pax_global_header00006660000000000000000000000064140526760040014516gustar00rootroot0000000000000052 comment=154e13be75e6d6a8bc5d45e001567a7803db0b28 volatility3-1.0.1/000077500000000000000000000000001405267600400140005ustar00rootroot00000000000000volatility3-1.0.1/.github/000077500000000000000000000000001405267600400153405ustar00rootroot00000000000000volatility3-1.0.1/.github/ISSUE_TEMPLATE/000077500000000000000000000000001405267600400175235ustar00rootroot00000000000000volatility3-1.0.1/.github/ISSUE_TEMPLATE/bug_report.md000066400000000000000000000011111405267600400222070ustar00rootroot00000000000000--- name: Bug report about: Create a report to help us improve --- **Describe the bug** A clear and concise description of what the bug is. **Context** Volatility Version: Operating System: Python Version: Suspected Operating System: Command: **To Reproduce** Steps to reproduce the behavior: 1. Use command '...' 2. See error **Expected behavior** A clear and concise description of what you expected to happen. **Screenshots** If applicable, add screenshots to help explain your problem. **Additional information** Add any other information about the problem here. volatility3-1.0.1/.github/ISSUE_TEMPLATE/feature_request.md000066400000000000000000000010661405267600400232530ustar00rootroot00000000000000--- name: Feature request about: Suggest an idea for Volatility --- **Is your feature request related to a problem? Please describe.** A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] **Describe the solution you'd like** A clear and concise description of what you want to happen. **Describe alternatives you've considered** A clear and concise description of any alternative solutions or features you've considered. **Additional information** Add any other information or screenshots about the feature request here. volatility3-1.0.1/.github/workflows/000077500000000000000000000000001405267600400173755ustar00rootroot00000000000000volatility3-1.0.1/.github/workflows/build-pypi.yml000066400000000000000000000013671405267600400222050ustar00rootroot00000000000000name: build-pypi on: push: branches: - stable - develop - 'release/**' pull_request: branches: - stable - 'release/**' jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 - name: Set up Python 3.x uses: actions/setup-python@v2 with: python-version: '3.x' - name: Install dependencies run: | python -m pip install --upgrade pip pip install setuptools wheel - name: Build PyPi packages run: | python setup.py sdist --formats=gztar,zip python setup.py bdist_wheel - name: Archive dist uses: actions/upload-artifact@v2 with: name: volatility3-pypi path: | dist/ volatility3-1.0.1/.gitignore000066400000000000000000000006121405267600400157670ustar00rootroot00000000000000# Python generated files __pycache__ *.pyc # Sphinx generated files doc/build doc/source/volatility3.* # Pycharm/PyDev development files workspace.xml .idea .vscode # Manually generated files .mypy_cache stubs volatility3/symbols/linux* volatility3/symbols/windows* volatility3/symbols/mac* # Mac metadata files .DS_Store # Volatility's config config*.json # Pyinstaller files build dist volatility3-1.0.1/.readthedocs.yml000066400000000000000000000010241405267600400170630ustar00rootroot00000000000000# .readthedocs.yml # Read the Docs configuration file # See https://docs.readthedocs.io/en/stable/config-file/v2.html for details # Required version: 2 # Build documentation in the docs/ directory with Sphinx sphinx: configuration: doc/source/conf.py # Optionally build your docs in additional formats such as PDF and ePub formats: all # Optionally set the version of Python and requirements required to build your docs python: version: 3.7 install: - method: pip path: . extra_requirements: - doc volatility3-1.0.1/.style.yapf000066400000000000000000000174041405267600400161050ustar00rootroot00000000000000[style] # Align closing bracket with visual indentation. align_closing_bracket_with_visual_indent=True # Allow dictionary keys to exist on multiple lines. For example: # # x = { # ('this is the first element of a tuple', # 'this is the second element of a tuple'): # value, # } allow_multiline_dictionary_keys=False # Allow lambdas to be formatted on more than one line. allow_multiline_lambdas=False # Allow splits before the dictionary value. allow_split_before_dict_value=True # Number of blank lines surrounding top-level function and class # definitions. blank_lines_around_top_level_definition=2 # Insert a blank line before a class-level docstring. blank_line_before_class_docstring=False # Insert a blank line before a module docstring. blank_line_before_module_docstring=False # Insert a blank line before a 'def' or 'class' immediately nested # within another 'def' or 'class'. For example: # # class Foo: # # <------ this blank line # def method(): # ... blank_line_before_nested_class_or_def=True # Do not split consecutive brackets. Only relevant when # dedent_closing_brackets is set. For example: # # call_func_that_takes_a_dict( # { # 'key1': 'value1', # 'key2': 'value2', # } # ) # # would reformat to: # # call_func_that_takes_a_dict({ # 'key1': 'value1', # 'key2': 'value2', # }) coalesce_brackets=False # The column limit. column_limit=120 # The style for continuation alignment. Possible values are: # # - SPACE: Use spaces for continuation alignment. This is default behavior. # - FIXED: Use fixed number (CONTINUATION_INDENT_WIDTH) of columns # (ie: CONTINUATION_INDENT_WIDTH/INDENT_WIDTH tabs) for continuation # alignment. # - LESS: Slightly left if cannot vertically align continuation lines with # indent characters. # - VALIGN-RIGHT: Vertically align continuation lines with indent # characters. Slightly right (one more indent character) if cannot # vertically align continuation lines with indent characters. # # For options FIXED, and VALIGN-RIGHT are only available when USE_TABS is # enabled. continuation_align_style=SPACE # Indent width used for line continuations. continuation_indent_width=4 # Put closing brackets on a separate line, dedented, if the bracketed # expression can't fit in a single line. Applies to all kinds of brackets, # including function definitions and calls. For example: # # config = { # 'key1': 'value1', # 'key2': 'value2', # } # <--- this bracket is dedented and on a separate line # # time_series = self.remote_client.query_entity_counters( # entity='dev3246.region1', # key='dns.query_latency_tcp', # transform=Transformation.AVERAGE(window=timedelta(seconds=60)), # start_ts=now()-timedelta(days=3), # end_ts=now(), # ) # <--- this bracket is dedented and on a separate line dedent_closing_brackets=False # Disable the heuristic which places each list element on a separate line # if the list is comma-terminated. disable_ending_comma_heuristic=False # Place each dictionary entry onto its own line. each_dict_entry_on_separate_line=True # The regex for an i18n comment. The presence of this comment stops # reformatting of that line, because the comments are required to be # next to the string they translate. i18n_comment= # The i18n function call names. The presence of this function stops # reformattting on that line, because the string it has cannot be moved # away from the i18n comment. i18n_function_call= # Indent the dictionary value if it cannot fit on the same line as the # dictionary key. For example: # # config = { # 'key1': # 'value1', # 'key2': value1 + # value2, # } indent_dictionary_value=False # The number of columns to use for indentation. indent_width=4 # Join short lines into one line. E.g., single line 'if' statements. join_multiple_lines=True # Do not include spaces around selected binary operators. For example: # # 1 + 2 * 3 - 4 / 5 # # will be formatted as follows when configured with "*,/": # # 1 + 2*3 - 4/5 # no_spaces_around_selected_binary_operators= # Use spaces around default or named assigns. spaces_around_default_or_named_assign=True # Use spaces around the power operator. spaces_around_power_operator=True # The number of spaces required before a trailing comment. spaces_before_comment=2 # Insert a space between the ending comma and closing bracket of a list, # etc. space_between_ending_comma_and_closing_bracket=True # Split before arguments split_all_comma_separated_values=False # Split before arguments if the argument list is terminated by a # comma. split_arguments_when_comma_terminated=False # Set to True to prefer splitting before '&', '|' or '^' rather than # after. split_before_bitwise_operator=True # Split before the closing bracket if a list or dict literal doesn't fit on # a single line. split_before_closing_bracket=True # Split before a dictionary or set generator (comp_for). For example, note # the split before the 'for': # # foo = { # variable: 'Hello world, have a nice day!' # for variable in bar if variable != 42 # } split_before_dict_set_generator=True # Split before the '.' if we need to split a longer expression: # # foo = ('This is a really long string: {}, {}, {}, {}'.format(a, b, c, d)) # # would reformat to something like: # # foo = ('This is a really long string: {}, {}, {}, {}' # .format(a, b, c, d)) split_before_dot=False # Split after the opening paren which surrounds an expression if it doesn't # fit on a single line. split_before_expression_after_opening_paren=False # If an argument / parameter list is going to be split, then split before # the first argument. split_before_first_argument=False # Set to True to prefer splitting before 'and' or 'or' rather than # after. split_before_logical_operator=True # Split named assignments onto individual lines. split_before_named_assigns=True # Set to True to split list comprehensions and generators that have # non-trivial expressions and multiple clauses before each of these # clauses. For example: # # result = [ # a_long_var + 100 for a_long_var in xrange(1000) # if a_long_var % 10] # # would reformat to something like: # # result = [ # a_long_var + 100 # for a_long_var in xrange(1000) # if a_long_var % 10] split_complex_comprehension=True # The penalty for splitting right after the opening bracket. split_penalty_after_opening_bracket=200 # The penalty for splitting the line after a unary operator. split_penalty_after_unary_operator=10000 # The penalty for splitting right before an if expression. split_penalty_before_if_expr=0 # The penalty of splitting the line around the '&', '|', and '^' # operators. split_penalty_bitwise_operator=300 # The penalty for splitting a list comprehension or generator # expression. split_penalty_comprehension=80 # The penalty for characters over the column limit. split_penalty_excess_character=7000 # The penalty incurred by adding a line split to the unwrapped line. The # more line splits added the higher the penalty. split_penalty_for_added_line_split=30 # The penalty of splitting a list of "import as" names. For example: # # from a_very_long_or_indented_module_name_yada_yad import (long_argument_1, # long_argument_2, # long_argument_3) # # would reformat to something like: # # from a_very_long_or_indented_module_name_yada_yad import ( # long_argument_1, long_argument_2, long_argument_3) split_penalty_import_names=0 # The penalty of splitting the line around the 'and' and 'or' # operators. split_penalty_logical_operator=300 # Use the Tab character for indentation. use_tabs=False volatility3-1.0.1/LICENSE.txt000066400000000000000000000075201405267600400156270ustar00rootroot00000000000000Volatility Software License Version 1.0 dated October 3, 2019. This license covers the Volatility software, Copyright 2019 Volatility Foundation. Software The software referred to in this license includes the software named above, and any data (such as operating system profiles or configuration information), and documentation provided with the software. Purpose This license gives you permission to use, share, and build with this software for free, but requires you to share source code for changes, additions, and software that you build with it. Acceptance In order to receive this license, you must agree to its rules. The rules of this license are both obligations under that agreement and conditions to your license. You must not do anything with this software that triggers a rule that you cannot or will not follow. Copyright Each contributor licenses you to do everything with this software that would otherwise infringe that contributor's copyright in it. Notices You must ensure that everyone who gets a copy of any part of this software from you, with or without changes, also gets the text of this license or a link to https://www.volatilityfoundation.org/license/vsl-v1.0. You must not remove any copyright notice in the Software. Patent Each contributor licenses you to do everything with this software that would otherwise infringe any patent claims they can license or become able to license. Reliability No contributor can revoke this license. Copyleft If you make any Additions available to others, such as by providing copies of them or providing access to them over the Internet, you must make them publicly available, according to this paragraph. "Additions" includes changes or additions to the software, and any content or materials, including any training materials, you create that contain any portion of the software. "Additions" also includes any translations or ports of the software. "Additions" also includes any software designed to execute the software and parse its results, such as a wrapper written for the software, but does not include shell or execution menu software designed to execute software generally. When this license requires you to make Additions available: - You must publish all source code for software under this license, in the preferred form for making changes, through a freely accessible distribution system widely used for similar source code, so the developer and others can find and copy it. - You must publish all data or content under this license, in a format customarily used to make changes to it, through a freely accessible distribution system, so the developer and others can find and copy it. - You are responsible to ensure you have rights in Additions necessary to comply with this section. Contributing If you contribute (or offer to contribute) any materials to Volatility Foundation for the software, such as by submitting a pull request to the repository for the software or related content run by Volatility Foundation, you agree to contribute them under the under the BSD 2-Clause Plus Patent License (in the case of software) or the Creative Commons Zero Public Domain Dedication (in the case of content), unless you clearly mark them "Not a Contribution." Trademarks This license grants you no rights to any trademarks or service marks. Termination If you violate any term of this license, your license ends immediately. No Liability As far as the law allows, the software comes as is, without any warranty or condition, and no contributor will be liable to anyone for any damages related to this software or this license, under any kind of legal claim. Versions Volatility Foundation is the steward of this license and may publish new versions of this license with new version numbers. You may use the software under the version of this license under which you received the software, or, at your choice, any later version. volatility3-1.0.1/MANIFEST.in000066400000000000000000000002641405267600400155400ustar00rootroot00000000000000prune development include * .* include doc/make.bat doc/Makefile recursive-include doc/source * recursive-include volatility3 *.json recursive-exclude doc/source volatility3.