obj.CType, obj.NativeType]:
ret = ret.v()
+ if ret > 1000000:
+ ret = -1
+
return ret
@property
@@ -1269,6 +1324,9 @@ def gid(self):
if type(ret) == obj.CType:
ret = ret.v()
+ if ret > 1000000:
+ ret = -1
+
return ret
@property
@@ -1284,26 +1342,9 @@ def euid(self):
return ret
- def find_heap_vma(self):
- ret = None
-
- for vma in self.get_proc_maps():
- # find the data section of bash
- if vma.vm_start <= self.mm.start_brk and vma.vm_end >= self.mm.brk:
- ret = vma
- break
-
- return ret
-
def bash_hash_entries(self):
nbuckets_offset = self.obj_vm.profile.get_obj_offset("_bash_hash_table", "nbuckets")
- heap_vma = self.find_heap_vma()
-
- if heap_vma == None:
- debug.debug("Unable to find heap for pid %d" % self.pid)
- return
-
proc_as = self.get_process_address_space()
if proc_as == None:
return
@@ -1315,8 +1356,6 @@ def bash_hash_entries(self):
for ent in htable:
yield ent
- off = off + 1
-
def ldrmodules(self):
proc_maps = {}
dl_maps = {}
@@ -1378,7 +1417,8 @@ def ldrmodules(self):
def plt_hook_info(self):
elfs = dict()
-
+ task_proc_maps = list(self.get_proc_maps())
+
for elf, elf_start, elf_end, soname, needed in self.elfs():
elfs[(self, soname)] = (elf, elf_start, elf_end, needed)
@@ -1432,7 +1472,7 @@ def plt_hook_info(self):
hookdesc = ''
vma = None
- for i in task.get_proc_maps():
+ for i in task_proc_maps:
if addr >= i.vm_start and addr < i.vm_end:
vma = i
break
@@ -1592,22 +1632,35 @@ def bash_history_entries(self):
yield hist
def _dynamic_env(self, proc_as, pack_format, addr_sz):
+ # preload address 0
+ addr_cache = {0 : 1}
+
for vma in self.get_proc_maps():
if not (vma.vm_file and str(vma.vm_flags) == "rw-"):
continue
fname = vma.info(self)[0]
- if fname.find("ld") == -1 and fname != "/bin/bash":
+ if fname.find("ld") == -1 and (not fname.endswith(("/bin/bash", "/bin/dash", "/bin/sh"))):
continue
env_start = 0
- for off in range(vma.vm_start, vma.vm_end):
+
+ vma_start = int(vma.vm_start)
+ vma_end = int(vma.vm_end)
+ vma_len = vma_end - vma_start
+ vma_data = proc_as.zread(vma_start, vma_len)
+
+ for off in range(0, vma_len - addr_sz, 4):
# check the first index
- addrstr = proc_as.read(off, addr_sz)
- if not addrstr or len(addrstr) != addr_sz:
- continue
+ addrstr = vma_data[off:off+addr_sz]
addr = struct.unpack(pack_format, addrstr)[0]
+
+ if addr in addr_cache:
+ continue
+
+ addr_cache[addr] = 1
+
# check first idx...
if addr:
firstaddrstr = proc_as.read(addr, addr_sz)
@@ -1658,12 +1711,17 @@ def _dynamic_env(self, proc_as, pack_format, addr_sz):
break
def _shell_variables(self, proc_as, pack_format, addr_sz):
+ # preload cache with address 0
+ ptr_cache = {0 : 1}
+
+ nbuckets_offset = self.obj_vm.profile.get_obj_offset("_bash_hash_table", "nbuckets")
+
bash_was_last = False
for vma in self.get_proc_maps():
if vma.vm_file:
fname = vma.info(self)[0]
- if fname.endswith("/bin/bash"):
+ if fname.endswith(("/bin/bash", "/bin/dash", "/bin/sh")):
bash_was_last = True
else:
bash_was_last = False
@@ -1676,15 +1734,20 @@ def _shell_variables(self, proc_as, pack_format, addr_sz):
if bash_was_last == False:
continue
- nbuckets_offset = self.obj_vm.profile.get_obj_offset("_bash_hash_table", "nbuckets")
+ vma_start = int(vma.vm_start)
+ vma_end = int(vma.vm_end)
+ vma_len = vma_end - vma_start
+ vma_data = proc_as.zread(vma_start, vma_len)
- for off in range(vma.vm_start, vma.vm_end, 4):
- ptr_test = proc_as.read(off, addr_sz)
- if not ptr_test:
+ for off in range(0, vma_len - addr_sz, 4):
+ ptr_test = vma_data[off:off+addr_sz]
+
+ ptr = struct.unpack(pack_format, ptr_test)[0]
+ if ptr in ptr_cache:
continue
- ptr = struct.unpack(pack_format, ptr_test)[0]
-
+ ptr_cache[ptr] = 1
+
ptr_test2 = proc_as.read(ptr + 20, addr_sz)
if not ptr_test2:
continue
@@ -1710,6 +1773,9 @@ def bash_environment(self):
# In cases when mm is an invalid pointer
if not proc_as:
return
+
+ if str(self.comm) not in ["sh", "dash", "bash"]:
+ return
# Are we dealing with 32 or 64-bit pointers
if self.obj_vm.profile.metadata.get('memory_model', '32bit') == '32bit':
@@ -1848,14 +1914,17 @@ def threads(self):
return threads
def get_proc_maps(self):
- if not self.mm:
+ if not self.mm or self.get_process_address_space() == None:
return
seen = {}
for vma in linux_common.walk_internal_list("vm_area_struct", "vm_next", self.mm.mmap):
val = vma.v()
if val in seen:
break
-
+
+ if not vma.is_valid():
+ break
+
yield vma
seen[val] = 1
@@ -1907,7 +1976,7 @@ def search_process_memory(self, s, heap_only = False):
for vma in self.get_proc_maps():
if heap_only:
- if not (vma.vm_start <= self.mm.start_brk and vma.vm_end >= self.mm.brk):
+ if not (vma.vm_start <= self.mm.brk and vma.vm_end >= self.mm.start_brk):
continue
offset = vma.vm_start
@@ -2175,7 +2244,25 @@ def minor(self):
return self.s_dev & ((1 << 20) - 1)
class inode(obj.CType):
+ @property
+ def uid(self):
+
+ try:
+ ret = int(self.i_uid)
+ except TypeError:
+ ret = int(self.i_uid.val)
+
+ return ret
+ @property
+ def gid(self):
+
+ try:
+ ret = int(self.i_gid)
+ except TypeError:
+ ret = int(self.i_gid.val)
+ return ret
+
def is_dir(self):
"""Mimic the S_ISDIR macro"""
return self.i_mode & linux_flags.S_IFMT == linux_flags.S_IFDIR
@@ -2240,6 +2327,8 @@ class VolatilityDTB(obj.VolatilityMagic):
def generate_suggestions(self):
"""Tries to locate the DTB."""
profile = self.obj_vm.profile
+ config = self.obj_vm.get_config()
+ tbl = self.obj_vm.profile.sys_map["kernel"]
if profile.metadata.get('memory_model', '32bit') == "32bit":
sym = "swapper_pg_dir"
@@ -2248,13 +2337,14 @@ def generate_suggestions(self):
fmt = "= 4.13
+ if not sym in tbl:
+ sym = "init_top_pgt"
+
shifts = [0xffffffff80000000, 0xffffffff80000000 - 0x1000000, 0xffffffff7fe00000]
read_sz = 8
fmt = "= 0:
+ if cur.get_phys_page() != 0 and cur.get_offset() >= 0:
sz = 4096
if file_size - written < 4096:
sz = file_size - written
- buf = phys_as.zread(cur.phys_page * 4096, sz)
+ buf = phys_as.zread(cur.get_phys_page() * 4096, sz)
- yield (cur.offset.v(), buf)
+ yield (cur.get_offset().v(), buf)
idx = idx + 1
written = written + 4096
- cur = self._get_next_page(cur.listq)
+ cur = self._get_next_page(cur.get_listq())
+
+class vm_page(obj.CType):
+ def _get_vmp_member(self, memb):
+ ret = self.members.get(memb)
+
+ if ret:
+ ret = self.m(memb)
+
+ # 10.14+
+ else:
+ ret = self.m("vmp_" + memb)
+
+ return ret
+
+ def get_offset(self):
+ return self._get_vmp_member("offset")
+
+ def get_phys_page(self):
+ return self._get_vmp_member("phys_page")
+
+ def get_listq(self):
+ return self._get_vmp_member("listq")
class fileglob(obj.CType):
@@ -483,6 +518,8 @@ def bash_hash_entries(self):
htable_type = "mac64_bash_hash_table"
nbuckets_offset = self.obj_vm.profile.get_obj_offset(htable_type, "nbuckets")
+ range_end = 4096 - nbuckets_offset - 8
+
for map in self.get_proc_maps():
if shared_start <= map.start <= shared_end:
continue
@@ -498,42 +535,57 @@ def bash_hash_entries(self):
if map.end - map.start > 0x40000000:
continue
- off = map.start
+ chunk_off = int(map.start)
+ end = int(map.end)
- while off < map.end:
- # test the number of buckets
- dr = proc_as.read(off + nbuckets_offset, 4)
- if dr == None:
- new_off = (off & ~0xfff) + 0xfff + 1
- off = new_off
- continue
+ while chunk_off < end:
+ data = proc_as.read(chunk_off, 4096)
- test = struct.unpack(" 0:
- pdata = bucket.data
+ htable = obj.Object(htable_type, offset = read_off, vm = proc_as)
+
+ if htable.is_valid():
+ bucket_array = obj.Object(theType="Array", targetType=addr_type, offset = htable.bucket_array, vm = htable.nbuckets.obj_vm, count = 64)
+ seen = set()
+
+ for bucket_ptr in bucket_array:
+ bucket = obj.Object(bucket_contents_type, offset = bucket_ptr, vm = htable.nbuckets.obj_vm)
+ while bucket != None and bucket.times_found > 0:
+ if bucket.v() in seen:
+ break
+ seen.add(bucket.v())
- if pdata == None:
- bucket = bucket.next_bucket()
- continue
+ pdata = bucket.data
- if bucket.key != None and bucket.data != None and pdata.is_valid() and (0 <= pdata.flags <= 2):
- if len(str(bucket.key)) > 0 or len(str(bucket.data.path)) > 0:
- yield bucket
+ if pdata == None:
+ bucket = bucket.next_bucket()
+ continue
- bucket = bucket.next_bucket()
-
- off = off + 1
+ if bucket.key != None and bucket.data != None and pdata.is_valid() and (0 <= pdata.flags <= 2):
+ if (len(str(bucket.key)) > 0 or len(str(bucket.data.path)) > 0) and (0 < bucket.times_found <= 1024):
+ yield bucket
+
+ bucket = bucket.next_bucket()
+
+ off = off + 4
def bash_history_entries(self):
proc_as = self.get_process_address_space()
@@ -619,54 +671,60 @@ def _carve_mappings_for_env(self, proc_as, mappings):
if env_start:
break
- off = start
-
if length >= 0x1000000:
continue
+
+ chunk_offset = start
- while off < end:
+ while chunk_offset < end:
if env_start:
break
- # check the first index
- addrstr = proc_as.read(off, self.pack_size)
- if not addrstr:
- off = (off & ~0xfff) + 0xfff + 1
+ data = proc_as.read(chunk_offset, 4096)
+
+ chunk_offset = chunk_offset + 4096
+
+ if data == None:
continue
-
- off = off + 4
- addr = struct.unpack(self.pack_fmt, addrstr)[0]
- if addr in seen_ptrs:
- continue
+ off = 0
+ # read from the buffer
+ while off < 4096 - 4:
+ addrstr = data[off:off+self.pack_size]
+
+ off = off + 4
- seen_ptrs[addr] = 1
-
- # check first idx...