*.rst volatility3-1.0.1/README.md000066400000000000000000000116111405267600400152570ustar00rootroot00000000000000# Volatility 3: The volatile memory extraction framework Volatility is the world’s most widely used framework for extracting digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer visibility into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research. In 2019, the Volatility Foundation released a complete rewrite of the framework, Volatility 3. The project was intended to address many of the technical and performance challenges associated with the original code base that became apparent over the previous 10 years. Another benefit of the rewrite is that Volatility 3 could be released under a custom license that was more aligned with the goals of the Volatility community, the Volatility Software License (VSL). See the [LICENSE](LICENSE.txt) file for more details. ## Requirements - Python 3.5.3 or later. - Pefile 2017.8.1 or later. ## Optional Dependencies - yara-python 3.8.0 or later. - capstone 3.0.0 or later. ## Downloading Volatility The latest stable version of Volatility will always be the master branch of the GitHub repository. You can get the latest version of the code using the following command: ```shell git clone https://github.com/volatilityfoundation/volatility3.git ``` ## Quick Start 1. Clone the latest version of Volatility from GitHub: ```shell git clone https://github.com/volatilityfoundation/volatility3.git ``` 2. See available options: ```shell python3 vol.py —h ``` 3. To get more information on a Windows memory sample and to make sure Volatility supports that sample type, run `python3 vol.py -f windows.info` Example: ```shell python3 vol.py —f /home/user/samples/stuxnet.vmem windows.info ``` 4. Run some other plugins. The `-f` or `—-single-location` is not strictly required, but most plugins expect a single sample. Some also require/accept other options. Run `python3 vol.py -h` for more information on a particular command. ## Symbol Tables Symbol table packs for the various operating systems are available for download at: The hashes to verify whether any of the symbol pack files have downloaded successfully or have changed can be found at: Symbol tables zip files must be placed, as named, into the `volatility3/symbols` directory (or just the symbols directory next to the executable file). Windows symbols that cannot be found will be queried, downloaded, generated and cached. Mac and Linux symbol tables must be manually produced by a tool such as [dwarf2json](https://github.com/volatilityfoundation/dwarf2json). Please note: These are representative and are complete up to the point of creation for Windows and Mac. Due to the ease of compiling Linux kernels and the inability to uniquely distinguish them, an exhaustive set of Linux symbol tables cannot easily be supplied. ## Documentation The framework is documented through doc strings and can be built using sphinx. The latest generated copy of the documentation can be found at: ## Licensing and Copyright Copyright (C) 2007-2020 Volatility Foundation All Rights Reserved ## Bugs and Support If you think you've found a bug, please report it at: In order to help us solve your issues as quickly as possible, please include the following information when filing a bug: - The version of Volatility you're using - The operating system used to run Volatility - The version of Python used to run Volatility - The suspected operating system of the memory sample - The complete command line you used to run Volatility For community support, please join us on Slack: ## Contact For information or requests, contact: Volatility Foundation Web: Blog: Email: volatility (at) volatilityfoundation (dot) org Twitter: [@volatility](https://twitter.com/volatility) volatility3-1.0.1/development/000077500000000000000000000000001405267600400163225ustar00rootroot00000000000000volatility3-1.0.1/development/__init__.py000066400000000000000000000000001405267600400204210ustar00rootroot00000000000000volatility3-1.0.1/development/centos-kernels.txt000066400000000000000000000146141405267600400220250ustar00rootroot00000000000000https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20190218180909/4.14.94-200.el7.x86_64/kernel-core-4.14.94-200.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20190218180909/4.14.94-200.el7.x86_64/kernel-debuginfo-4.14.94-200.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20190218180954/4.14.101-200.el7.x86_64/kernel-core-4.14.101-200.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20190218180954/4.14.101-200.el7.x86_64/kernel-debuginfo-4.14.101-200.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20190314091448/4.14.106-200.el7.x86_64/kernel-core-4.14.106-200.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20190314091448/4.14.106-200.el7.x86_64/kernel-debuginfo-4.14.106-200.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20190415175139/4.14.111-200.el7.x86_64/kernel-core-4.14.111-200.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20190415175139/4.14.111-200.el7.x86_64/kernel-debuginfo-4.14.111-200.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20190506131339/4.14.116-200.el7.x86_64/kernel-core-4.14.116-200.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20190506131339/4.14.116-200.el7.x86_64/kernel-debuginfo-4.14.116-200.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20190506131813/4.19.39-300.el7.x86_64/kernel-core-4.19.39-300.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20190506131813/4.19.39-300.el7.x86_64/kernel-debuginfo-4.19.39-300.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20190516234433/4.14.119-200.el7.x86_64/kernel-core-4.14.119-200.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20190516234433/4.14.119-200.el7.x86_64/kernel-debuginfo-4.14.119-200.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20190918210642/4.19.72-300.el7.x86_64/kernel-core-4.19.72-300.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20190918210642/4.19.72-300.el7.x86_64/kernel-debuginfo-4.19.72-300.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20191121160255/4.19.84-300.el7.x86_64/kernel-core-4.19.84-300.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20191121160255/4.19.84-300.el7.x86_64/kernel-debuginfo-4.19.84-300.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20200109160334/4.19.94-300.el7.x86_64/kernel-core-4.19.94-300.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20200109160334/4.19.94-300.el7.x86_64/kernel-debuginfo-4.19.94-300.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20200217152238/4.19.104-300.el7.x86_64/kernel-core-4.19.104-300.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20200217152238/4.19.104-300.el7.x86_64/kernel-debuginfo-4.19.104-300.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20200316161817/4.19.110-300.el7.x86_64/kernel-core-4.19.110-300.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20200316161817/4.19.110-300.el7.x86_64/kernel-debuginfo-4.19.110-300.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20200330144235/4.19.113-300.el8.x86_64/kernel-core-4.19.113-300.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20200330144235/4.19.113-300.el8.x86_64/kernel-debuginfo-4.19.113-300.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20200330211837/4.19.113-300.el8.x86_64/kernel-core-4.19.113-300.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20200330211837/4.19.113-300.el8.x86_64/kernel-debuginfo-4.19.113-300.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20200522143231/5.4.42-200.el7.x86_64/kernel-core-5.4.42-200.el7.x86_64.rpm https://buildlogs.centos.org/c7-kernels.x86_64/kernel/20200522143231/5.4.42-200.el7.x86_64/kernel-debuginfo-5.4.42-200.el7.x86_64.rpm https://buildlogs.centos.org/c7.00.02/kernel/20140529190808/3.10.0-121.el7.x86_64/kernel-3.10.0-121.el7.x86_64.rpm https://buildlogs.centos.org/c7.00.02/kernel/20140529190808/3.10.0-121.el7.x86_64/kernel-debuginfo-3.10.0-121.el7.x86_64.rpm https://buildlogs.centos.org/c7.00.03/kernel/20140609184350/3.10.0-121.el7.x86_64/kernel-3.10.0-121.el7.x86_64.rpm https://buildlogs.centos.org/c7.00.03/kernel/20140609184350/3.10.0-121.el7.x86_64/kernel-debuginfo-3.10.0-121.el7.x86_64.rpm https://buildlogs.centos.org/c7.00.04/kernel/20140612172658/3.10.0-123.el7.x86_64/kernel-3.10.0-123.el7.x86_64.rpm https://buildlogs.centos.org/c7.00.04/kernel/20140612172658/3.10.0-123.el7.x86_64/kernel-debuginfo-3.10.0-123.el7.x86_64.rpm https://buildlogs.centos.org/c7.00.04/kernel/20140619231033/3.10.0-123.el7.x86_64/kernel-3.10.0-123.el7.x86_64.rpm https://buildlogs.centos.org/c7.00.04/kernel/20140619231033/3.10.0-123.el7.x86_64/kernel-debuginfo-3.10.0-123.el7.x86_64.rpm https://buildlogs.centos.org/c7.1611.01/kernel/20161117160457/3.10.0-514.el7.x86_64/kernel-3.10.0-514.el7.x86_64.rpm https://buildlogs.centos.org/c7.1611.01/kernel/20161117160457/3.10.0-514.el7.x86_64/kernel-debuginfo-3.10.0-514.el7.x86_64.rpm https://buildlogs.centos.org/c7.1708.00/kernel/20170822030048/3.10.0-693.el7.x86_64/kernel-3.10.0-693.el7.x86_64.rpm https://buildlogs.centos.org/c7.1708.00/kernel/20170822030048/3.10.0-693.el7.x86_64/kernel-debuginfo-3.10.0-693.el7.x86_64.rpm https://buildlogs.centos.org/c7.1804.00.x86_64/kernel/20180410150127/3.10.0-862.el7.x86_64/kernel-3.10.0-862.el7.centos.x86_64.rpm https://buildlogs.centos.org/c7.1804.00.x86_64/kernel/20180410150127/3.10.0-862.el7.x86_64/kernel-debuginfo-3.10.0-862.el7.centos.x86_64.rpm https://buildlogs.centos.org/c7.1810.00.x86_64/kernel/20181030130226/3.10.0-957.el7.x86_64/kernel-3.10.0-957.el7.x86_64.rpm https://buildlogs.centos.org/c7.1810.00.x86_64/kernel/20181030130226/3.10.0-957.el7.x86_64/kernel-debuginfo-3.10.0-957.el7.x86_64.rpm https://buildlogs.centos.org/c7.1908.00.x86_64/kernel/20190808101829/3.10.0-1062.el7.x86_64/kernel-3.10.0-1062.el7.x86_64.rpm https://buildlogs.centos.org/c7.1908.00.x86_64/kernel/20190808101829/3.10.0-1062.el7.x86_64/kernel-debuginfo-3.10.0-1062.el7.x86_64.rpm https://buildlogs.centos.org/c7.2003.00.x86_64/kernel/20200331233310/3.10.0-1127.el7.x86_64/kernel-3.10.0-1127.el7.x86_64.rpm https://buildlogs.centos.org/c7.2003.00.x86_64/kernel/20200331233310/3.10.0-1127.el7.x86_64/kernel-debuginfo-3.10.0-1127.el7.x86_64.rpm volatility3-1.0.1/development/compare-vol.py000066400000000000000000000276241405267600400211330ustar00rootroot00000000000000import argparse import csv import hashlib import os import re import shutil import subprocess import time from dataclasses import dataclass, field from typing import Dict, List @dataclass class VolatilityImage: filepath: str = "" vol2_profile: str = "" vol2_imageinfo_time: float = None vol2_plugin_parameters: Dict[str, List[str]] = field(default_factory = dict) vol3_plugin_parameters: Dict[str, List[str]] = field(default_factory = dict) rekall_plugin_parameters: Dict[str, List[str]] = field(default_factory = dict) @dataclass class VolatilityPlugin: name: str = "" vol2_plugin_parameters: List[str] = field(default_factory = list) vol3_plugin_parameters: List[str] = field(default_factory = list) rekall_plugin_parameters: List[str] = field(default_factory = list) class VolatilityTest: short_name = "true" long_name = "True" def __init__(self, path: str, output_directory: str) -> None: self.path = path self.output_directory = output_directory def result_titles(self) -> List[str]: return [self.long_name] def create_prerequisites(self, plugin: VolatilityPlugin, image: VolatilityImage, image_hash: str) -> None: pass def create_results(self, plugin: VolatilityPlugin, image: VolatilityImage, image_hash: str) -> List[float]: self.create_prerequisites(plugin, image, image_hash) # Volatility 2 Test print("[*] Testing {} {} with image {}".format(self.short_name, plugin.name, image.filepath)) os.chdir(self.path) cmd = self.plugin_cmd(plugin, image) start_time = time.perf_counter() try: completed = subprocess.run(cmd, cwd = self.path, capture_output = True, timeout = 420) except subprocess.TimeoutExpired as excp: completed = excp end_time = time.perf_counter() total_time = end_time - start_time print(" Tested {} {} with image {}: {}".format(self.short_name, plugin.name, image.filepath, total_time)) with open( os.path.join(self.output_directory, '{}_{}_{}_stdout'.format(self.short_name, plugin.name, image_hash)), "wb") as f: f.write(completed.stdout) if completed.stderr: with open( os.path.join(self.output_directory, '{}_{}_{}_stderr'.format(self.short_name, plugin.name, image_hash)), "wb") as f: f.write(completed.stderr) return [total_time] def plugin_cmd(self, plugin: VolatilityPlugin, image: VolatilityImage): return ["true"] class Volatility2Test(VolatilityTest): short_name = "vol2" long_name = "Volatility 2" def plugin_cmd(self, plugin: VolatilityPlugin, image: VolatilityImage): return ["python2", "-u", "vol.py", "-f", image.filepath, "--profile", image.vol2_profile ] + plugin.vol2_plugin_parameters + image.vol2_plugin_parameters.get(plugin.name, []) def result_titles(self): return [self.long_name, "Imageinfo", f"{self.long_name} + Imageinfo"] def create_results(self, plugin: VolatilityPlugin, image: VolatilityImage, image_hash) -> List[float]: result = super().create_results(plugin, image, image_hash) result += [image.vol2_imageinfo_time, result[0] + image.vol2_imageinfo_time] return result def create_prerequisites(self, plugin: VolatilityPlugin, image: VolatilityImage, image_hash): # Volatility 2 image info if not image.vol2_profile: print("[*] Testing {} imageinfo with image {}".format(self.short_name, image.filepath)) os.chdir(self.path) cmd = ["python2", "-u", "vol.py", "-f", image.filepath, "imageinfo"] start_time = time.perf_counter() vol2_completed = subprocess.run(cmd, cwd = self.path, capture_output = True) end_time = time.perf_counter() image.vol2_imageinfo_time = end_time - start_time print(" Tested volatility2 imageinfo with image {}: {}".format(image.filepath, end_time - start_time)) with open(os.path.join(self.output_directory, 'vol2_imageinfo_{}_stdout'.format(image_hash)), "wb") as f: f.write(vol2_completed.stdout) image.vol2_profile = re.search(b"Suggested Profile\(s\) : ([^,]+)", vol2_completed.stdout)[1] class RekallTest(VolatilityTest): short_name = "rekall" long_name = "Rekall" def plugin_cmd(self, plugin: VolatilityPlugin, image: VolatilityImage) -> List[str]: if not plugin.rekall_plugin_parameters: plugin.rekall_plugin_parameters = plugin.vol2_plugin_parameters if not image.rekall_plugin_parameters: image.rekall_plugin_parameters = image.vol2_plugin_parameters return ["rekall", "-f", image.filepath] + plugin.rekall_plugin_parameters + image.rekall_plugin_parameters.get( plugin.name, []) def create_prerequisites(self, plugin: VolatilityPlugin, image: VolatilityImage, image_hash: str) -> None: shutil.rmtree('/home/mike/.rekall_cache/sessions') class Volatility3Test(VolatilityTest): short_name = "vol3" long_name = "Volatility 3" def plugin_cmd(self, plugin: VolatilityPlugin, image: VolatilityImage) -> List[str]: return [ "python", "-u", "vol.py", "-q", "-f", image.filepath, ] + plugin.vol3_plugin_parameters + image.vol3_plugin_parameters.get(plugin.name, []) class Volatility3PyPyTest(VolatilityTest): short_name = "pypy" long_name = "Volatility 3 (PyPy)" def plugin_cmd(self, plugin: VolatilityPlugin, image: VolatilityImage) -> List[str]: return [ "pypy3", "-u", "vol.py", "-q", "-f", image.filepath, ] + plugin.vol3_plugin_parameters + image.vol3_plugin_parameters.get(plugin.name, []) class VolatilityTester: def __init__(self, images: List[VolatilityImage], plugins: List[VolatilityPlugin], frameworks: List[str], output_dir: str, vol2_path: str = None, vol3_path: str = None, rekall_path = None): self.images = images self.plugins = plugins if not vol2_path: vol2_path = output_dir if not vol3_path: vol3_path = output_dir if not rekall_path: rekall_path = output_dir available_tests = [ Volatility3Test(vol3_path, output_dir), Volatility3PyPyTest(vol3_path, output_dir), Volatility2Test(vol2_path, output_dir), RekallTest(rekall_path, output_dir) ] self.tests = [x for x in available_tests if x.short_name.lower() in frameworks] self.csv_writer = None print(f"[?] Vol2 path {vol2_path}") print(f"[?] Vol3 path {vol3_path}") print(f"[?] Rekall path {rekall_path}") print("") print(f"[?] Frameworks: {[x.long_name for x in self.tests]}") def run_tests(self): with open("volatility-timings.csv", 'w') as csvfile: self.csv_writer = csv.writer(csvfile) titles = ["Image Hash", "Image Path", "Plugin Name"] for test in self.tests: titles += test.result_titles() self.csv_writer.writerow(titles) for image in self.images: for plugin in self.plugins: self.run_test(plugin, image) def run_test(self, plugin: VolatilityPlugin, image: VolatilityImage): image_hash = hashlib.md5(bytes(image.filepath, "latin-1")).hexdigest() results = [] for test in self.tests: results += test.create_results(plugin, image, image_hash) self.csv_writer.writerow([image_hash, image.filepath, plugin.name] + results) if __name__ == '__main__': plugins = [ VolatilityPlugin(name = "pslist", vol2_plugin_parameters = ["pslist"], vol3_plugin_parameters = ["windows.pslist"]), VolatilityPlugin(name = "psscan", vol2_plugin_parameters = ["psscan"], vol3_plugin_parameters = ["windows.psscan"], rekall_plugin_parameters = ["psscan", "--scan_kernel"]), VolatilityPlugin(name = "driverscan", vol2_plugin_parameters = ["driverscan"], vol3_plugin_parameters = ["windows.driverscan"], rekall_plugin_parameters = ["driverscan", "--scan_kernel"]), VolatilityPlugin(name = "handles", vol2_plugin_parameters = ["handles"], vol3_plugin_parameters = ["windows.handles"]), VolatilityPlugin(name = "modules", vol2_plugin_parameters = ["modules"], vol3_plugin_parameters = ["windows.modules"]), VolatilityPlugin(name = "hivelist", vol2_plugin_parameters = ["hivelist"], vol3_plugin_parameters = ["registry.hivelist"], rekall_plugin_parameters = ["hives"]), VolatilityPlugin(name = "vadinfo", vol2_plugin_parameters = ["vadinfo"], vol3_plugin_parameters = ["windows.vadinfo"], rekall_plugin_parameters = ["vad"]), VolatilityPlugin(name = "modscan", vol2_plugin_parameters = ["modscan"], vol3_plugin_parameters = ["windows.modscan"], rekall_plugin_parameters = ["modscan", "--scan_kernel"]), VolatilityPlugin(name = "svcscan", vol2_plugin_parameters = ["svcscan"], vol3_plugin_parameters = ["windows.svcscan"], rekall_plugin_parameters = ["svcscan"]), VolatilityPlugin(name = "ssdt", vol2_plugin_parameters = ["ssdt"], vol3_plugin_parameters = ["windows.ssdt"]), VolatilityPlugin(name = "printkey", vol2_plugin_parameters = ["printkey", "-K", "Classes"], vol3_plugin_parameters = ["registry.printkey", "--key", "Classes"], rekall_plugin_parameters = ["printkey", "--key", "Classes"]) ] parser = argparse.ArgumentParser() parser.add_argument("--output-dir", type = str, default = os.getcwd(), help = "Directory to store all results") parser.add_argument("--vol3path", type = str, default = os.path.join(os.getcwd(), 'volatility3'), help = "Path ot the volatility 3 directory") parser.add_argument("--vol2path", type = str, default = os.path.join(os.getcwd(), 'volatility'), help = "Path to the volatility 2 directory") parser.add_argument("--rekallpath", type = str, default = os.path.join(os.getcwd(), 'rekall'), help = "Path to the rekall directory") parser.add_argument("--frameworks", nargs = "+", type = str, choices = [x.short_name.lower() for x in VolatilityTest.