- if addr:
- firstaddrstr = proc_as.read(addr, self.pack_size)
- if not firstaddrstr or len(firstaddrstr) != self.pack_size:
+ addr = struct.unpack(self.pack_fmt, addrstr)[0]
+ if addr in seen_ptrs:
continue
- firstaddr = struct.unpack(self.pack_fmt, firstaddrstr)[0]
- if firstaddr in seen_firsts:
- continue
-
- seen_firsts[firstaddr] = 1
- buf = proc_as.read(firstaddr, 64)
- if not buf:
- continue
- eqidx = buf.find("=")
- if eqidx > 0:
- nullidx = buf.find("\x00")
- # single char name, =
- if nullidx >= eqidx:
- env_start = addr
+ seen_ptrs[addr] = 1
+
+ # check first idx...
+ if addr:
+ firstaddrstr = proc_as.read(addr, self.pack_size)
+ if not firstaddrstr or len(firstaddrstr) != self.pack_size:
+ continue
+ firstaddr = struct.unpack(self.pack_fmt, firstaddrstr)[0]
+ if firstaddr in seen_firsts:
+ continue
+
+ seen_firsts[firstaddr] = 1
- if not dynamic_env_hint:
- dynamic_env_hint = [start, end, length]
+ buf = proc_as.read(firstaddr, 64)
+ if not buf:
+ continue
+ eqidx = buf.find("=")
+ if eqidx > 0:
+ nullidx = buf.find("\x00")
+ # single char name, =
+ if nullidx >= eqidx:
+ env_start = addr
- break
+ if not dynamic_env_hint:
+ dynamic_env_hint = [start, end, length]
+
+ break
return env_start
@@ -983,7 +1041,7 @@ def text_start(self):
for map in self.get_proc_maps():
vnode = map.get_vnode()
- if vnode and vnode != "sub_map" and vnode.v() == wanted_vnode:
+ if vnode and vnode != "sub_map" and vnode.v() == wanted_vnode and map.get_perms() == "r-x":
text_start = map.start.v()
break
@@ -1003,6 +1061,8 @@ def get_macho(self, exe_address):
proc_as = self.get_process_address_space()
m = obj.Object("macho_header", offset = exe_address, vm = proc_as)
+ if not m.is_valid():
+ return
buffer = ""
@@ -1059,6 +1119,8 @@ def get_dyld_maps(self):
return
info_addr = struct.unpack(self.pack_fmt, info_buf)[0]
+ if not proc_as.is_valid_address(info_addr):
+ return
cnt = infos.infoArrayCount
if cnt > 4096:
@@ -1073,10 +1135,21 @@ def get_dyld_maps(self):
def get_proc_maps(self):
map = self.task.map.hdr.links.next
+ seen = set()
+
for i in xrange(self.task.map.hdr.nentries):
+ if map.v() in seen:
+ break
+ seen.add(map.v())
+
if not map:
break
- yield map
+
+ map_size = int(map.links.end - map.links.start)
+
+ if 4095 < map_size < 0x800000000000 and map_size % 4096 == 0:
+ yield map
+
map = map.links.next
def find_heap_map(self):
@@ -1246,6 +1319,11 @@ def lsof(self):
yield f, path, i
class rtentry(obj.CType):
+ def is_valid(self):
+ return str(self.source_ip) != "" and \
+ str(self.dest_ip) != "" and \
+ (0 <= int(self.sent) < 50000000000) and \
+ (0 <= int(self.rx) < 50000000000)
def get_time(self):
if not hasattr(self, "base_calendartime"):
@@ -1322,6 +1400,9 @@ def walk_list(self, list_head):
p = p.tasks.prev.dereference_as("task")
class zone(obj.CType):
+ def is_valid(self):
+ return self.elem_size > 0
+
def _get_from_active_zones(self):
ret = []
first_elem = self.active_zones
@@ -1454,13 +1535,18 @@ def get_perms(self):
perms = perms + "-"
return perms
+
+ def range_alias(self):
+ if hasattr(self, "alias"):
+ ret = self.alias.v()
+ else:
+ ret = self.vme_offset.v() & 0xfff
+
+ return ret
# used to find heap, stack, etc.
def get_special_path(self):
- if hasattr(self, "alias"):
- check = self.alias.v()
- else:
- check = self.vme_offset.v() & 0xfff
+ check = self.range_alias()
if 0 < check < 10:
ret = "[heap]"
@@ -1478,9 +1564,12 @@ def get_path(self):
ret = vnode
elif vnode:
path = []
- while vnode:
+ seen = set()
+ while vnode and vnode.v() not in seen:
+ seen.add(vnode.v())
path.append(str(vnode.v_name.dereference() or ''))
vnode = vnode.v_parent
+
path.reverse()
ret = "/".join(path)
else:
@@ -1497,6 +1586,15 @@ def object(self):
return ret
+ @property
+ def offset(self):
+ if hasattr(self, "vme_offset"):
+ ret = self.vme_offset
+ else:
+ ret = self.m("offset")
+
+ return ret
+
def get_vnode(self):
map_obj = self
@@ -1506,8 +1604,11 @@ def get_vnode(self):
# find_vnode_object
vnode_object = map_obj.object.object()
- while vnode_object.shadow.dereference() != None:
+ seen = set()
+
+ while vnode_object.shadow.dereference() != None and vnode_object.v() not in seen:
vnode_object = vnode_object.shadow.dereference()
+ seen.add(vnode_object.v())
ops = vnode_object.pager.mo_pager_ops.v()
@@ -2213,6 +2314,7 @@ def modification(self, profile):
'vm_map_object' : vm_map_object,
'rtentry' : rtentry,
'queue_entry' : queue_entry,
+ 'vm_page' : vm_page,
})
mac_overlay = {
diff --git a/volatility/plugins/overlays/mac/macho.py b/volatility/plugins/overlays/mac/macho.py
index 46c08559c..1e65e60d7 100644
--- a/volatility/plugins/overlays/mac/macho.py
+++ b/volatility/plugins/overlays/mac/macho.py
@@ -281,16 +281,24 @@ def __init__(self, theType, offset, vm, name = None, **kwargs):
self.cached_dysymtab = None
self.cached_syms = None
self.load_diff = 0
+ self.link_edit_bias = 0
macho.__init__(self, 1, "macho32_header", "macho64_header", theType, offset, vm, name, **kwargs)
if self.macho_obj:
- self._build_symbol_caches()
self.calc_load_diff()
+ self._calc_linkedit_bias()
+ self._build_symbol_caches()
def is_valid(self):
return self.macho_obj != None
+ def _calc_linkedit_bias(self):
+ for s in self.segments():
+ if str(s.segname) == "__LINKEDIT":
+ self.link_edit_bias = s.vmaddr - s.fileoff
+ break
+
def calc_load_diff(self):
seg = None
@@ -314,7 +322,6 @@ def load_commands(self):
# the load commands start after the header
hdr_size = self.macho_obj.size()
-
if hdr_size == 0 or hdr_size > 100000000:
return
@@ -358,16 +365,24 @@ def get_indirect_syms(self):
tname = self._get_typename("nlist")
obj_size = self.obj_vm.profile.get_obj_size(tname)
+ indirect_table_addr = self.link_edit_bias + self.cached_dysymtab.indirectsymoff
+
+ if not self.obj_vm.is_valid_address(indirect_table_addr):
+ return syms
+
cnt = self.cached_dysymtab.nindirectsyms
if cnt > 100000:
cnt = 1024
-
- symtab_idxs = obj.Object(theType="Array", targetType="unsigned int", count=cnt, offset = self.obj_offset + self.cached_dysymtab.indirectsymoff, vm = self.obj_vm, parent = self)
+
+ symtab_idxs = obj.Object(theType="Array", targetType="unsigned int", count=cnt,
+ offset = indirect_table_addr,
+ vm = self.obj_vm, parent = self)
for idx in symtab_idxs:
sym_addr = self.cached_symtab + (idx * obj_size)
sym = obj.Object("macho_nlist", offset = sym_addr, vm = self.obj_vm, parent = self)
- syms.append(sym)
+ if sym.is_valid():
+ syms.append(sym)
return syms
@@ -376,10 +391,18 @@ def _get_symtab_syms(self, sym_command, symtab_addr):
tname = self._get_typename("nlist")
obj_size = self.obj_vm.profile.get_obj_size(tname)
- for i in range(sym_command.nsyms):
+ if not self.obj_vm.is_valid_address(symtab_addr):
+ return syms
+
+ num_syms = sym_command.nsyms
+ if num_syms > 2000:
+ return syms
+
+ for i in range(num_syms):
sym_addr = symtab_addr + (i * obj_size)
sym = obj.Object("macho_nlist", offset = sym_addr, vm = self.obj_vm, parent = self)
- syms.append(sym)
+ if sym.is_valid():
+ syms.append(sym)
return syms
@@ -391,16 +414,16 @@ def _build_symbol_caches(self):
return
symtab_command = symtab_cmd.cast(symtab_struct_name)
- str_strtab = self.obj_offset + symtab_command.stroff
- symtab_addr = self.obj_offset + symtab_command.symoff
-
+ str_strtab = self.link_edit_bias + symtab_command.stroff
+ symtab_addr = self.link_edit_bias + symtab_command.symoff
+
self.cached_syms = self._get_symtab_syms(symtab_command, symtab_addr)
-
+
dysymtab_cmd = self.load_command_of_type(0xb) # LC_DYSYMTAB
- dystruct_name = self._get_typename("dysymtab_command")
-
if dysymtab_cmd == None:
return
+