__subclasses__()], default = [x.short_name.lower() for x in VolatilityTest.__subclasses__()], help = "A comma separated list of frameworks to test") parser.add_argument('images', metavar = 'IMAGE', type = str, nargs = '+', help = 'The list of images to compare') args = parser.parse_args() vt = VolatilityTester([VolatilityImage(filepath = x) for x in args.images], plugins, [x.lower() for x in args.frameworks], args.output_dir, args.vol2path, args.vol3path, args.rekallpath) vt.run_tests() volatility3-1.0.1/development/debian-kernels.txt000066400000000000000000000253701405267600400217550ustar00rootroot00000000000000https://www.mirrorservice.org/sites/ftp.debian.org/debian/pool/main/l/linux/linux-image-3.16.0-6-amd64-dbg_3.16.56-1+deb8u1_amd64.deb https://www.mirrorservice.org/sites/ftp.debian.org/debian/pool/main/l/linux/linux-image-3.16.0-6-amd64_3.16.56-1+deb8u1_amd64.deb https://www.mirrorservice.org/sites/ftp.debian.org/debian/pool/main/l/linux/linux-image-4.9.0-12-amd64-dbg_4.9.210-1_amd64.deb https://www.mirrorservice.org/sites/ftp.debian.org/debian/pool/main/l/linux/linux-image-4.9.0-12-amd64_4.9.210-1_amd64.deb https://www.mirrorservice.org/sites/ftp.debian.org/debian/pool/main/l/linux/linux-image-4.9.0-12-rt-amd64_4.9.210-1_amd64.deb https://www.mirrorservice.org/sites/ftp.debian.org/debian/pool/main/l/linux/linux-image-4.9.0-12-rt-amd64-dbg_4.9.210-1_amd64.deb http://archive.debian.org/debian/pool/main/l/linux-2.6/linux-image-2.6.32-5-amd64_2.6.32-48squeeze6_amd64.deb http://archive.debian.org/debian/pool/main/l/linux-2.6/linux-image-2.6.32-5-amd64-dbg_2.6.32-48squeeze6_amd64.deb http://archive.debian.org/debian/pool/main/l/linux-2.6/linux-image-2.6.32-5-amd64_2.6.32-48squeeze20_amd64.deb http://archive.debian.org/debian/pool/main/l/linux-2.6/linux-image-2.6.32-5-amd64-dbg_2.6.32-48squeeze20_amd64.deb http://archive.debian.org/debian/pool/main/l/linux-2.6/linux-image-2.6.32-5-xen-amd64_2.6.32-48squeeze6_amd64.deb http://archive.debian.org/debian/pool/main/l/linux-2.6/linux-image-2.6.32-5-xen-amd64-dbg_2.6.32-48squeeze6_amd64.deb http://archive.debian.org/debian/pool/main/l/linux-2.6/linux-image-2.6.32-5-xen-amd64_2.6.32-48squeeze20_amd64.deb http://archive.debian.org/debian/pool/main/l/linux-2.6/linux-image-2.6.32-5-xen-amd64-dbg_2.6.32-48squeeze20_amd64.deb http://archive.debian.org/debian/pool/main/l/linux/linux-image-3.2.0-4-amd64_3.2.78-1_amd64.deb http://archive.debian.org/debian/pool/main/l/linux/linux-image-3.2.0-4-amd64-dbg_3.2.78-1_amd64.deb http://archive.debian.org/debian/pool/main/l/linux/linux-image-3.2.0-4-rt-amd64_3.2.78-1_amd64.deb http://archive.debian.org/debian/pool/main/l/linux/linux-image-3.2.0-4-rt-amd64-dbg_3.2.78-1_amd64.deb http://archive.debian.org/debian/pool/main/l/linux/linux-image-3.16.0-0.bpo.4-amd64_3.16.39-1+deb8u1~bpo70+1_amd64.deb http://archive.debian.org/debian/pool/main/l/linux/linux-image-3.16.0-0.bpo.4-amd64-dbg_3.16.39-1+deb8u1~bpo70+1_amd64.deb http://archive.debian.org/debian/pool/main/l/linux/linux-image-3.16.0-6-amd64_3.16.56-1+deb8u1_amd64.deb http://archive.debian.org/debian/pool/main/l/linux/linux-image-3.16.0-6-amd64-dbg_3.16.56-1+deb8u1_amd64.deb http://archive.debian.org/debian/pool/main/l/linux/linux-image-4.9.0-0.bpo.6-amd64_4.9.88-1+deb9u1~bpo8+1_amd64.deb http://archive.debian.org/debian/pool/main/l/linux/linux-image-4.9.0-0.bpo.6-amd64-dbg_4.9.88-1+deb9u1~bpo8+1_amd64.deb http://archive.debian.org/debian/pool/main/l/linux/linux-image-4.9.0-0.bpo.6-rt-amd64_4.9.88-1+deb9u1~bpo8+1_amd64.deb http://archive.debian.org/debian/pool/main/l/linux/linux-image-4.9.0-0.bpo.6-rt-amd64-dbg_4.9.88-1+deb9u1~bpo8+1_amd64.deb http://security.debian.org/debian-security/pool/updates/main/l/linux/linux-image-3.16.0-10-amd64_3.16.81-1_amd64.deb http://security.debian.org/debian-security/pool/updates/main/l/linux/linux-image-3.16.0-10-amd64-dbg_3.16.81-1_amd64.deb http://security.debian.org/debian-security/pool/updates/main/l/linux/linux-image-4.9.0-11-amd64_4.9.189-3+deb9u2_amd64.deb http://security.debian.org/debian-security/pool/updates/main/l/linux/linux-image-4.9.0-11-amd64-dbg_4.9.189-3+deb9u2_amd64.deb http://security.debian.org/debian-security/pool/updates/main/l/linux/linux-image-4.9.0-11-rt-amd64_4.9.189-3+deb9u2_amd64.deb http://security.debian.org/debian-security/pool/updates/main/l/linux/linux-image-4.9.0-11-rt-amd64-dbg_4.9.189-3+deb9u2_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux/linux-image-4.19.0-0.bpo.6-amd64-dbg_4.19.67-2%2Bdeb10u2~bpo9%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux-signed-amd64/linux-image-4.19.0-0.bpo.6-amd64_4.19.67-2%2Bdeb10u2~bpo9%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux/linux-image-4.19.0-0.bpo.6-cloud-amd64-dbg_4.19.67-2%2Bdeb10u2~bpo9%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux-signed-amd64/linux-image-4.19.0-0.bpo.6-cloud-amd64_4.19.67-2%2Bdeb10u2~bpo9%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux/linux-image-4.19.0-0.bpo.6-rt-amd64-dbg_4.19.67-2%2Bdeb10u2~bpo9%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux-signed-amd64/linux-image-4.19.0-0.bpo.6-rt-amd64_4.19.67-2%2Bdeb10u2~bpo9%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux/linux-image-4.19.0-0.bpo.8-amd64-dbg_4.19.98-1~bpo9%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux-signed-amd64/linux-image-4.19.0-0.bpo.8-amd64_4.19.98-1~bpo9%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux/linux-image-4.19.0-0.bpo.8-cloud-amd64-dbg_4.19.98-1~bpo9%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux-signed-amd64/linux-image-4.19.0-0.bpo.8-cloud-amd64_4.19.98-1~bpo9%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux/linux-image-4.19.0-0.bpo.8-rt-amd64-dbg_4.19.98-1~bpo9%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux-signed-amd64/linux-image-4.19.0-0.bpo.8-rt-amd64_4.19.98-1~bpo9%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux/linux-image-4.19.0-9-amd64-dbg_4.19.118-2_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux-signed-amd64/linux-image-4.19.0-9-amd64_4.19.118-2_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux/linux-image-4.19.0-9-cloud-amd64-dbg_4.19.118-2_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux-signed-amd64/linux-image-4.19.0-9-cloud-amd64_4.19.118-2_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux/linux-image-4.19.0-9-rt-amd64-dbg_4.19.118-2_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux-signed-amd64/linux-image-4.19.0-9-rt-amd64_4.19.118-2_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux-signed-amd64/linux-image-5.4.0-0.bpo.2-amd64_5.4.8-1~bpo10%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux/linux-image-5.4.0-0.bpo.2-amd64-dbg_5.4.8-1~bpo10%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux-signed-amd64/linux-image-5.4.0-0.bpo.2-cloud-amd64_5.4.8-1~bpo10%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux/linux-image-5.4.0-0.bpo.2-cloud-amd64-dbg_5.4.8-1~bpo10%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux-signed-amd64/linux-image-5.4.0-0.bpo.2-rt-amd64_5.4.8-1~bpo10%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux/linux-image-5.4.0-0.bpo.2-rt-amd64-dbg_5.4.8-1~bpo10%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux-signed-amd64/linux-image-5.4.0-0.bpo.3-amd64_5.4.13-1~bpo10%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux/linux-image-5.4.0-0.bpo.3-amd64-dbg_5.4.13-1~bpo10%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux-signed-amd64/linux-image-5.4.0-0.bpo.3-cloud-amd64_5.4.13-1~bpo10%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux/linux-image-5.4.0-0.bpo.3-cloud-amd64-dbg_5.4.13-1~bpo10%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux-signed-amd64/linux-image-5.4.0-0.bpo.3-rt-amd64_5.4.13-1~bpo10%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux/linux-image-5.4.0-0.bpo.3-rt-amd64-dbg_5.4.13-1~bpo10%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux-signed-amd64/linux-image-5.4.0-0.bpo.4-amd64_5.4.19-1~bpo10%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux/linux-image-5.4.0-0.bpo.4-amd64-dbg_5.4.19-1~bpo10%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux-signed-amd64/linux-image-5.4.0-0.bpo.4-cloud-amd64_5.4.19-1~bpo10%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux/linux-image-5.4.0-0.bpo.4-cloud-amd64-dbg_5.4.19-1~bpo10%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux/linux-image-5.4.0-0.bpo.4-rt-amd64-dbg_5.4.19-1~bpo10%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux-signed-amd64/linux-image-5.4.0-0.bpo.4-rt-amd64_5.4.19-1~bpo10%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux/linux-image-5.5.0-0.bpo.2-amd64-dbg_5.5.17-1~bpo10%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux-signed-amd64/linux-image-5.5.0-0.bpo.2-amd64_5.5.17-1~bpo10%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux/linux-image-5.5.0-0.bpo.2-cloud-amd64-dbg_5.5.17-1~bpo10%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux-signed-amd64/linux-image-5.5.0-0.bpo.2-cloud-amd64_5.5.17-1~bpo10%2B1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux/linux-image-5.6.0-1-amd64-dbg_5.6.7-1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux-signed-amd64/linux-image-5.6.0-1-amd64_5.6.7-1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux/linux-image-5.6.0-1-cloud-amd64-dbg_5.6.7-1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux-signed-amd64/linux-image-5.6.0-1-cloud-amd64_5.6.7-1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux/linux-image-5.6.0-1-rt-amd64-dbg_5.6.7-1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux-signed-amd64/linux-image-5.6.0-1-rt-amd64_5.6.7-1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux/linux-image-5.7.0-rc5-amd64-dbg_5.7~rc5-1~exp1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux-signed-amd64/linux-image-5.7.0-rc5-amd64_5.7~rc5-1~exp1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux/linux-image-5.7.0-rc5-cloud-amd64-dbg_5.7~rc5-1~exp1_amd64.deb http://ftp.us.debian.org/debian/pool/main/l/linux-signed-amd64/linux-image-5.7.0-rc5-cloud-amd64_5.7~rc5-1~exp1_amd64.deb http://security.debian.org/debian-security/pool/updates/main/l/linux-latest/linux-image-amd64-dbg_3.16+63+deb8u6_amd64.deb http://security.debian.org/debian-security/pool/updates/main/l/linux-latest/linux-image-amd64_3.16+63+deb8u6_amd64.deb http://security.debian.org/debian-security/pool/updates/main/l/linux-latest-4.9/linux-image-4.9-amd64-dbg_4.9+80+deb9u10~deb8u1_amd64.deb http://security.debian.org/debian-security/pool/updates/main/l/linux-latest-4.9/linux-image-4.9-amd64_4.9+80+deb9u10~deb8u1_amd64.deb http://security.debian.org/debian-security/pool/updates/main/l/linux/linux-image-4.9.0-11-rt-amd64-dbg_4.9.189-3+deb9u2_amd64.deb http://security.debian.org/debian-security/pool/updates/main/l/linux/linux-image-4.9.0-11-rt-amd64_4.9.189-3+deb9u2_amd64.deb http://security.debian.org/debian-security/pool/updates/main/l/linux/linux-image-4.9.0-11-amd64-dbg_4.9.189-3+deb9u2_amd64.deb http://security.debian.org/debian-security/pool/updates/main/l/linux/linux-image-4.9.0-11-amd64_4.9.189-3+deb9u2_amd64.deb http://security.debian.org/debian-security/pool/updates/main/l/linux/linux-image-3.16.0-10-amd64-dbg_3.16.81-1_amd64.deb http://security.debian.org/debian-security/pool/updates/main/l/linux/linux-image-3.16.0-10-amd64_3.16.81-1_amd64.deb volatility3-1.0.1/development/fedora-kernels.txt000066400000000000000000000142711405267600400217710ustar00rootroot00000000000000https://archives.fedoraproject.org/pub/archive/fedora/linux/core/5/x86_64/os/Fedora/RPMS/kernel-2.6.15-1.2054_FC5.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/core/5/x86_64/debug/kernel-debuginfo-2.6.15-1.2054_FC5.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/core/6/x86_64/os/Fedora/RPMS/kernel-2.6.18-1.2798.fc6.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/core/6/x86_64/debug/kernel-debuginfo-2.6.18-1.2798.fc6.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/7/x86_64/kernel-2.6.23.17-88.fc7.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/7/x86_64/debug/kernel-debuginfo-2.6.23.17-88.fc7.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/8/x86_64.newkey/kernel-2.6.26.8-57.fc8.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/8/x86_64.newkey/debug/kernel-debuginfo-2.6.26.8-57.fc8.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/9/x86_64.newkey/kernel-2.6.27.25-78.2.56.fc9.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/9/x86_64.newkey/debug/kernel-debuginfo-2.6.27.25-78.2.56.fc9.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/10/x86_64/kernel-2.6.27.41-170.2.117.fc10.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/10/x86_64/debug/kernel-debuginfo-2.6.27.41-170.2.117.fc10.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/11/x86_64/kernel-2.6.30.10-105.2.23.fc11.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/11/x86_64/debug/kernel-debuginfo-2.6.30.10-105.2.23.fc11.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/12/x86_64/kernel-2.6.32.26-175.fc12.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/12/x86_64/debug/kernel-debuginfo-2.6.32.26-175.fc12.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/13/x86_64/kernel-2.6.34.9-69.fc13.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/13/x86_64/debug/kernel-debuginfo-2.6.34.9-69.fc13.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/14/x86_64/kernel-2.6.35.14-106.fc14.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/14/x86_64/debug/kernel-debuginfo-2.6.35.14-106.fc14.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/15/x86_64/kernel-2.6.43.8-1.fc15.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/15/x86_64/debug/kernel-debuginfo-2.6.43.8-1.fc15.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/16/x86_64/kernel-3.6.11-4.fc16.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/16/x86_64/debug/kernel-debuginfo-3.6.11-4.fc16.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/17/x86_64/kernel-3.9.10-100.fc17.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/17/x86_64/debug/kernel-debuginfo-3.9.10-100.fc17.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/18/x86_64/kernel-3.11.10-100.fc18.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/18/x86_64/debug/kernel-debuginfo-3.11.10-100.fc18.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/19/x86_64/kernel-3.14.27-100.fc19.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/19/x86_64/debug/kernel-debuginfo-3.14.27-100.fc19.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/20/x86_64/kernel-3.19.8-100.fc20.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/20/x86_64/debug/kernel-debuginfo-3.19.8-100.fc20.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/21/x86_64/k/kernel-core-4.1.13-100.fc21.