+ dystruct_name = self._get_typename("dysymtab_command")
dysymtab_command = dysymtab_cmd.cast(dystruct_name)
self.cached_strtab = str_strtab
diff --git a/volatility/plugins/overlays/windows/pe_vtypes.py b/volatility/plugins/overlays/windows/pe_vtypes.py
index 06999adae..554f1f47e 100644
--- a/volatility/plugins/overlays/windows/pe_vtypes.py
+++ b/volatility/plugins/overlays/windows/pe_vtypes.py
@@ -448,13 +448,29 @@ def load_time(self):
else:
return ""
+ @property
+ def LoadCount(self):
+ # prior to windows 8 / server 2012
+ try:
+ return self.m("LoadCount")
+ except AttributeError:
+ pass
+
+ # windows 8 / server 2012 and later
+ try:
+ return self.ObsoleteLoadCount
+ except AttributeError:
+ pass
+
+ return obj.NoneObject("No load count")
+
def _nt_header(self):
"""Return the _IMAGE_NT_HEADERS object"""
try:
dos_header = obj.Object("_IMAGE_DOS_HEADER", offset = self.DllBase,
vm = self.obj_native_vm)
-
+
return dos_header.get_nt_header()
except ValueError:
return obj.NoneObject("Failed initial sanity checks")
@@ -571,6 +587,7 @@ def exports(self):
if expdir.valid(self._nt_header()):
# Ordinal, Function RVA, and Name Object
+
for o, f, n in expdir._exported_functions():
yield o, f, n
@@ -751,9 +768,27 @@ def get_image(self, unsafe = False, memory = False, fix = False):
else:
return self._get_image_exe(unsafe, fix)
+class _IMAGE_NT_HEADERS64(obj.CType):
+ @property
+ def OptionalHeader(self):
+ ret = self.m("OptionalHeader")
+
+ if self.obj_vm.profile.get_obj_size("address") == 8 and self.FileHeader.Machine == 0x014c: # 32bit exe
+ ret = ret.cast("_IMAGE_OPTIONAL_HEADER32")
+
+ return ret
+
class _IMAGE_NT_HEADERS(obj.CType):
"""PE header"""
+ @property
+ def OptionalHeader(self):
+ ret = self.m("OptionalHeader")
+ if self.obj_vm.profile.get_obj_size("address") == 8 and self.FileHeader.Machine == 0x014c: # 32bit exe
+ ret = ret.cast("_IMAGE_OPTIONAL_HEADER32")
+
+ return ret
+
def get_sections(self, unsafe = False):
"""Get the PE sections"""
sect_size = self.obj_vm.profile.get_obj_size("_IMAGE_SECTION_HEADER")
@@ -957,6 +992,10 @@ def __init__(self, theType = None, offset = None, vm = None, parent = None, *arg
def get_entries(self):
"""Gets a tree of the entries from the top level IRD"""
+
+ if self.NamedEntriesCount + self.IdEntriesCount > 4096:
+ return
+
for irde in self.Entries:
if irde != None:
if irde.Name & 0x80000000:
@@ -996,10 +1035,11 @@ def modification(self, profile):
'_LDR_DATA_TABLE_ENTRY': _LDR_DATA_TABLE_ENTRY,
'_IMAGE_DOS_HEADER': _IMAGE_DOS_HEADER,
'_IMAGE_NT_HEADERS': _IMAGE_NT_HEADERS,
+ '_IMAGE_NT_HEADERS64': _IMAGE_NT_HEADERS64,
'_IMAGE_SECTION_HEADER': _IMAGE_SECTION_HEADER,
'_IMAGE_RESOURCE_DIRECTORY': _IMAGE_RESOURCE_DIRECTORY,
'_IMAGE_RESOURCE_DIR_STRING_U': _IMAGE_RESOURCE_DIR_STRING_U,
'_VS_FIXEDFILEINFO': _VS_FIXEDFILEINFO,
'_VS_VERSION_INFO': _VS_VERSION_INFO,
'VerStruct': VerStruct,
- })
+ })
\ No newline at end of file
diff --git a/volatility/plugins/overlays/windows/ssdt_vtypes.py b/volatility/plugins/overlays/windows/ssdt_vtypes.py
index ceb17910c..79cd06414 100644
--- a/volatility/plugins/overlays/windows/ssdt_vtypes.py
+++ b/volatility/plugins/overlays/windows/ssdt_vtypes.py
@@ -195,4 +195,68 @@ class Win8SP1x64Syscalls(AbstractSyscalls):
conditions = {'os': lambda x: x == 'windows',
'memory_model': lambda x: x == '64bit',
'major': lambda x : x == 6,
- 'minor': lambda x : x == 3}
\ No newline at end of file
+ 'minor': lambda x : x == 3}
+
+class Win10x64_10586_Syscalls(AbstractSyscalls):
+ syscall_module = 'volatility.plugins.overlays.windows.win10_x64_10586_syscalls'
+ conditions = {'os': lambda x: x == 'windows',
+ 'memory_model': lambda x: x == '64bit',
+ 'major': lambda x : x == 6,
+ 'minor': lambda x : x == 4,
+ 'build': lambda x : x == 10586}
+
+class Win10x86_10586_Syscalls(AbstractSyscalls):
+ syscall_module = 'volatility.plugins.overlays.windows.win10_x86_10586_syscalls'
+ conditions = {'os': lambda x: x == 'windows',
+ 'memory_model': lambda x: x == '32bit',
+ 'major': lambda x : x == 6,
+ 'minor': lambda x : x == 4,
+ 'build': lambda x : x == 10586}
+
+class Win10x64_14393_Syscalls(AbstractSyscalls):
+ syscall_module = 'volatility.plugins.overlays.windows.win10_x64_14393_syscalls'
+ conditions = {'os': lambda x: x == 'windows',
+ 'memory_model': lambda x: x == '64bit',
+ 'major': lambda x : x == 6,
+ 'minor': lambda x : x == 4,
+ 'build': lambda x : x == 14393}
+
+class Win10x86_14393_Syscalls(AbstractSyscalls):
+ syscall_module = 'volatility.plugins.overlays.windows.win10_x86_14393_syscalls'
+ conditions = {'os': lambda x: x == 'windows',
+ 'memory_model': lambda x: x == '32bit',
+ 'major': lambda x : x == 6,
+ 'minor': lambda x : x == 4,
+ 'build': lambda x : x == 14393}
+
+class Win10x64_15063_Syscalls(AbstractSyscalls):
+ syscall_module = 'volatility.plugins.overlays.windows.win10_x64_15063_syscalls'
+ conditions = {'os': lambda x: x == 'windows',
+ 'memory_model': lambda x: x == '64bit',
+ 'major': lambda x : x == 6,
+ 'minor': lambda x : x == 4,
+ 'build': lambda x : x == 15063}
+
+class Win10x86_15063_Syscalls(AbstractSyscalls):
+ syscall_module = 'volatility.plugins.overlays.windows.win10_x86_15063_syscalls'
+ conditions = {'os': lambda x: x == 'windows',
+ 'memory_model': lambda x: x == '32bit',
+ 'major': lambda x : x == 6,
+ 'minor': lambda x : x == 4,
+ 'build': lambda x : x == 15063}
+
+class Win10x64_16299_Syscalls(AbstractSyscalls):
+ syscall_module = 'volatility.plugins.overlays.windows.win10_x64_16299_syscalls'
+ conditions = {'os': lambda x: x == 'windows',
+ 'memory_model': lambda x: x == '64bit',
+ 'major': lambda x : x == 6,
+ 'minor': lambda x : x == 4,
+ 'build': lambda x : x == 16299}
+
+class Win10x86_16299_Syscalls(AbstractSyscalls):
+ syscall_module = 'volatility.plugins.overlays.windows.win10_x86_16299_syscalls'
+ conditions = {'os': lambda x: x == 'windows',
+ 'memory_model': lambda x: x == '32bit',
+ 'major': lambda x : x == 6,
+ 'minor': lambda x : x == 4,
+ 'build': lambda x : x == 16299}
\ No newline at end of file
diff --git a/volatility/plugins/overlays/windows/tcpip_vtypes.py b/volatility/plugins/overlays/windows/tcpip_vtypes.py
index e02e09e5e..25f55b45b 100644
--- a/volatility/plugins/overlays/windows/tcpip_vtypes.py
+++ b/volatility/plugins/overlays/windows/tcpip_vtypes.py
@@ -442,12 +442,20 @@ def modification(self, profile):
}],
})
- if profile.metadata.get("build") >= 14393:
+ build = profile.metadata.get("build")
+
+ if build == 14393:
profile.merge_overlay({
'_TCP_ENDPOINT': [ None, {
'Owner' : [ 0x1b4, ['pointer', ['_EPROCESS']]],
}],
})
+ elif build >= 15063:
+ profile.merge_overlay({
+ '_TCP_ENDPOINT': [ None, {
+ 'Owner' : [ 0x1cc, ['pointer', ['_EPROCESS']]],
+ }],
+ })
class Win8x64Tcpip(obj.ProfileModification):
before = ['Win7Vista2008x64Tcpip']
@@ -491,3 +499,19 @@ class Win10x64Tcpip(obj.ProfileModification):
'minor': lambda x : x == 4}
def modification(self, profile):
profile.vtypes.update(tcpip_vtypes_win_10_x64)
+
+class Win10x64_15063_Tcpip(obj.ProfileModification):
+ """TCP Endpoint for Creators and Fall Creators"""
+
+ before = ['Win10x64Tcpip']
+ conditions = {'os': lambda x: x == 'windows',
+ 'memory_model': lambda x: x == '64bit',
+ 'major': lambda x : x == 6,
+ 'minor': lambda x : x == 4,
+ 'build': lambda x : x >= 15063}
+ def modification(self, profile):
+ profile.merge_overlay({
+ '_TCP_ENDPOINT': [ None, {
+ 'Owner' : [ 0x270, ['pointer', ['_EPROCESS']]],
+ }],
+ })
diff --git a/volatility/plugins/overlays/windows/vista.py b/volatility/plugins/overlays/windows/vista.py
index 49ea2196c..b343b8bcd 100644
--- a/volatility/plugins/overlays/windows/vista.py
+++ b/volatility/plugins/overlays/windows/vista.py
@@ -113,7 +113,8 @@ class VistaObjectClasses(obj.ProfileModification):
def modification(self, profile):
profile.object_classes.update({'_ETHREAD' : _ETHREAD,
'_POOL_HEADER': _POOL_HEADER,
- '_TOKEN': _TOKEN})
+ '_TOKEN': _TOKEN,
+ 'wchar': windows._UNICODE_STRING})
class VistaKDBG(windows.AbstractKDBGMod):
before = ['WindowsOverlay']
diff --git a/volatility/plugins/overlays/windows/win10.py b/volatility/plugins/overlays/windows/win10.py
index 37e04a2a0..2b869735f 100644
--- a/volatility/plugins/overlays/windows/win10.py
+++ b/volatility/plugins/overlays/windows/win10.py
@@ -31,6 +31,7 @@
import volatility.win32.tasks as tasks
import volatility.debug as debug
import volatility.plugins.overlays.windows.win8 as win8
+from volatility.win32.rawreg import KEY_FLAGS
try:
import distorm3
@@ -42,7 +43,7 @@ class _HMAP_ENTRY(obj.CType):
@property
def BlockAddress(self):
- return self.PermanentBinAddress & 0xFFFFFFFFFFF0
+ return (self.PermanentBinAddress & 0xFFFFFFFFFFF0) + self.BlockOffset
class Win10Registry(obj.ProfileModification):
"""The Windows 10 registry HMAP"""
@@ -54,6 +55,26 @@ class Win10Registry(obj.ProfileModification):
def modification(self, profile):
profile.object_classes.update({"_HMAP_ENTRY": _HMAP_ENTRY})
+class _CM_KEY_BODY(windows._CM_KEY_BODY):
+ """Registry key"""