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/21/x86_64/debug/k/kernel-debuginfo-4.1.13-100.fc21.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/22/x86_64/k/kernel-core-4.4.14-200.fc22.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/22/x86_64/debug/k/kernel-debuginfo-4.4.14-200.fc22.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/23/x86_64/k/kernel-core-4.8.13-100.fc23.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/23/x86_64/debug/k/kernel-debuginfo-4.8.13-100.fc23.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/24/x86_64/k/kernel-core-4.11.12-100.fc24.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/24/x86_64/debug/k/kernel-debuginfo-4.11.12-100.fc24.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/25/x86_64/Packages/k/kernel-core-4.13.16-100.fc25.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/25/x86_64/debug/Packages/k/kernel-debuginfo-4.13.16-100.fc25.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/26/x86_64/Packages/k/kernel-core-4.16.11-100.fc26.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/26/x86_64/debug/Packages/k/kernel-debuginfo-4.16.11-100.fc26.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/27/x86_64/Packages/k/kernel-core-4.18.19-100.fc27.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/27/x86_64/debug/Packages/k/kernel-debuginfo-4.18.19-100.fc27.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/28/Everything/x86_64/Packages/k/kernel-core-5.0.16-100.fc28.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/28/Everything/x86_64/debug/Packages/k/kernel-debuginfo-5.0.16-100.fc28.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/29/Everything/x86_64/Packages/k/kernel-core-5.3.11-100.fc29.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/29/Everything/x86_64/debug/Packages/k/kernel-debuginfo-5.3.11-100.fc29.x86_64.rpm volatility3-1.0.1/development/jsonschema.schema000066400000000000000000000114251405267600400216410ustar00rootroot00000000000000{ "$schema": "http://json-schema.org/draft-07/schema#", "$id": "http://json-schema.org/draft-07/schema#", "title": "Core schema meta-schema", "definitions": { "schemaArray": { "type": "array", "minItems": 1, "items": { "$ref": "#" } }, "nonNegativeInteger": { "type": "integer", "minimum": 0 }, "nonNegativeIntegerDefault0": { "allOf": [ { "$ref": "#/definitions/nonNegativeInteger" }, { "default": 0 } ] }, "simpleTypes": { "enum": [ "array", "boolean", "integer", "null", "number", "object", "string" ] }, "stringArray": { "type": "array", "items": { "type": "string" }, "uniqueItems": true, "default": [] } }, "type": ["object", "boolean"], "properties": { "$id": { "type": "string", "format": "uri-reference" }, "$schema": { "type": "string", "format": "uri" }, "$ref": { "type": "string", "format": "uri-reference" }, "$comment": { "type": "string" }, "title": { "type": "string" }, "description": { "type": "string" }, "default": true, "readOnly": { "type": "boolean", "default": false }, "examples": { "type": "array", "items": true }, "multipleOf": { "type": "number", "exclusiveMinimum": 0 }, "maximum": { "type": "number" }, "exclusiveMaximum": { "type": "number" }, "minimum": { "type": "number" }, "exclusiveMinimum": { "type": "number" }, "maxLength": { "$ref": "#/definitions/nonNegativeInteger" }, "minLength": { "$ref": "#/definitions/nonNegativeIntegerDefault0" }, "pattern": { "type": "string", "format": "regex" }, "additionalItems": { "$ref": "#" }, "items": { "anyOf": [ { "$ref": "#" }, { "$ref": "#/definitions/schemaArray" } ], "default": true }, "maxItems": { "$ref": "#/definitions/nonNegativeInteger" }, "minItems": { "$ref": "#/definitions/nonNegativeIntegerDefault0" }, "uniqueItems": { "type": "boolean", "default": false }, "contains": { "$ref": "#" }, "maxProperties": { "$ref": "#/definitions/nonNegativeInteger" }, "minProperties": { "$ref": "#/definitions/nonNegativeIntegerDefault0" }, "required": { "$ref": "#/definitions/stringArray" }, "additionalProperties": { "$ref": "#" }, "definitions": { "type": "object", "additionalProperties": { "$ref": "#" }, "default": {} }, "properties": { "type": "object", "additionalProperties": { "$ref": "#" }, "default": {} }, "patternProperties": { "type": "object", "additionalProperties": { "$ref": "#" }, "propertyNames": { "format": "regex" }, "default": {} }, "dependencies": { "type": "object", "additionalProperties": { "anyOf": [ { "$ref": "#" }, { "$ref": "#/definitions/stringArray" } ] } }, "propertyNames": { "$ref": "#" }, "const": true, "enum": { "type": "array", "items": true, "minItems": 1, "uniqueItems": true }, "type": { "anyOf": [ { "$ref": "#/definitions/simpleTypes" }, { "type": "array", "items": { "$ref": "#/definitions/simpleTypes" }, "minItems": 1, "uniqueItems": true } ] }, "format": { "type": "string" }, "contentMediaType": { "type": "string" }, "contentEncoding": { "type": "string" }, "if": { "$ref": "#" }, "then": { "$ref": "#" }, "else": { "$ref": "#" }, "allOf": { "$ref": "#/definitions/schemaArray" }, "anyOf": { "$ref": "#/definitions/schemaArray" }, "oneOf": { "$ref": "#/definitions/schemaArray" }, "not": { "$ref": "#" } }, "default": true } volatility3-1.0.1/development/mac-kdk/000077500000000000000000000000001405267600400176315ustar00rootroot00000000000000volatility3-1.0.1/development/mac-kdk/extract_kernel.sh000077500000000000000000000030731405267600400232050ustar00rootroot00000000000000#!/bin/bash UNPACK_DIR="Unpacked" KERNEL_DIR="$(basename ${1})" JSON_DIR="JSON" DWARF2JSON="dwarf2json" echo "Operating on ${KERNEL_DIR}" mkdir tmp pushd tmp 7z x ../${1} if [ -f "KernelDebugKit/mach_kernel" ]; then echo "7Z unpack successful" mv KernelDebugKit System else echo "XAR unpack required" xar -x -f Kernel\ Debug\ Kit/KernelDebugKit.pkg python2 ../parse_pbzx2.py KDK.pkg/Payload if [ $? == 0 ]; then xz -d KDK.pkg/*.xz cat KDK.pkg/*.cpio > Payload\~ else 7z x Kernel\ Debug\ Kit/KernelDebugKit.pkg fi echo "CPIO unpacking Payload" cpio -i < Payload\~ fi mkdir -p "../${UNPACK_DIR}/${KERNEL_DIR}" if [ -f "System/Library/Kernels/kernel" ]; then cp "System/Library/Kernels/kernel" "../${UNPACK_DIR}/${KERNEL_DIR}/kernel" cp "System/Library/Kernels/kernel.dSYM/Contents/Resources/DWARF/kernel" "../${UNPACK_DIR}/${KERNEL_DIR}/kernel.dSYM" elif [ -f "System/mach_kernel.dSYM/Contents/Resources/DWARF/mach_kernel" ]; then cp System/mach_kernel "../${UNPACK_DIR}/${KERNEL_DIR}/kernel" cp System/mach_kernel.dSYM/Contents/Resources/DWARF/mach_kernel "../${UNPACK_DIR}/${KERNEL_DIR}/kernel.dSYM" fi chmod -R ug+w "../${UNPACK_DIR}/${KERNEL_DIR}" ${DWARF2JSON} popd rm -fr tmp ${DWARF2JSON} mac --macho "${UNPACK_DIR}/${KERNEL_DIR}/kernel.dSYM" --macho-symbols "${UNPACK_DIRECTORY}/${KERNEL_DIR}/kernel" | xz -9 > ${JSON_DIR}/${KERNEL_DIR}.json.xz if [ $? == 0 ]; then ${DWARF2JSON} mac --arch i386 --macho "${UNPACK_DIR}/${KERNEL_DIR}/kernel.dSYM" --macho-symbols "${UNPACK_DIRECTORY}/${KERNEL_DIR}/kernel" | xz -9 > ${JSON_DIR}/${KERNEL_DIR}.json.xz fi volatility3-1.0.1/development/mac-kdk/generate_json.sh000077500000000000000000000016461405267600400230220ustar00rootroot00000000000000#!/bin/bash DWARF2JSON=$(which dwarf2json) KDK_PATH="${1}" JSON_DIR="${2}" for i in `ls ${KDK_PATH}`; do echo "${i}" if [ -f "${KDK_PATH}/${i}/System/Library/Kernels/kernel" ]; then echo "Library Kernels" ${DWARF2JSON} mac --macho "${KDK_PATH}/${i}/System/Library/Kernels/kernel.dSYM/Contents/Resources/DWARF/kernel" --macho-symbols "${KDK_PATH}/${i}/System/Library/Kernels/kernel" > ${JSON_DIR}/${i}.json elif [ -f "${KDK_PATH}/${i}/System/mach_kernel.dSYM/Contents/Resources/DWARF/mach_kernel" ]; then echo "Mach kernel" ${DWARF2JSON} mac --macho "${KDK_PATH}/${i}/System/mach_kernel.dSYM/Contents/Resources/DWARF/mach_kernel" --macho-symbols "${KDK_PATH}/${i}/System/mach_kernel" > "${JSON_DIR}/${i}.json" || ${DWARF2JSON} mac --arch i386 --macho "${KDK_PATH}/${i}/System/mach_kernel.dSYM/Contents/Resources/DWARF/mach_kernel" --macho-symbols "${KDK_PATH}/${i}/System/mach_kernel" > "${JSON_DIR}/${i}.json" fi done volatility3-1.0.1/development/mac-kdk/parse_pbzx2.py000066400000000000000000000055741405267600400224550ustar00rootroot00000000000000# v2 pbzx stream handler # My personal writeup on the differences here: https://gist.github.com/pudquick/29fcfe09c326a9b96cf5 # # Pure python reimplementation of .cpio.xz content extraction from pbzx file payload originally here: # http://www.tonymacx86.com/general-help/135458-pbzx-stream-parser.html # # Cleaned up C version (as the basis for my code) here, thanks to Pepijn Bruienne / @bruienne # https://gist.github.com/bruienne/029494bbcfb358098b41 import struct import sys def seekread(f, offset = None, length = 0, relative = True): if offset is not None: # offset provided, let's seek f.seek(offset, [0, 1, 2][relative]) if length: return f.read(length) def parse_pbzx(pbzx_path): section = 0 xar_out_path = '%s.part%02d.cpio.xz' % (pbzx_path, section) f = open(pbzx_path, 'rb') # pbzx = f.read() # f.close() magic = seekread(f, length = 4) if magic != 'pbzx': raise RuntimeError("Error: Not a pbzx file") # Read 8 bytes for initial flags flags = seekread(f, length = 8) # Interpret the flags as a 64-bit big-endian unsigned int flags = struct.unpack('>Q', flags)[0] xar_f = open(xar_out_path, 'wb') while flags & (1 << 24): # Read in more flags flags = seekread(f, length = 8) flags = struct.unpack('>Q', flags)[0] # Read in length f_length = seekread(f, length = 8) f_length = struct.unpack('>Q', f_length)[0] xzmagic = seekread(f, length = 6) if xzmagic != '\xfd7zXZ\x00': # This isn't xz content, this is actually _raw decompressed cpio_ chunk of 16MB in size... # Let's back up ... seekread(f, offset = -6, length = 0) # ... and split it out ... f_content = seekread(f, length = f_length) section += 1 decomp_out = '%s.part%02d.cpio' % (pbzx_path, section) g = open(decomp_out, 'wb') g.write(f_content) g.close() # Now to start the next section, which should hopefully be .xz (we'll just assume it is ...) xar_f.close() section += 1 new_out = '%s.part%02d.cpio.xz' % (pbzx_path, section) xar_f = open(new_out, 'wb') else: f_length -= 6 # This part needs buffering f_content = seekread(f, length = f_length) tail = seekread(f, offset = -2, length = 2) xar_f.write(xzmagic) xar_f.write(f_content) if tail != 'YZ': xar_f.close() raise RuntimeError("Error: Footer is not xar file footer") try: f.close() xar_f.close() except IOError: pass def main(): parse_pbzx(sys.argv[1]) print("Now xz decompress the .xz chunks, then 'cat' them all together in order into a single new.cpio file") if __name__ == '__main__': main() volatility3-1.0.1/development/pdbparse-to-json.py000066400000000000000000000320521405267600400220650ustar00rootroot00000000000000import argparse import binascii import datetime import json import logging import os from typing import Dict, Union, Optional, Any, Set from urllib import request import pdbparse import pdbparse.undecorate logger = logging.getLogger(__name__) logger.setLevel(1) if __name__ == '__main__': console = logging.StreamHandler() console.setLevel(1) formatter = logging.Formatter('%(levelname)-8s %(name)-12s: %(message)s') console.setFormatter(formatter) logger.addHandler(console) class PDBRetreiver: def retreive_pdb(self, guid: str, file_name: str) -> Optional[str]: logger.info("Download PDB file...") file_name = ".".join(file_name.split(".")[:-1] + ['pdb']) for sym_url in ['http://msdl.microsoft.com/download/symbols']: url = sym_url + "/{}/{}/".format(file_name, guid) result = None for suffix in [file_name[:-1] + '_', file_name]: try: logger.debug("Attempting to retrieve {}".format(url + suffix)) result, _ = request.urlretrieve(url + suffix) except request.HTTPError as excp: logger.debug("Failed with {}".format(excp)) if result: logger.debug("Successfully written to {}".format(result)) break return result class PDBConvertor: ctype = { "T_INT4": "int", "T_INT8": "long long", "T_LONG": "long", "T_QUAD": "long long", "T_RCHAR": "char", "T_REAL32": "float", "T_REAL64": "double", "T_REAL80": "long double", "T_SHORT": "short", "T_UCHAR": "unsigned char", "T_UINT4": "unsigned int", "T_ULONG": "unsigned long", "T_UQUAD": "unsigned long long", "T_USHORT": "unsigned short", "T_HRESULT": "HRESULT", "T_WCHAR": "wchar", "T_VOID": "void", } ctype_python_types = { "char": "char", "unsigned char": "char", "float": "float", "double": "float", "long double": "float", "void": "void" } base_type_size = { "T_32PRCHAR": 4, "T_32PUCHAR": 4, "T_32PULONG": 4, "T_32PUQUAD": 4, "T_32PUSHORT": 4, "T_32PLONG": 4, "T_32PWCHAR": 4, "T_32PVOID": 4, "T_64PRCHAR": 8, "T_64PUCHAR": 8, "T_64PULONG": 8, "T_64PUQUAD": 8, "T_64PUSHORT": 8, "T_64PLONG": 8, "T_64PWCHAR": 8, "T_64PVOID": 8, "T_VOID": 0, "T_INT4": 4, "T_INT8": 8, "T_LONG": 4, "T_QUAD": 8, "T_RCHAR": 1, "T_REAL32": 4, "T_REAL64": 8, "T_REAL80": 10, "T_SHORT": 2, "T_UCHAR": 1, "T_UINT4": 4, "T_ULONG": 4, "T_UQUAD": 8, "T_USHORT": 2, "T_WCHAR": 2, "T_HRESULT": 4, "PTR_64": 8, "PTR_32": 4, "PTR_NEAR32": 4, "PTR_NEAR64": 8, } def __init__(self, filename: str): self._filename = filename logger.info("Parsing PDB...") self._pdb = pdbparse.parse(filename) self._seen_ctypes = set([]) # type: Set[str] def lookup_ctype(self, ctype: str) -> str: self._seen_ctypes.add(ctype) return self.ctype[ctype] def lookup_ctype_pointers(self, ctype_pointer: str) -> Dict[str, Union[str, Dict[str, str]]]: base_type = ctype_pointer.replace('32P', '').replace('64P', '') if base_type == ctype_pointer: # We raise a KeyError, because we've been asked about a type that isn't a pointer raise KeyError self._seen_ctypes.add(base_type) return {"kind": "pointer", "subtype": {"kind": "base", "name": self.ctype[base_type]}} def read_pdb(self) -> Dict: """Reads in the PDB file and forms essentially a python dictionary of necessary data""" output = { "user_types": self.read_usertypes(), "enums": self.read_enums(), "metadata": self.generate_metadata(), "symbols": self.read_symbols(), "base_types": self.read_basetypes() } return output def generate_metadata(self) -> Dict[str, Any]: """Generates the metadata necessary for this object""" dbg = self._pdb.STREAM_DBI last_bytes = str(binascii.hexlify(self._pdb.STREAM_PDB.GUID.Data4), 'ascii')[-16:] guidstr = u'{:08x}{:04x}{:04x}{}'.format(self._pdb.STREAM_PDB.GUID.Data1, self._pdb.STREAM_PDB.GUID.Data2, self._pdb.STREAM_PDB.GUID.Data3, last_bytes) pdb_data = { "GUID": guidstr.upper(), "age": self._pdb.STREAM_PDB.Age, "database": "ntkrnlmp.pdb", "machine_type": int(dbg.machine) } result = { "format": "6.0.0", "producer": { "datetime": datetime.datetime.now().isoformat(), "name": "pdbconv", "version": "0.1.0" }, "windows": { "pdb": pdb_data } } return result def read_enums(self) -> Dict: """Reads the Enumerations from the PDB file""" logger.info("Reading enums...") output = {} # type: Dict[str, Any] stream = self._pdb.STREAM_TPI for type_index in stream.types: user_type = stream.types[type_index] if (user_type.leaf_type == "LF_ENUM" and not user_type.prop.fwdref): output.update(self._format_enum(user_type)) return output def _format_enum(self, user_enum): output = { user_enum.name: { 'base': self.lookup_ctype(user_enum.utype), 'size': self._determine_size(user_enum.utype), 'constants': dict([(enum.name, enum.enum_value) for enum in user_enum.fieldlist.substructs]) } } return output def read_symbols(self) -> Dict: """Reads the symbols from the PDB file""" logger.info("Reading symbols...") output = {} try: sects = self._pdb.STREAM_SECT_HDR_ORIG.sections omap = self._pdb.STREAM_OMAP_FROM_SRC except AttributeError as e: # In this case there is no OMAP, so we use the given section # headers and use the identity function for omap.remap sects = self._pdb.STREAM_SECT_HDR.sections omap = None for sym in self._pdb.STREAM_GSYM.globals: if not hasattr(sym, 'offset'): continue try: virt_base = sects[sym.segment - 1].VirtualAddress except IndexError: continue name, _, _ = pdbparse.undecorate.undecorate(sym.name) if omap: output[name] = {"address": omap.remap(sym.offset + virt_base)} else: output[name] = {"address": sym.offset + virt_base} return output def read_usertypes(self) -> Dict: """Reads the user types from the PDB file""" logger.info("Reading usertypes...") output = {} stream = self._pdb.STREAM_TPI for type_index in stream.types: user_type = stream.types[type_index] if (user_type.leaf_type == "LF_STRUCTURE" and not user_type.prop.fwdref): output.update(self._format_usertype(user_type, "struct")) elif (user_type.leaf_type == "LF_UNION" and not user_type.prop.fwdref): output.update(self._format_usertype(user_type, "union")) return