+
+ def full_key_name(self):
+ output = []
+ kcb = self.KeyControlBlock
+ seen = []
+ while kcb.ParentKcb and kcb.ParentKcb.obj_offset not in seen:
+ if kcb.NameBlock.Name == None:
+ break
+ # Win10/Win2016 14393 and later skip KCB's with KEY_HIVE_ENTRY flag set
+ if (kcb.Flags & KEY_FLAGS["KEY_HIVE_ENTRY"] == KEY_FLAGS["KEY_HIVE_ENTRY"]):
+ kcb = kcb.ParentKcb
+ if not kcb:
+ break
+ output.append(str(kcb.NameBlock.Name))
+ kcb = kcb.ParentKcb
+ seen.append(kcb.obj_offset)
+ return "\\".join(reversed(output))
+
class Win10x64DTB(obj.ProfileModification):
"""The Windows 10 64-bit DTB signature"""
@@ -65,9 +86,18 @@ class Win10x64DTB(obj.ProfileModification):
}
def modification(self, profile):
+ build = profile.metadata.get("build", 0)
+
+ if build >= 19041:
+ signature = "\x03\x00\x00\x00"
+ elif build >= 18362:
+ signature = "\x03\x00\xb8\x00"
+ else:
+ signature = "\x03\x00\xb6\x00"
+
profile.merge_overlay({
'VOLATILITY_MAGIC': [ None, {
- 'DTBSignature' : [ None, ['VolatilityMagic', dict(value = "\x03\x00\xb6\x00")]],
+ 'DTBSignature' : [ None, ['VolatilityMagic', dict(value = signature)]],
}]})
class Win10x86DTB(obj.ProfileModification):
@@ -83,7 +113,9 @@ class Win10x86DTB(obj.ProfileModification):
def modification(self, profile):
build = profile.metadata.get("build", 0)
- if build >= 15063:
+ if build >= 19041:
+ signature = "\x03\x00\x00\x00"
+ elif build >= 15063:
signature = "\x03\x00\x2C\x00"
else:
signature = "\x03\x00\x2A\x00"
@@ -93,6 +125,18 @@ def modification(self, profile):
'DTBSignature' : [ None, ['VolatilityMagic', dict(value = signature)]],
}]})
+class Win10ObjectClasses(obj.ProfileModification):
+ before = ['WindowsOverlay', 'WindowsObjectClasses']
+
+ conditions = {'os': lambda x: x == 'windows',
+ 'major': lambda x: x == 6,
+ 'minor': lambda x: x == 4,
+ 'build': lambda x: x >= 14393,
+ }
+
+ def modification(self, profile):
+ profile.object_classes.update({'_CM_KEY_BODY' : _CM_KEY_BODY,})
+
class Win10KDBG(windows.AbstractKDBGMod):
"""The Windows 10 KDBG signatures"""
@@ -104,6 +148,17 @@ class Win10KDBG(windows.AbstractKDBGMod):
kdbgsize = 0x368
+class Win10_17763KDBG(windows.AbstractKDBGMod):
+ """The Windows 10 17763 KDBG signatures"""
+
+ before = ['Win8KDBG', 'Win10KDBG']
+ conditions = {'os': lambda x: x == 'windows',
+ 'major': lambda x: x == 6,
+ 'minor': lambda x: x == 4,
+ 'build': lambda x: x >= 17763}
+
+ kdbgsize = 0x380
+
class ObHeaderCookieStore(object):
"""A class for finding and storing the nt!ObHeaderCookie value"""
@@ -533,6 +588,218 @@ class _OBJECT_HEADER_10_15063(_OBJECT_HEADER_10):
61: 'VRegConfigurationContext'
}
+class _OBJECT_HEADER_10_16299(_OBJECT_HEADER_10):
+
+ type_map = {
+ 2: 'Type',
+ 3: 'Directory',
+ 4: 'SymbolicLink',
+ 5: 'Token',
+ 6: 'Job',
+ 7: 'Process',
+ 8: 'Thread',
+ 9: 'Partition',
+ 10: 'UserApcReserve',
+ 11: 'IoCompletionReserve',
+ 12: 'ActivityReference',
+ 13: 'PsSiloContextPaged',
+ 14: 'PsSiloContextNonPaged',
+ 15: 'DebugObject',
+ 16: 'Event',
+ 17: 'Mutant',
+ 18: 'Callback',
+ 19: 'Semaphore',
+ 20: 'Timer',
+ 21: 'IRTimer',
+ 22: 'Profile',
+ 23: 'KeyedEvent',
+ 24: 'WindowStation',
+ 25: 'Desktop',
+ 26: 'Composition',
+ 27: 'RawInputManager',
+ 28: 'CoreMessaging',
+ 29: 'TpWorkerFactory',
+ 30: 'Adapter',
+ 31: 'Controller',
+ 32: 'Device',
+ 33: 'Driver',
+ 34: 'IoCompletion',
+ 35: 'WaitCompletionPacket',
+ 36: 'File',
+ 37: 'TmTm',
+ 38: 'TmTx',
+ 39: 'TmRm',
+ 40: 'TmEn',
+ 41: 'Section',
+ 42: 'Session',
+ 43: 'Key',
+ 44: 'RegistryTransaction',
+ 45: 'ALPC Port',
+ 46: 'EnergyTracker',
+ 47: 'PowerRequest',
+ 48: 'WmiGuid',
+ 49: 'EtwRegistration',
+ 50: 'EtwSessionDemuxEntry',
+ 51: 'EtwConsumer',
+ 52: 'DmaAdapter',
+ 53: 'DmaDomain',
+ 54: 'PcwObject',
+ 55: 'FilterConnectionPort',
+ 56: 'FilterCommunicationPort',
+ 57: 'NdisCmState',
+ 58: 'DxgkSharedResource',
+ 59: 'DxgkSharedSyncObject',
+ 60: 'DxgkSharedSwapChainObject',
+ 61: 'DxgkDisplayManagerObject',
+ 62: 'DxgkCurrentDxgProcessObject',
+ 63: 'DxgkSharedProtectedSessionObject',
+ 64: 'DxgkSharedBundleObject',
+ 65: 'VRegConfigurationContext',
+ }
+
+class _OBJECT_HEADER_10_17134(_OBJECT_HEADER_10):
+
+ type_map = {
+ 2: "Type",
+ 3: "Directory",
+ 4: "SymbolicLink",
+ 5: "Token",
+ 6: "Job",
+ 7: "Process",
+ 8: "Thread",
+ 9: "Partition",
+ 10: "UserApcReserve",
+ 11: "IoCompletionReserve",
+ 12: "ActivityReference",
+ 13: "PsSiloContextPaged",
+ 14: "PsSiloContextNonPaged",
+ 15: "DebugObject",
+ 16: "Event",
+ 17: "Mutant",
+ 18: "Callback",
+ 19: "Semaphore",
+ 20: "Timer",
+ 21: "IRTimer",
+ 22: "Profile",
+ 23: "KeyedEvent",
+ 24: "WindowStation",
+ 25: "Desktop",
+ 26: "Composition",
+ 27: "RawInputManager",
+ 28: "CoreMessaging",
+ 29: "TpWorkerFactory",
+ 30: "Adapter",
+ 31: "Controller",
+ 32: "Device",
+ 33: "Driver",
+ 34: "IoCompletion",
+ 35: "WaitCompletionPacket",
+ 36: "File",
+ 37: "TmTm",
+ 38: "TmTx",
+ 39: "TmRm",
+ 40: "TmEn",
+ 41: "Section",
+ 42: "Session",
+ 43: "Key",
+ 44: "RegistryTransaction",
+ 45: "ALPC",
+ 46: "EnergyTracker",
+ 47: "PowerRequest",
+ 48: "WmiGuid",
+ 49: "EtwRegistration",
+ 50: "EtwSessionDemuxEntry",
+ 51: "EtwConsumer",
+ 52: "CoverageSampler",
+ 53: "DmaAdapter",
+ 54: "PcwObject",
+ 55: "FilterConnectionPort",
+ 56: "FilterCommunicationPort",
+ 57: "NdisCmState",
+ 58: "DxgkSharedResource",
+ 59: "DxgkSharedKeyedMutexObject",
+ 60: "DxgkSharedSyncObject",
+ 61: "DxgkSharedSwapChainObject",
+ 62: "DxgkDisplayManagerObject",
+ 63: "DxgkCurrentDxgProcessObject",
+ 64: "DxgkSharedProtectedSessionObject",
+ 65: "DxgkSharedBundleObject",
+ 66: "DxgkCompositionObject",
+ 67: "VRegConfigurationContext",
+ }
+
+class _OBJECT_HEADER_10_18362(_OBJECT_HEADER_10):
+
+ type_map = {
+ 2: "Type",
+ 3: "Directory",
+ 4: "SymbolicLink",
+ 5: "Token",
+ 6: "Job",
+ 7: "Process",
+ 8: "Thread",
+ 9: "Partition",
+ 10: "UserApcReserve",
+ 11: "IoCompletionReserve",
+ 12: "ActivityReference",
+ 13: "PsSiloContextPaged",
+ 14: "PsSiloContextNonPaged",
+ 15: "DebugObject",
+ 16: "Event",
+ 17: "Mutant",
+ 18: "Callback",
+ 19: "Semaphore",
+ 20: "Timer",
+ 21: "IRTimer",
+ 22: "Profile",
+ 23: "KeyedEvent",
+ 24: "WindowStation",
+ 25: "Desktop",
+ 26: "Composition",
+ 27: "RawInputManager",
+ 28: "CoreMessaging",
+ 29: "ActivationObject",
+ 30: "TpWorkerFactory",
+ 31: "Adapter",
+ 32: "Controller",
+ 33: "Device",
+ 34: "Driver",
+ 35: "IoCompletion",
+ 36: "WaitCompletionPacket",
+ 37: "File",
+ 38: "TmTm",
+ 39: "TmTx",
+ 40: "TmRm",
+ 41: "TmEn",
+ 42: "Section",
+ 43: "Session",
+ 44: "Key",
+ 45: "RegistryTransaction",
+ 46: "ALPC",
+ 47: "EnergyTracker",
+ 48: "PowerRequest",
+ 49: "WmiGuid",
+ 50: "EtwRegistration",
+ 51: "EtwSessionDemuxEntry",
+ 52: "EtwConsumer",
+ 53: "CoverageSampler",
+ 54: "DmaAdapter",
+ 55: "PcwObject",
+ 56: "FilterConnectionPort",
+ 57: "FilterCommunicationPort",
+ 58: "NdisCmState",
+ 59: "DxgkSharedResource",
+ 60: "DxgkSharedKeyedMutexObject",
+ 61: "DxgkSharedSyncObject",
+ 62: "DxgkSharedSwapChainObject",
+ 63: "DxgkDisplayManagerObject",
+ 64: "DxgkCurrentDxgProcessObject",
+ 65: "DxgkSharedProtectedSessionObject",
+ 66: "DxgkSharedBundleObject",
+ 67: "DxgkCompositionObject",
+ 68: "VRegConfigurationContext",
+ }
+
class _HANDLE_TABLE_10_DD08DD42(win8._HANDLE_TABLE_81R264):
def decode_pointer(self, value):
@@ -555,7 +822,31 @@ def modification(self, profile):
metadata = profile.metadata
build = metadata.get("build", 0)
- if build >= 15063:
+ if build >= 18362:
+ header = _OBJECT_HEADER_10_18362
+
+ ## update the handle table here as well
+ if metadata.get("memory_model") == "64bit":
+ profile.object_classes.update({
+ "_HANDLE_TABLE": _HANDLE_TABLE_10_DD08DD42})
+
+ elif build >= 17134:
+ header = _OBJECT_HEADER_10_17134
+
+ ## update the handle table here as well
+ if metadata.get("memory_model") == "64bit":
+ profile.object_classes.update({
+ "_HANDLE_TABLE": _HANDLE_TABLE_10_DD08DD42})
+
+ elif build >= 16299:
+ header = _OBJECT_HEADER_10_16299
+
+ ## update the handle table here as well
+ if metadata.get("memory_model") == "64bit":
+ profile.object_classes.update({
+ "_HANDLE_TABLE": _HANDLE_TABLE_10_DD08DD42})
+
+ elif build >= 15063:
header = _OBJECT_HEADER_10_15063
## update the handle table here as well
@@ -571,19 +862,48 @@ def modification(self, profile):
profile.object_classes.update({
"_HANDLE_TABLE": _HANDLE_TABLE_10_DD08DD42})
- elif build >= 10240:
+ elif build >= 10586:
header = _OBJECT_HEADER_10_1AC738FB
else:
header = _OBJECT_HEADER_10
profile.object_classes.update({"_OBJECT_HEADER": header})
+class WSLPicoModifcation(obj.ProfileModification):
+ """Profile modification for Windows Subsystem for Linux,
+ in particular the Pico process contexts"""
+
+ before = ['WindowsOverlay']
+ conditions = {'os': lambda x: x == 'windows',
+ 'major': lambda x: x == 6,
+ 'minor': lambda x: x == 4,
+ 'memory_model': lambda x: x == '64bit'}
+
+ def modification(self, profile):
+
+ build = profile.metadata.get("build", 0)
+
+ if build <