output def _format_usertype(self, usertype, kind) -> Dict: """Produces a single usertype""" fields = {} # type: Dict[str, Dict[str, Any]] [fields.update(self._format_field(s)) for s in usertype.fieldlist.substructs] return {usertype.name: {'fields': fields, 'kind': kind, 'size': usertype.size}} def _format_field(self, field) -> Dict[str, Dict[str, Any]]: return {field.name: {"offset": field.offset, "type": self._format_kind(field.index)}} def _determine_size(self, field): output = None if isinstance(field, str): output = self.base_type_size[field] elif (field.leaf_type == "LF_STRUCTURE" or field.leaf_type == "LF_ARRAY" or field.leaf_type == "LF_UNION"): output = field.size elif field.leaf_type == "LF_POINTER": output = self.base_type_size[field.ptr_attr.type] elif field.leaf_type == "LF_MODIFIER": output = self._determine_size(field.modified_type) elif field.leaf_type == "LF_ENUM": output = self._determine_size(field.utype) elif field.leaf_type == "LF_BITFIELD": output = self._determine_size(field.base_type) elif field.leaf_type == "LF_MEMBER": output = self._determine_size(field.index) if output is None: import pdb pdb.set_trace() raise ValueError("Unknown size for field: {}".format(field.name)) return output def _format_kind(self, kind): output = {} if isinstance(kind, str): try: output = self.lookup_ctype_pointers(kind) except KeyError: try: output = {'kind': 'base', 'name': self.lookup_ctype(kind)} except KeyError: output = {'kind': 'base', 'name': kind} elif kind.leaf_type == 'LF_MODIFIER': output = self._format_kind(kind.modified_type) elif kind.leaf_type == 'LF_STRUCTURE': output = {'kind': 'struct', 'name': kind.name} elif kind.leaf_type == 'LF_UNION': output = {'kind': 'union', 'name': kind.name} elif kind.leaf_type == 'LF_BITFIELD': output = { 'kind': 'bitfield', 'type': self._format_kind(kind.base_type), 'bit_length': kind.length, 'bit_position': kind.position } elif kind.leaf_type == 'LF_POINTER': output = {'kind': 'pointer', 'subtype': self._format_kind(kind.utype)} elif kind.leaf_type == 'LF_ARRAY': output = { 'kind': 'array', 'count': kind.size // self._determine_size(kind.element_type), 'subtype': self._format_kind(kind.element_type) } elif kind.leaf_type == 'LF_ENUM': output = {'kind': 'enum', 'name': kind.name} elif kind.leaf_type == 'LF_PROCEDURE': output = {'kind': "function"} else: import pdb pdb.set_trace() return output def read_basetypes(self) -> Dict: """Reads the base types from the PDB file""" ptr_size = 4 if "64" in self._pdb.STREAM_DBI.machine: ptr_size = 8 output = {"pointer": {"endian": "little", "kind": "int", "signed": False, "size": ptr_size}} for index in self._seen_ctypes: output[self.ctype[index]] = { "endian": "little", "kind": self.ctype_python_types.get(self.ctype[index], "int"), "signed": False if "_U" in index else True, "size": self.base_type_size[index] } return output if __name__ == '__main__': parser = argparse.ArgumentParser(description = "Convertor for PDB files to Volatility 3 Intermediate Symbol Format") parser.add_argument("-o", "--output", metavar = "OUTPUT", help = "Filename for data output", required = True) file_group = parser.add_argument_group("file", description = "File-based conversion of PDB to ISF") file_group.add_argument("-f", "--file", metavar = "FILE", help = "PDB file to translate to ISF") data_group = parser.add_argument_group("data", description = "Convert based on a GUID and filename pattern") data_group.add_argument("-p", "--pattern", metavar = "PATTERN", help = "Filename pattern to recover PDB file") data_group.add_argument("-g", "--guid", metavar = "GUID", help = "GUID + Age string for the required PDB file", default = None) data_group.add_argument("-k", "--keep", action = "store_true", default = False, help = "Keep the downloaded PDB file") args = parser.parse_args() delfile = False filename = None if args.guid is not None and args.pattern is not None: filename = PDBRetreiver().retreive_pdb(guid = args.guid, file_name = args.pattern) delfile = True elif args.file: filename = args.file else: parser.error("No GUID/pattern or file provided") if not filename: parser.error("No suitable filename provided or retrieved") convertor = PDBConvertor(filename) with open(args.output, "w") as f: json.dump(convertor.read_pdb(), f, indent = 2, sort_keys = True) if args.keep: print("Temporary PDB file: {}".format(filename)) elif delfile: os.remove(filename) volatility3-1.0.1/development/schema_validate.py000066400000000000000000000034131405267600400220060ustar00rootroot00000000000000import argparse import json import os import sys # TODO: Rather nasty hack, when volatility's actually installed this would be unnecessary sys.path += ".." import logging console = logging.StreamHandler() console.setLevel(logging.DEBUG) formatter = logging.Formatter('%(levelname)-8s %(name)-12s: %(message)s') console.setFormatter(formatter) logger = logging.getLogger("") logger.addHandler(console) logger.setLevel(logging.DEBUG) from volatility3 import schemas if __name__ == '__main__': parser = argparse.ArgumentParser("Validates ") parser.add_argument("-s", "--schema", dest = "schema", default = None) parser.add_argument("filenames", metavar = "FILE", nargs = '+') args = parser.parse_args() schema = None if args.schema: with open(os.path.abspath(args.schema), 'r') as s: schema = json.load(s) failures = [] for filename in args.filenames: try: if os.path.exists(filename): print("[?] Validating file: {}".format(filename)) with open(filename, 'r') as t: test = json.load(t) if args.schema: result = schemas.valid(test, schema, False) else: result = schemas.validate(test, False) if result: print("[+] Validation successful: {}".format(filename)) else: print("[-] Validation failed: {}".format(filename)) failures.append(filename) else: print("[x] File not found: {}".format(filename)) except Exception as e: failures.append(filename) print("[x] Exception occurred: {} ({})".format(filename, repr(e))) print("Failures", failures) volatility3-1.0.1/development/stock-linux-json.py000066400000000000000000000120441405267600400221240ustar00rootroot00000000000000import argparse import lzma import os import subprocess import tempfile from typing import List, Dict, Optional import requests import rpmfile from debian import debfile DWARF2JSON = './dwarf2json' class Downloader: def __init__(self, url_lists: List[List[str]]) -> None: self.url_lists = url_lists def download_lists(self, keep = False): for url_list in self.url_lists: print("Downloading files...") files_for_processing = self.download_list(url_list) self.process_files(files_for_processing) if not keep: for fname in files_for_processing.values(): if fname: os.unlink(fname) def download_list(self, urls: List[str]) -> Dict[str, str]: processed_files = {} for url in urls: print(" - Downloading {}".format(url)) data = requests.get(url) with tempfile.NamedTemporaryFile() as archivedata: archivedata.write(data.content) archivedata.seek(0) if url.endswith('.rpm'): processed_files[url] = self.process_rpm(archivedata) elif url.endswith('.deb'): processed_files[url] = self.process_deb(archivedata) return processed_files def process_rpm(self, archivedata) -> Optional[str]: rpm = rpmfile.RPMFile(fileobj = archivedata) member = None extracted = None for member in rpm.getmembers(): if 'vmlinux' in member.name or 'System.map' in member.name: print(" - Extracting {}".format(member.name)) extracted = rpm.extractfile(member) break if not member or not extracted: return None with tempfile.NamedTemporaryFile(delete = False, prefix = 'vmlinux' if 'vmlinux' in member.name else 'System.map') as output: print(" - Writing to {}".format(output.name)) output.write(extracted.read()) return output.name def process_deb(self, archivedata) -> Optional[str]: deb = debfile.DebFile(fileobj = archivedata) member = None extracted = None for member in deb.data.tgz().getmembers(): if member.name.endswith('vmlinux') or 'System.map' in member.name: print(" - Extracting {}".format(member.name)) extracted = deb.data.get_file(member.name) break if not member or not extracted: return None with tempfile.NamedTemporaryFile(delete = False, prefix = 'vmlinux' if 'vmlinux' in member.name else 'System.map') as output: print(" - Writing to {}".format(output.name)) output.write(extracted.read()) return output.name def process_files(self, named_files: Dict[str, str]): """Runs the dwarf2json binary across the files""" print("Processing Files...") for i in named_files: if named_files[i] is None: print("FAILURE: None encountered for {}".format(i)) return args = [DWARF2JSON, 'linux'] output_filename = 'unknown-kernel.json' for named_file in named_files: prefix = '--system-map' if not 'System' in named_files[named_file]: prefix = '--elf' output_filename = './' + '-'.join((named_file.split('/')[-1]).split('-')[2:])[:-4] + '.json.xz' args += [prefix, named_files[named_file]] print(" - Running {}".format(args)) proc = subprocess.run(args, capture_output = True) print(" - Writing to {}".format(output_filename)) with lzma.open(output_filename, 'w') as f: f.write(proc.stdout) if __name__ == '__main__': parser = argparse.ArgumentParser(description = "Takes a list of URLs for Centos and downloads them") parser.add_argument("-f", "--file", dest = 'filename', metavar = "FILENAME", help = "Filename to be read", required = True) parser.add_argument("-d", "--dwarf2json", dest = 'dwarfpath', metavar = "PATH", default = DWARF2JSON, help = "Path to the dwarf2json binary", required = True) parser.add_argument("-k", "--keep", dest = 'keep', action = 'store_true', help = 'Keep extracted temporary files after completion', default = False) args = parser.parse_args() DWARF2JSON = args.dwarfpath with open(args.filename) as f: lines = f.readlines() urls = [] for i in range(len(lines) // 2): urls += [[lines[2 * i].strip(), lines[(2 * i) + 1].strip()]] d = Downloader(urls) d.download_lists(keep = args.keep) volatility3-1.0.1/doc/000077500000000000000000000000001405267600400145455ustar00rootroot00000000000000volatility3-1.0.1/doc/Makefile000066400000000000000000000013531405267600400162070ustar00rootroot00000000000000# Minimal makefile for Sphinx documentation # # You can set these variables from the command line. SPHINXOPTS = SPHINXBUILD = sphinx-build SOURCEDIR = source BUILDDIR = build # Put it first so that "make" without argument is like "make help". help: @$(SPHINXBUILD) -M help "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O) .PHONY: help Makefile # Ensure we clean the autodoc files when we clean clean: -rm source/volatility3.*.rst @$(SPHINXBUILD) -M clean "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O) # Catch-all target: route all unknown targets to Sphinx using the new # "make mode" option. $(O) is meant as a shortcut for $(SPHINXOPTS). %: Makefile @$(SPHINXBUILD) -M $@ "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O) volatility3-1.0.1/doc/make.bat000066400000000000000000000014271405267600400161560ustar00rootroot00000000000000@ECHO OFF pushd %~dp0 REM Command file for Sphinx documentation if "%SPHINXBUILD%" == "" ( set SPHINXBUILD=sphinx-build ) set SOURCEDIR=source set BUILDDIR=build if "%1" == "" goto help %SPHINXBUILD% >NUL 2>NUL if errorlevel 9009 ( echo. echo.The 'sphinx-build' command was not found. Make sure you have Sphinx echo.installed, then set the SPHINXBUILD environment variable to point echo.to the full path of the 'sphinx-build' executable. Alternatively you echo.may add the Sphinx directory to PATH. echo. echo.If you don't have Sphinx installed, grab it from echo.http://sphinx-doc.org/ exit /b 1 ) %SPHINXBUILD% -M %1 %SOURCEDIR% %BUILDDIR% %SPHINXOPTS% goto end :help %SPHINXBUILD% -M help %SOURCEDIR% %BUILDDIR% %SPHINXOPTS% :end popd volatility3-1.0.1/doc/source/000077500000000000000000000000001405267600400160455ustar00rootroot00000000000000volatility3-1.0.1/doc/source/_static/000077500000000000000000000000001405267600400174735ustar00rootroot00000000000000volatility3-1.0.1/doc/source/_static/favicon.ico000066400000000000000000003216261405267600400216260ustar00rootroot00000000000000hf 00v@@((LF3($n( :=E>BM@DQBGUCJ[EL^FMaFOdFOeGOfGPhHQkHRoHStHTvHWFW    Gq;G( @--19BM?CO?DP@DQAFSBGUBHWBHXCIYCIZCJ[EL^EL_FMaFOdFOeGPhHSpHSrHTuHTwHVHWHWFW4LDX9QAW>U     ! !     !  ?p>|~???トÃ|8?p? q/??(0` &%&)(***,--1./301524957>69@9BM?CO?DPAFSBGUBGVCIYCJ[DK^&'GPgGPiHRlHTuHTw*9HW.CFW4LDX9QAW>U&" #%!(&%"!")# ("% $)%!)"# &( )'''%)#% $$$$$!' (& #"( #)'!&& ?@>~?????????}|p?~?|????><<8<<8<<8=????(@"!!&%&)(***,./301524945;57>9BM?CO@DQAFSBGUBGVDK^&'GPiHRlHTw*9HW.CFW4LDX9QAW>U$" $%!" %" % $! " $ %!$" !   #! ! " % !"  % !%"$#$  # ??|???????Ã????\>?xx>xx>?xx>xx>x???( "!!9U                                                           @ ????????????????????|??????????????????????????????("!!9U                                                                                                                 _?????_ ???????????????????????????????????U_??*(??????????????????????????????????????????????????????????????_????????????UU_volatility3-1.0.1/doc/source/_static/vol.png000066400000000000000000000231631405267600400210060ustar00rootroot00000000000000PNG  IHDRq;!sBIT|d pHYs%%VtEXtSoftwarewww.inkscape.org<"tEXtTitleVolatility_R1_Logo Red SolidW* IDATxyx[g5! qdK )$ -;HZoQ -KY)B  !&%e[,NȖ8$[eGϓ;s$53w8Rh_A{^ᷪGޣAځq.g8Ƹ65ΰ1.=̞=[W6,cNځ8 '(}&YXL6ǣ63v|'ŕg6t?-&#y^}gkx۳Hk ʟT2&Ud/%v;uCG`꜉hv/%s,F+Ul6T0K<Y5.םrI`f/SKq,D; iR@b :zy ׸\3,|{^w[_J%CzR9@cՒ ~t):ڠT; !Aqp2j6UQ>: Cjjj<BFnCȐ-)F$qp U\-p"325jkk?fptjM@Wv,|Xq4d@^t+XGGPv? A]<~$i+.+9*]qAv{ l{FNl,ۏU_:_4;"čbGjkkn+4}Pdn6}x) -%# u2zH#c)6ڽgB̷ƾ˝8 =!20-%@ 0 a})..6DC1U=)@IuoyyyƯBa`IlF'!& }Vw4`!qV_Oǩ&fx b7 I;q14 iڧ]0 kJ@p =MDʦnٲOA$\ Ï#3M{uˠ08f{T!ꌌ1G4'SQh {-16d"N\&ǹqzo8kk(*(8HX*Dx/tƑ _+S~RwNr+%] AxVt=Eip2~\2l)n{%\Zh߬xNNS7IJ&;O5_Ȭ J Hn~OBI9vj]#c"q`*E*3ܵ<NQZ]Ō~G'.U\_8Tc0 ۟pj4g&14KKK3+**zi✓h6T3eOǻwEjo;H>-z6㵧Bi E.Vs~^Lp`ڎЏ<|)]G*c{*Gֺ{eF$Jѳ7N\`~IDY>AS]hSiyŕ&V gҞLA7gR'\( \}v{Nn\d~bFm@lc.v8SqAU:Q ;6ߵ:/:F}z[C NQؒ|^W,Eiw%EC ׄbBډ=U)d [R` z a5%EK;"KRܿ r:-װ\D%T&3W̓Km6ht1BARrmM`qVDE2u TvE=]B32Uhq$3C)XW%S0p|<k i!|\R>$?H4Ƭ[RS8~4i'&_1RdL=Q~MD$00bRDTIB۝ThOi~~c)dIi'7D%Sїt%O$R@r)ⴲ Vݵԓ R\6 (O'o4cSXzK= Ճjpe<;"L="-t?MVB7'S_Fּ/JO8,)ߠ(Qx&zREZ+_< WXP8'ǺceͭLP@_&zi: $`yM]׃'H<ɀ?$KfK|+_b/ޑ*] )cH 6Rڊt6m\o});Rտ:2l#KNU5nw)#mP8~ai~ ks, [PV]YmHi4wDlq xlF@`J$HJcX&x߯BZ r&MDQ }t?e1^Rre.$&?0d?I^\bZ heMh-NhRq-=W\V!F=i6;憉9NIa,‰9ٟ4&䗙U5ĕx|GkkB61+9~P?nHV -^n= ~1Q{aBwlQA n"FAHA|WD˵5|@A9rBvNf_s3s[>[-n{F?. -RIN9{F5ip7V' I`$⼼J8)~Ŕi3m4qM m;,Ʉn8qp?YDt"Hx'd9صH76ɔ*⠨{@)t z,v1pks&S [۽gݱc›(;Gj)eÔ_4@=׭5}BAO莘 &O787֍0D0~ "B['6rmY,oq$bmNh^ ?NoOصͮ)Hɐvus;!Gs*ʺÈz:5O(O=$2 ۞}b7?CA&M]:cR G/(q:CzW]X V0侍ؘMŖ690ױs-g/ѓ8=1qN4w -_CըXAY S:nň[d-&>[W2x0)Á^c͌/Y➃3N0"l3:d^[$U)GN2^ԐHqUw) 7;\%|)z [v=yY";#@d[$llLw؝ k#~s. %$32 _SWڟuy" &h55Zk{}S _?\;d,^HU%^D fާ&YF%'{ihq[Oxm CƾYZDo,9pT6l4zӶ~漎g-1E}lR g:[^mDc~UGڮ]mʭ}/'@+8[ֹM]0!6/8]%>O܁`}^7g顨?TG; ſVlw; ?}O#)s.5 ھǯHf";:Qꋮ +~ٙK-A4E>hy3\ӭgqSG3*v*=5}xҋϢ3z[p%73A>Do4Fznپ3b4VQOкC=h Q9^HALJFlQ&RG,.7mP- ,:SaM;{,mψXM5ZKs*97s& ݵcsֿ ߶`#*YYIbg^/>$(OU]`4OkW2?v<v'K)ϮQ'MwTZ\ʔ/.8} d/1ijWz+ B48?if gJ!NfPC?R(ScKkW Zdf k܋yB\z„;΀xb<[j{O-`ӦwgzOɴ2ǭ^=ܥ֧%.+;6;rO('噦NPt5}^DjԴm":[/ }^ KY,]nzGV>ͦ-R T"<#sν󲮼ꏖ }B)/"iyp:fB.W0x;vy|pԽxR&MVԼie> "y bЦ (vl Nj((=0'/g ^j4gzQ5Zn}XڹCZkPĹfL4^כ=ee<ߚ&K֥Wlڭ`x=AڴG_x";s4iE ̖͋ :":/U"HsPL "wT-%u{}~"@'Cб N+YfAu 4~t>p̀1yJW[o2XrCH)Qg*5irΏĄ+:y:TUCRvˉ" 9@OJ#aum*dx3^ML}E55@qge`Zedd^ff>ͤ m}" j /rI_ OBGx!~4(G+++?߻\RH hb0^&²/ d ߘ?=['22Ƚ̽[)on-Wa}YmG,+s,d9u;V֪D=U%a}{58XSm#[m;0pZc7|C}2{նoC t;|ZG#bW>toh'cL#&w>iwOw\A;3Ǻh{IDATTLN pt"۪<=ֻuEvݶ䫎BĦ4c/pZiݷ1t*LsQo=Z'F|>]:z͍ٲiwBKCo< ~>v6ͷU6 mp|-c`^pz좦߷i+{띒+ɾষA&ӻ%_*kuN )ݶ Vzk y^.+rak_615tj$gHWEF_wʭ>R;zvo,=bI?[֢;NmdCgwr)KbHv\KS/<}Mk{?l۞+QSwIlEYmo~%yp;}'ԟMWMp02a9{Iv]Sz%Φ3Bau0F]%U mYD})۲%9 [~B~ٲ\C".s9w7?h&8EM GAbp4Nޡ͒BJ d {[gK(hnkx酃(38|9> `;Zny: B:F65M6^zCS0klnbG#Y5M#!w+: rOU cQ„M6aufw7O? G᣾$＝/m=l?fw46dffOT, WV03s;砾׋1j(L`J vAu8觿I zJT̳,>7$nc!״/Q\CUhgv^ظ`, which acts as a container for all the various layers and tables necessary to conduct memory analysis. Memory layers ------------- A memory layer is a body of data that can be accessed by requesting data at a specific address. Memory is seen as sequential when accessed through sequential addresses, however, there is no obligation for the data to be stored sequentially, and modern processors tend to store the memory in a paged format. Moreover, there is no need for the data to be stored in an easily accessible format, it could be encoded or encrypted or more, it could be the combination of two other sources. These are typically handled by programs that process file formats, or the memory manager of the processor, but these are all translations (either in the geometric or linguistic sense) of the original data. In Volatility 3 this is represented by a directed graph, whose end nodes are :py:class:`DataLayers ` and whose internal nodes are specifically called a :py:class:`TranslationLayer `. In this way, a raw memory image in the LiME file format and a page file can be combined to form a single Intel virtual memory layer. When requesting addresses from the Intel layer, it will use the Intel memory mapping algorithm, along with the address of the directory table base or page table map, to translate that address into a physical address, which will then either be directed towards the swap layer or the LiME layer. Should it be directed towards the LiME layer, the LiME file format algorithm will be translated to determine where within the file the data is stored and that will be returned. .. note:: Volatility 2 had a similar concept, called address spaces, but these could only stack linearly one on top of another. The list of layers supported by volatility can be determined by running the `frameworkinfo` plugin. Templates and Objects --------------------- Once we can address contiguous chunks of memory with a means to translate a virtual address (as seen by the programs) into the actual data used by the processor, we can start pulling out :py:class:`Objects ` by taking a :py:class:`~volatility3.framework.interfaces.objects.Template` and constructing it on the memory layer at a specific offset. A :py:class:`~volatility3.framework.interfaces.objects.Template` contains all the information you can know about the structure of the object without actually being populated by any data. As such a :py:class:`~volatility3.framework.interfaces.objects.Template` can tell you the size of a structure and its members, how far into the structure a particular member lives and potentially what various values in that field would mean, but not what resides in a particular member. Using a :py:class:`~volatility3.framework.interfaces.objects.Template` on a memory layer at a particular offset, an :py:class:`Object ` can be constructed. In Volatility 3, once an :py:class:`Object ` has been created, the data has been read from the layer and is not read again. An object allows its members to be interrogated and in particular allows pointers to be followed, providing easy access to the data contained in the object. .. note:: Volatility 2 would re-read the data which was useful for live memory forensics but quite inefficient for the more common static memory analysis typically conducted. Volatility 3 requires that objects be manually reconstructed if the data may have changed. Volatility 3 also constructs actual Python integers and floats whereas Volatility 2 created proxy objects which would sometimes cause problems with type checking. Symbol Tables ------------- Most compiled programs know of their own templates, and define the structure (and location within the program) of these templates as a :py:class:`Symbol `. A :py:class:`Symbol ` is often an address and a template and can be used to refer to either independently. Lookup tables of these symbols are often produced as debugging information alongside the compilation of the program. Volatility 3 provides access to these through a :py:class:`SymbolTable `, many of which can be collected within a :py:class:`~volatility3.framework.contexts.Context` as a :py:class:`SymbolSpace `. A :py:class:`~volatility3.framework.contexts.Context` can store only one :py:class:`~volatility.framework.symbols.SymbolSpace` at a time, although a :py:class:`~volatility3.framework.symbols.SymbolSpace` can store as many :py:class:`~volatility3.framework.symbols.SymbolTable` items as necessary. Volatility 3 uses the de facto naming convention for symbols of `module!symbol` to refer to them. It reads them from its own JSON formatted file, which acts as a common intermediary between Windows PDB files, Linux DWARF files, other symbol formats and the internal Python format that Volatility 3 uses to represent a :py:class:`~volatility3.framework.interfaces.objects.Template` or a :py:class:`Symbol `. .. note:: Volatility 2's name for a :py:class:`~volatility3.framework.symbols.SymbolSpace` was a profile, but it could not differentiate between symbols from different modules and required special handling for 32-bit programs that used Wow64 on Windows. This meant that all symbols lived in a single namespace with the possibility of symbol name collisions. It read the symbols using a format called *vtypes*, written in Python code directly. This made it less transferable or able to be used by other software. Plugins ------- A plugin acts as a means of requesting data from the user interface (and so the user) and then using it to carry out a specific form of analysis on the :py:class:`Context ` (containing whatever symbol tables and memory layers it may). The means of communication between the user interface and the library is the configuration tree, which is used by components within the :py:class:`~volatility3.framework.contexts.Context` to store configurable data. After the plugin has been run, it then returns the results in a specific format known as a :py:class:`~volatility3.framework.interfaces.renderers.TreeGrid`. This ensures that the data can be handled by consumers of the library, without knowing exactly what the data is or how it's formatted. Output Renderers ---------------- User interfaces can choose how best to present the output of the results to their users. The library always responds from every plugin with a :py:class:`~volatility3.framework.renderers.TreeGrid`, and the user interface can then determine how best to display it. For the Command Line Interface, that might be via text output as a table, or it might output to an SQLite database or a CSV file. For a web interface, the best output is probably as JSON where it could be displayed as a table, or inserted into a database like Elastic Search and trawled using an existing frontend such as Kibana. The renderers only need to know how to process very basic types (booleans, strings, integers, bytes) and a few additional specific ones (disassembly and various absent values). Configuration Tree ------------------ The configuration tree acts as the interface between the calling program and Volatility 3 library. Elements of the library (such as a :py:class:`Plugin `, a :py:class:`TranslationLayer `, an :py:class:`Automagic `, etc.) can use the configuration tree to inform the calling program of the options they require and/or optionally support, and allows the calling program to provide that information when the library is then called. Automagic --------- There are certain setup tasks that establish the context in a way favorable to a plugin before it runs, removing several tasks that are repetitive and also easy to get wrong. These are called :py:class:`Automagic `, since they do things like magically taking a raw memory image and automatically providing the plugin with an appropriate Intel translation layer and an accurate symbol table without either the plugin or the calling program having to specify all the necessary details. .. note:: Volatility 2 used to do this as well, but it wasn't a particularly modular mechanism, and was used only for stacking address spaces (rather than identifying profiles), and it couldn't really be disabled/configured easily. Automagics in Volatility 3 are a core component which consumers of the library can call or not at their discretion. volatility3-1.0.1/doc/source/complex-plugin.rst000066400000000000000000000506341405267600400215520ustar00rootroot00000000000000Writing more advanced Plugins ============================= There are several common tasks you might wish to accomplish, there is a recommended means of achieving most of these which are discussed below. Writing Reusable Methods ------------------------ Classes which inherit from :py:class:`~volatility3.framework.interfaces.plugins.PluginInterface` all have a :py:meth:`run()` method which takes no parameters and will return a :py:class:`~volatility3.framework.interfaces.renderers.TreeGrid`. Since most useful functions are parameterized, to provide parameters to a plugin the `configuration` for the context must be appropriately manipulated. There is scope for this, in order to run multiple plugins (see `Writing plugins that run other plugins`) but a much simpler method is to provide a parameterized `classmethod` within the plugin, which will allow the method to yield whatever kind of output it will generate and take whatever parameters it might need. This is how processes are listed, which is an often used function. The code lives within the :py:class:`~volatility3.plugins.windows.pslist.PsList` plugin but can be used by other plugins by providing the appropriate parameters (see :py:meth:`~volatility3.plugins.windows.pslist.PsList.list_processes`). It is up to the author of a plugin to validate that any required plugins are present and are the appropriate version. Writing plugins that run other plugins -------------------------------------- Occasionally plugins will want to process the output from other plugins (for example, the timeliner plugin which runs all other available plugins that feature a Timeliner interface). This can be achieved with the following example code: .. code-block:: python automagics = automagic.choose_automagic(automagic.available(self._context), plugin_class) plugin = plugins.construct_plugin(self.context, automagics, plugin_class, self.config_path, self._progress_callback, self.open) This code will first generate suitable automagics for running against the context. Unfortunately this must be re-run for each plugin in order to populate the context's configuration correctly based on the plugin's requirements (which may vary between plugins). Once the automagics have been constructed, the plugin can be instantiated using the helper function :py:func:`~volatility3.framework.plugins.construct_plugin` providing: * the base context (containing the configuration and any already loaded layers or symbol tables), * the plugin class to run, * the configuration path within the context for the plugin * any callback to determine progress in lengthy operations * an open method for the plugin to create files during the run With the constructed plugin, it can either be run by calling its :py:meth:`~volatility3.framework.interfaces.plugins.PluginInterface.run` method, or any other known method can be invoked on it. Writing plugins that output files --------------------------------- Every plugin can create files, but since the user interface must decide how to actually provide these files to the user, an abstraction layer is used. The user interface specifies an open_method (which is actually a class constructor that can double as a python ContextManager, so it can be used by the python `with` keyword). This is set on the plugin using `plugin.set_open_method` and can then be called or accessed using `plugin.open(preferred_filename)`. There are no additional options that can be set on the filename, and a :py:class:`~volatility3.framework.interfaces.plugins.FileHandlerInterface` is the result. This mimics an `IO[bytes]` object, which closely mimics a standard python file-like object. As such code for outputting to a file would be expected to look something like: .. code-block:: python with self.open(preferred_filename) as file_handle: file_handle.write(data) Since self.open returns a ContextManager the file is closed automatically and thus committed for the UI to process as necessary. If the file is not closed, the UI may not be able to properly process it and unexpected results may arise. In certain instances you may receive a file_handle from another plugin's method, in which case the file is unlikely to be closed to allow the preferred filename to be changed (or data to be added/modified, if necessary). Writing Scanners ---------------- Scanners are objects that adhere to the :py:class:`~volatility3.framework.interfaces.layers.ScannerInterface`. They are passed to the :py:meth:`~volatility3.framework.interfaces.layers.TranslationLayerInterface.scan` method on layers which will divide the provided range of sections (or the entire layer if none are provided) and call the :py:meth:`~volatility3.framework.interfaces.layers.ScannerInterface`'s call method method with each chunk as a parameter, ensuring a suitable amount of overlap (as defined by the scanner). The offset of the chunk, within the layer, is also provided as a parameter. Scanners can technically maintain state, but it is not recommended since the ordering that the chunks are scanned is not guaranteed. Scanners may be executed in parallel if they mark themselves as `thread_safe` although the threading technique may be either standard threading or multiprocessing. Note, the only component of the scans which is parallelized are those that go on within the scan method. As such, any processing carried out on the results yielded by the scanner will be processed in serial. It should also be noted that generating the addresses to be scanned are not iterated in parallel (in full, before the scanning occurs), meaning the smaller the sections to scan the quicker the scan will run. Empirically it was found that scanners are typically not the most time intensive part of plugins (even those that do extensive scanning) and so parallelism does not offer significant gains. As such, parallelism is not enabled by default but interfaces can easily enable parallelism when desired. Writing/Using Intermediate Symbol Format Files ---------------------------------------------- It can occasionally be useful to create a data file containing the static structures that can create a :py:class:`~volatility3.framework.interfaces.objects.Template` to be instantiated on a layer. Volatility has all the machinery necessary to construct these for you from properly formatted JSON data. The JSON format is documented by the JSON schema files located in schemas. These are versioned using standard .so library versioning, so they may not increment as expected. Each schema lists an available version that can be used, which specifies five different sections: * Base_types - These are the basic type names that will make up the native/primitive types * User_types - These are the standard definitions of type structures, most will go here * Symbols - These list offsets that are associated with specific names (and can be associated with specific type names) * Enums - Enumerations that offer a number of choices * Metadata - This is information about the generator, when the file was generated and similar Constructing an appropriate file, the file can be loaded into a symbol table as follows: .. code-block:: python table_name = intermed.IntermediateSymbolTable.create(context, config_path, 'sub_path', 'filename') This code will load a JSON file from one of the standard symbol paths (volatility3/symbols and volatility3/framework/symbols) under the additional directory sub_path, with a name matching filename.json (the extension should not be included in the filename). The `sub_path` parameter acts as a filter, so that similarly named symbol tables for each operating system can be addressed separately. The top level directories which sub_path filters are also checked as zipfiles to determine any symbols within them. As such, group of symbol tables can be included in a single zip file. The filename for the symbol tables should not contain an extension, as extensions for JSON (and compressed JSON files) will be tested to find a match. Additional parameters exist, such as `native_types` which can be used to provide pre-populated native types. Another useful parameter is `table_mapping` which allows for type referenced inside the JSON (such as `one_table!type_name`) would allow remapping of `one_table` to `another_table` by providing a dictionary as follows: .. code-block:: python table_name = intermed.IntermediateSymbolTable.create(context, config_path, 'sub_path', 'filename', table_mapping = {'one_table': 'another_table'}) The last parameter that can be used is called `class_types` which allows a particular structure to be instantiated on a class other than :py:class:`~volatility3.framework.objects.StructType`, allowing for additional methods to be defined and associated with the type. The table name can then by used to access the constructed table from the context, such as: .. code-block:: python context.symbol_space[table_name] Writing new Translation Layers ------------------------------ Translation layers offer a way for data to be translated from a higher (domain) layer to a lower (range) layer. The main method that must be overloaded for a translation layer is the `mapping` method. Usually this is a linear mapping whereby a value at an offset in the domain maps directly to an offset in the range. Most new layers should inherit from :py:class:`~volatility3.framework.layers.linear.LinearlyMappedLayer` where they can define a mapping method as follows: .. code-block:: python def mapping(self, offset: int, length: int, ignore_errors: bool = False) -> Iterable[Tuple[int, int, int, int, str]]: This takes a (domain) offset and a length of block, and returns a sorted list of chunks that cover the requested amount of data. Each chunk contains the following information, in order: **offset (domain offset)** requested offset in the domain **chunk length** the length of the data in the domain **mapped offset (range offset)** where the data lives in the lower layer **mapped length** the length of the data in the range **layer_name** the layer that this data comes from An example (and the most common layer encountered in memory forensics) would be an Intel layer, which models the intel page mapping system. Based on a series of tables stored within the layer itself, an intel layer can convert a virtual address to a physical address. It should be noted that intel layers allow multiple virtual addresses to map to the same physical address (but a single virtual address cannot ever map to more than one physical address). As a simple example, in a virtual layer which looks like `abracadabra` but maps to a physical layer that looks like `abcdr`, requesting `mapping(5, 4)` would return: .. code-block:: python [(5,1,0,1, 'physical_layer'), (6,1,3,1, 'physical_layer'), (7,2,0,2, 'physical_layer') ] This mapping mechanism allows for great flexibility in that chunks making up a virtual layer can come from multiple different range layers, allowing for swap space to be used to construct the virtual layer, for example. Also, by defining the mapping method, the read and write methods (which read and write into the domain layer) are defined for you to write to the lower layers (which in turn can write to layers even lower than that) until eventually they arrive at a DataLayer, such as a file or a buffer. This mechanism also allowed for some minor optimization in scanning such a layer, but should further control over the scanning of layers be needed, please refer to the Layer Scanning page. Whilst it may seem as though some of the data seems redundant (the length values are always the same) this is not the case for :py:class:`~volatility3.framework.layers.segmented.NonLinearlySegmentedLayer`. These layers do not guarantee that each domain address maps directly to a range address, and in fact can carry out processing on the data. These layers are most commonly encountered as compression or encryption layers (whereby a domain address may map into a chunk of the range, but not directly). In this instance, the mapping will likely define additional methods that can take a chunk and process it from its original value into its final value (such as decompressing for read and compressing for write). These methods are private to the class, and are used within the standard `read` and `write` methods of a layer. A non-linear layer's mapping method should return the data required to be able to return the original data. As an example, a run length encoded layer, whose domain data looks like `aaabbbbbcdddd` could be stored as `3a5b1c4d`. The mapping method call for `mapping(5,4)` should return all the regions that encompass the data required. The layer would return the following data: .. code-block:: python [(5, 4, 2, 4, 'rle layer')] It would then define `_decode` and `_encode` methods that could convert from one to the other. In the case of `read(5, 4)`, the `_decode` method would be provided with the following parameters: .. code-block:: python data = "5b1c" mapped_offset = 2 offset = 5 output_length = 4 This requires that the `_decode` method can unpack the encoding back to `bbbbbc` and also know that the decoded block starts at 3, so that it can return just `bbbc`, as required. Such layers therefore typically need to keep much more internal state, to keep track of which offset of encoded data relates to which decoded offset for both the mapping and `_encode` and `_decode` methods. If the data processing produces known fixed length values, then it is possible to write an `_encode` method in much the same way as the decode method. `_encode` is provided with the data to encode, the mapped_offset to write it to the lower (range) layer, the original offset of the data in the higher (domain) layer and the value of the not yet encoded data to write. The encoded result, regardless of length will be written over the current image at the mapped_offset. No other changes or updates to tables, etc are carried out. `_encode` is much more difficult if the encoded data can be variable length, as it may involve rewriting most, if not all of the data in the image. Such a situation is not currently supported with this API and it is strongly recommended to raise NotImplementedError in this method. Communicating between layers ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Layers can ask for information from lower layers using the `layer.metadata` lookup. In the following example, a LayerStacker automagic that generates the intel TranslationLayer requests whether the base layer knows what the `page_map_offset` value should be, a CrashDumpLayer would have that information. As such the TranslationLayer would just lookup the `page_map_offset` value in the `base_layer.metadata` dictionary: .. code-block:: python if base_layer.metadata.get('page_layer_offset', None) is not None: Most layers will return `None`, since this is the default, but the CrashDumpLayer may know what the value should be, so it therefore populates the `metadata` property. This is defined as a read-only mapping to ensure that every layer includes data from every underlying layer. As such, CrashDumpLayer would actually specify this value by setting it in the protected dictionary by `self._direct_metadata['page_map_offset']`. There is, unfortunately, no easy way to form consensus between a particular layer may want and what a particular layer may be able to provide. At the moment, the main information that layers may populate are: * `os` with values of `Windows`, `Linux`, `Mac` or `unknown` * `architecture` with values of `Intel32`, `Intel64` or `unknown` * `pae` a boolean specifying whether the PAE mode is enabled for windows * `page_map_offset` the value pointing to the intel page_map_offset Any value can be specified and used by layers but consideration towards ambiguity should be used to ensure that overly generic names aren't used for something and then best describe something else that may be needed later on. .. note:: The data stored in metadata is *not* restored when constructed from a configuration, so metadata should only be used as a temporary means of storing information to be used in constructing later objects and all information required to recreate an object must be written through the requirements mechanism. Writing new Templates and Objects --------------------------------- In most cases, a whole new type of object is unnecessary. It will usually be derived from an :py:class:`~volatility3.framework.objects.StructType` (which is itself just another name for a :py:class:`~volatility3.framework.objects.AggregateType`, but it's better to use `StructType` for readability). This can be used as a class override for a particular symbol table, so that an existing structure can be augmented with additional methods. An example of this would be: .. code-block:: python symbol_table = contexts.symbol_space[symbol_table_name] symbol_table.set_type_class('', NewStructureClass) This will mean that when a specific structure is loaded from the symbol_space, it is not constructed as a standard `StructType`, but instead is instantiated using the NewStructureClass, meaning new methods can be called directly on it. If the situation really calls for an entirely new object, that isn't covered by one of the existing :py:class:`~volatility3.framework.objects.PrimativeObject` objects (such as :py:class:`~volatility3.framework.objects.Integer`, :py:class:`~volatility3.framework.objects.Boolean`, :py:class:`~volatility3.framework.objects.Float`, :py:class:`~volatility3.framework.objects.Char`, :py:class:`~volatility3.framework.objects.Bytes`) or the other builtins (such as :py:class:`~volatility3.framework.objects.Array`, :py:class:`~volatility3.framework.objects.Bitfield`, :py:class:`~volatility3.framework.objects.Enumeration`, :py:class:`~volatility3.framework.objects.Pointer`, :py:class:`~volatility3.framework.objects.String`, :py:class:`~volatility3.framework.objects.Void`) then you can review the following information about defining an entirely new object. All objects must inherit from :py:class:`~volatility3.framework.interfaces.objects.ObjectInterface` which defines a constructor that takes a context, a `type_name`, an :py:class:`~volatility3.framework.interfaces.objects.ObjectInformation` object and then can accept additional keywords (which will not necessarily be provided if the object is constructed from a JSON reference). The :py:class:`~volatility3.framework.interfaces.objects.ObjectInformation` class contains all the basic elements that define an object, which include: * layer_name * offset * member_name * parent * native_layer_name * size The layer_name and offset are how volatility reads the data of the object. Since objects can reference other objects (specifically pointers), and contain values that are used as offsets in a particular layer, there is also the concept of a native_layer_name. The native_layer_name allows an object to be constructed based on physical data (for instance) but to reference virtual addresses, or for an object in the kernel virtual layer to reference offsets in a process virtual layer. The member_name and parent are optional and are used for when an object is constructed as a member of a structure. The parent points back to the object that created this one, and member_name is the name of the attribute of the parent used to get to this object. Finally, some objects are dynamically sized, and this size parameter allows a constructor to specify how big the object should be. Note, the size can change throughout the lifespan of the object, and the object will need to ensure that it compensates for such a change. Objects must also contain a specific class called `VolTemplateProxy` which must inherit from :py:class:`~volatility3.framework.interfaces.objects.ObjectInterface`. This is used to access information about a structure before it has been associated with data and becomes an Object. The :py:class:`~volatility3.framework.interfaces.objects.ObjectInterface.VolTemplateProxy` class contains a number of abstract classmethods, which take a :py:class:`~volatility3.framework.interfaces.objects.Template`. The main method that is likely to need overwriting is the `size` method, which should return the size of the object (for the template of a dynamically-sized object, this should be a suitable value, and calculated based on the best available information). For most objects, this can be determined from the JSON data used to construct a normal `Struct` and therefore only needs to be defined for very specific objects. volatility3-1.0.1/doc/source/conf.py000066400000000000000000000313351405267600400173510ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # # # Volatility documentation build configuration file, created by # sphinx-quickstart on Wed Apr 2 01:48:22 2014. # # This file is execfile()d with the current directory set to its # containing dir. # # Note that not all possible configuration values are present in this # autogenerated file. # # All configuration values have a default; values that are commented out # serve to show the default. import os import sys import sphinx.ext.apidoc def setup(app): volatility_directory = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', '..', 'volatility3')) source_dir = os.path.abspath(os.path.dirname(__file__)) sphinx.ext.apidoc.main(argv = ['-e', '-M', '-f', '-T', '-o', source_dir, volatility_directory]) # Go through the volatility3.framework.plugins files and change them to volatility3.plugins for dir, _, files in os.walk(os.path.dirname(__file__)): for filename in files: if filename.startswith('volatility3.framework.plugins') and filename != 'volatility3.framework.plugins.rst': # Change all volatility3.framework.plugins to volatility3.plugins in the file # Rename the file new_filename = filename.replace('volatility3.framework.plugins', 'volatility3.plugins') replace_string = b"Submodules\n----------\n\n.. toctree::\n\n" submodules = replace_string # If file already exists, read out the subpackages entries from it add them to the new list if os.path.exists(os.path.join(dir, new_filename)): with open(os.path.join(dir, new_filename), 'rb') as newfile: data = newfile.read() index = data.find(replace_string) if index > -1: submodules = data[index:] with open(os.path.join(dir, new_filename), 'wb') as newfile: with open(os.path.join(dir, filename), "rb") as oldfile: line = oldfile.read() correct_plugins = line.replace(b'volatility3.framework.plugins', b'volatility3.plugins') correct_submodules = correct_plugins.replace(replace_string, submodules) newfile.write(correct_submodules) os.remove(os.path.join(dir, filename)) elif filename == 'volatility3.framework.rst': with open(os.path.join(dir, filename), "rb") as contents: lines = contents.readlines() plugins_seen = False with open(os.path.join(dir, filename), "wb") as contents: for line in lines: if b'volatility3.framework.plugins' in line: plugins_seen = True if plugins_seen and line == b'': contents.write(b' volatility3.plugins') contents.write(line) elif filename == 'volatility3.plugins.rst': with open(os.path.join(dir, filename), "rb") as contents: lines = contents.readlines() with open(os.path.join(dir, 'volatility3.framework.plugins.rst'), "rb") as contents: real_lines = contents.readlines() # Process real_lines for line_index in range(len(real_lines)): if b'Submodules' in real_lines[line_index]: break else: line_index = len(real_lines) submodule_lines = [b"\n"] + real_lines[line_index:] plugins_seen = False with open(os.path.join(dir, filename), "wb") as contents: for line in lines: contents.write(line) for line in submodule_lines: contents.write(line.replace(b'volatility3.framework.plugins', b'volatility3.plugins')) # If extensions (or modules to document with autodoc) are in another directory, # add these directories to sys.path here. If the directory is relative to the # documentation root, use os.path.abspath to make it absolute, like shown here. sys.path.insert(0, os.path.abspath('../..')) from volatility3.framework import constants # -- General configuration ------------------------------------------------ # If your documentation needs a minimal Sphinx version, state it here. needs_sphinx = '2.0' # Add any Sphinx extension module names here, as strings. They can be # extensions coming with Sphinx (named 'sphinx.ext.*') or your custom # ones. extensions = [ 'sphinx.ext.autodoc', 'sphinx.ext.doctest', 'sphinx.ext.napoleon', 'sphinx.ext.intersphinx', 'sphinx.ext.todo', 'sphinx.ext.coverage', 'sphinx.ext.viewcode' ] try: import sphinx_autodoc_typehints extensions.append('sphinx_autodoc_typehints') except ImportError: pass # Add any paths that contain templates here, relative to this directory. # templates_path = ['tools/templates'] # The suffix of source filenames. source_suffix = '.rst' # The encoding of source files. # source_encoding = 'utf-8-sig' # The master toctree document. master_doc = 'index' # General information about the project. project = 'Volatility 3' copyright = '2012-2019, Volatility Foundation' # The version info for the project you're documenting, acts as replacement for # |version| and |release|, also used in various other places throughout the # built documents. # # The full version, including alpha/beta/rc tags. release = constants.PACKAGE_VERSION # The short X.Y version. version = ".".join(release.split('.')[0:2]) # The language for content autogenerated by Sphinx. Refer to documentation # for a list of supported languages. # language = None # There are two options for replacing |today|: either, you set today to some # non-false value, then it is used: # today = '' # Else, today_fmt is used as the format for a strftime call. # today_fmt = '%B %d, %Y' # List of patterns, relative to source directory, that match files and # directories to ignore when looking for source files. exclude_patterns = [] # The reST default role (used for this markup: `text`) to use for all # documents. # default_role = None # If true, '()' will be appended to :func: etc. cross-reference text. # add_function_parentheses = True # If true, the current module name will be prepended to all description # unit titles (such as .. function::). # add_module_names = True add_module_names = False # If true, sectionauthor and moduleauthor directives will be shown in the # output. They are ignored by default. # show_authors = False # The name of the Pygments (syntax highlighting) style to use. pygments_style = 'sphinx' # A list of ignored prefixes for module index sorting. # modindex_common_prefix = [] # If true, keep warnings as "system message" paragraphs in the built documents. # keep_warnings = False # -- Options for HTML output ---------------------------------------------- # The theme to use for HTML and HTML Help pages. See the documentation for # a list of builtin themes. # html_theme = 'default' # html_theme = 'pydoctheme' # html_theme_options = {'collapsiblesidebar': True} # html_theme_path = ['tools'] html_theme = 'sphinx_rtd_theme' html_theme_options = {'logo_only': True} # Theme options are theme-specific and customize the look and feel of a theme # further. For a list of options available for each theme, see the # documentation. # html_theme_options = {} # Add any paths that contain custom themes here, relative to this directory. # html_theme_path = [] # The name for this set of Sphinx documents. If None, it defaults to # " v documentation". # html_title = None # A shorter title for the navigation bar. Default is the same as html_title. # html_short_title = None # The name of an image file (relative to this directory) to place at the top # of the sidebar. html_logo = '_static/vol.png' # The name of an image file (within the static path) to use as favicon of the # docs. This file should be a Windows icon file (.ico) being 16x16 or 32x32 # pixels large. html_favicon = '_static/favicon.ico' # Add any paths that contain custom static files (such as style sheets) here, # relative to this directory. They are copied after the builtin static files, # so a file named "default.css" will overwrite the builtin "default.css". html_static_path = ['_static'] # Add any extra paths that contain custom files (such as robots.txt or # .htaccess) here, relative to this directory. These files are copied # directly to the root of the documentation. # html_extra_path = [] # If not '', a 'Last updated on:' timestamp is inserted at every page bottom, # using the given strftime format. # html_last_updated_fmt = '%b %d, %Y' # If true, SmartyPants will be used to convert quotes and dashes to # typographically correct entities. # html_use_smartypants = True # Custom sidebar templates, maps document names to template names. # html_sidebars = {} # Additional templates that should be rendered to pages, maps page names to # template names. # html_additional_pages = {} # If false, no module index is generated. # html_domain_indices = True # If false, no index is generated. # html_use_index = True # If true, the index is split into individual pages for each letter. # html_split_index = False # If true, links to the reST sources are added to the pages. # html_show_sourcelink = True # If true, "Created using Sphinx" is shown in the HTML footer. Default is True. # html_show_sphinx = True # If true, "(C) Copyright ..." is shown in the HTML footer. Default is True. # html_show_copyright = True # If true, an OpenSearch description file will be output, and all pages will # contain a tag referring to it. The value of this option must be the # base URL from which the finished HTML is served. # html_use_opensearch = '' # This is the file name suffix for HTML files (e.g. ".xhtml"). # html_file_suffix = None # Output file base name for HTML help builder. htmlhelp_basename = 'Volatilitydoc' # -- Options for LaTeX output --------------------------------------------- latex_elements = { # The paper size ('letterpaper' or 'a4paper'). # 'papersize': 'letterpaper', # The font size ('10pt', '11pt' or '12pt'). # 'pointsize': '10pt', # Additional stuff for the LaTeX preamble. # 'preamble': '', } # Grouping the document tree into LaTeX files. List of tuples # (source start file, target name, title, # author, documentclass [howto, manual, or own class]). latex_documents = [ ('index', 'Volatility.tex', 'Volatility 3 Documentation', 'Volatility Foundation', 'manual'), ] # The name of an image file (relative to this directory) to place at the top of # the title page. # latex_logo = None # For "manual" documents, if this is true, then toplevel headings are parts, # not chapters. # latex_use_parts = False # If true, show page references after internal links. # latex_show_pagerefs = False # If true, show URL addresses after external links. # latex_show_urls = False # Documents to append as an appendix to all manuals. # latex_appendices = [] # If false, no module index is generated. # latex_domain_indices = True # -- Options for manual page output --------------------------------------- # One entry per manual page. List of tuples # (source start file, name, description, authors, manual section). man_pages = [('vol-cli', 'volatility', 'Volatility 3 Documentation', ['Volatility Foundation'], 1)] # If true, show URL addresses after external links. # man_show_urls = False # -- Options for Texinfo output ------------------------------------------- # Grouping the document tree into Texinfo files. List of tuples # (source start file, target name, title, author, # dir menu entry, description, category) texinfo_documents = [ ('index', 'Volatility', 'Volatility 3 Documentation', 'Volatility Foundation', 'Volatility', 'Memory forensics framework.', 'Miscellaneous'), ] # Documents to append as an appendix to all manuals. # texinfo_appendices = [] # If false, no module index is generated. # texinfo_domain_indices = True # How to display URL addresses: 'footnote', 'no', or 'inline'. # texinfo_show_urls = 'footnote' # If true, do not generate a @detailmenu in the "Top" node's menu. # texinfo_no_detailmenu = False # Example configuration for intersphinx: refer to the Python standard library. intersphinx_mapping = {'http://docs.python.org/': None} # -- Autodoc options ------------------------------------------------------- # autodoc_member_order = 'groupwise' autodoc_default_options = {'members': True, 'inherited-members': True, 'show-inheritance': True} autoclass_content = 'both' volatility3-1.0.1/doc/source/index.rst000066400000000000000000000011171405267600400177060ustar00rootroot00000000000000Volatility 3 ============ This is the documentation for Volatility 3, the most advanced memory forensics framework in the world. Like previous versions of the Volatility framework, Volatility 3 is Open Source. :doc:`List of plugins ` Here are some guidelines for using Volatility 3 effectively: .. toctree:: basics simple-plugin vol2to3 complex-plugin using-as-a-library symbol-tables Python Packages =============== .. toctree:: volatility3 Indices and tables ================== * :ref:`genindex` * :ref:`modindex` * :ref:`search` volatility3-1.0.1/doc/source/simple-plugin.rst000066400000000000000000000351601405267600400213710ustar00rootroot00000000000000How to Write a Simple Plugin ============================ This guide will step through how to construct a simple plugin using Volatility 3. The example plugin we'll use is :py:class:`~volatility3.plugins.windows.dlllist.DllList`, which features the main traits of a normal plugin, and reuses other plugins appropriately. Inherit from PluginInterface ---------------------------- The first step is to define a class that inherits from :py:class:`~volatility3.framework.interfaces.plugins.PluginInterface`. Volatility automatically finds all plugins defined under the various plugin directories by importing them and then making use of any classes that inherit from :py:class:`~volatility3.framework.interfaces.plugins.PluginInterface`. :: from volatility3.framework import interfaces class DllList(interfaces.plugins.PluginInterface): The next step is to define the requirements of the plugin, these will be converted into options the user can provide based on the User Interface. Define the plugin requirements ------------------------------ These requirements are the names of variables that will need to be populated in the configuration tree for the plugin to be able to run properly. Any that are defined as optional need not necessarily be provided. :: @classmethod def get_requirements(cls): return [requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), requirements.ListRequirement(name = 'pid', element_type = int, description = "Process IDs to include (all other processes are excluded)", optional = True)] This is a classmethod, because it is called before the specific plugin object has been instantiated (in order to know how to instantiate the plugin). At the moment these requirements are fairly straightforward: :: requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), This requirement indicates that the plugin will operate on a single :py:class:`TranslationLayer `. The name of the loaded layer will appear in the plugin's configuration under the name ``primary``. Requirement values can be accessed within the plugin through the plugin's `config` attribute (for example ``self.config['pid']``). .. note:: The name itself is dynamic depending on the other layers already present in the Context. Always use the value from the configuration rather than attempting to guess what the layer will be called. Finally, this defines that the translation layer must be on the Intel Architecture. At the moment, this acts as a filter, failing to be satisfied by memory images that do not match the architecture required. Most plugins will only operate on a single layer, but it is entirely possible for a plugin to request two different layers, for example a plugin that carries out some form of difference or statistics against multiple memory images. This requirement (and the next two) are known as Complex Requirements, and user interfaces will likely not directly request a value for this from a user. The value stored in the configuration tree for a :py:class:`~volatility3.framework.configuration.requirements.TranslationLayerRequirement` is the string name of a layer present in the context's memory that satisfies the requirement. :: requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), This requirement specifies the need for a particular :py:class:`SymbolTable ` to be loaded. This gets populated by various :py:class:`Automagic ` as the nearest sibling to a particular :py:class:`~volatility3.framework.configuration.requirements.TranslationLayerRequirement`. This means that if the :py:class:`~volatility3.framework.configuration.requirements.TranslationLayerRequirement` is satisfied and the :py:class:`Automagic ` can determine the appropriate :py:class:`SymbolTable `, the name of the :py:class:`SymbolTable ` will be stored in the configuration. This requirement is also a Complex Requirement and therefore will not be requested directly from the user. :: requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), This requirement indicates that the plugin will make use of another plugin's code, and specifies the version requirements on that plugin. The version is specified in terms of Semantic Versioning, meaning that to be compatible, the major versions must be identical and the minor version must be equal to or higher than the one provided. This requirement does not make use of any data from the configuration, even if it were provided, it is merely a functional check before running the plugin. :: requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, optional = True) The final requirement is a List Requirement, populated by integers. The description will be presented to the user to describe what the value represents. The optional flag indicates that the plugin can function without the ``pid`` value being defined within the configuration tree at all. Define the `run` method ----------------------- The run method is the primary method called on a plugin. It takes no parameters (these have been passed through the context's configuration tree, and the context is provided at plugin initialization time) and returns an unpopulated :py:class:`~volatility3.framework.interfaces.renderers.TreeGrid` object. These are typically constructed based on a generator that carries out the bulk of the plugin's processing. The :py:class:`~volatility3.framework.interfaces.renderers.TreeGrid` also specifies the column names and types that will be output as part of the :py:class:`~volatility3.framework.interfaces.renderers.TreeGrid`. :: def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), ("Base", format_hints.Hex), ("Size", format_hints.Hex), ("Name", str), ("Path", str)], self._generator(pslist.PsList.list_processes(self.context, self.config['primary'], self.config['nt_symbols'], filter_func = filter_func))) In this instance, the plugin constructs a filter (using the PsList plugin's *classmethod* for creating filters). It checks the plugin's configuration for the ``pid`` value, and passes it in as a list if it finds it, or None if it does not. The :py:func:`~volatility3.plugins.windows.pslist.PsList.create_pid_filter` method accepts a list of process identifiers that are included in the list. If the list is empty, all processes are returned. The next line specifies the columns by their name and type. The types are simple types (int, str, bytes, float, and bool) but can also provide hints as to how the output should be displayed (such as a hexidecimal number, using :py:class:`volatility3.framework.renderers.format_hints.Hex`). This indicates to user interfaces that the value should be displayed in a particular way, but does not guarantee that the value will be displayed that way (for example, if it doesn't make sense to do so in a particular interface). Finally, the generator is provided. The generator accepts a list of processes, which is gathered using a different plugin, the :py:class:`~volatility3.plugins.windows.pslist.PsList` plugin. That plugin features a *classmethod*, so that other plugins can call it. As such, it takes all the necessary parameters rather than accessing them from a configuration. Since it must be portable code, it takes a context, as well as the layer name, symbol table and optionally a filter. In this instance we unconditionally pass it the values from the configuration for the ``primary`` and ``nt_symbols`` requirements. This will generate a list of :py:class:`~volatility3.framework.symbols.windows.extensions.EPROCESS` objects, as provided by the :py:class:`~volatility.plugins.windows.pslist.PsList` plugin, and is not covered here but is used as an example for how to share code across plugins (both as the provider and the consumer of the shared code). Define the generator -------------------- The :py:class:`~volatility3.framework.interfaces.renderers.TreeGrid` can be populated without a generator, but it is quite a common model to use. This is where the main processing for this plugin lives. :: def _generator(self, procs): for proc in procs: for entry in proc.load_order_modules(): BaseDllName = FullDllName = renderers.UnreadableValue() try: BaseDllName = entry.BaseDllName.get_string() # We assume that if the BaseDllName points to an invalid buffer, so will FullDllName FullDllName = entry.FullDllName.get_string() except exceptions.InvalidAddressException: pass yield (0, (proc.UniqueProcessId, proc.ImageFileName.cast("string", max_length = proc.ImageFileName.vol.count, errors = 'replace'), format_hints.Hex(entry.DllBase), format_hints.Hex(entry.SizeOfImage), BaseDllName, FullDllName)) This iterates through the list of processes and for each one calls the :py:meth:`~volatility3.framework.symbols.windows.extensions.EPROCESS.load_order_modules` method on it. This provides a list of the loaded modules within the process. The plugin then defaults the ``BaseDllName`` and ``FullDllName`` variables to an :py:class:`~volatility3.framework.renderers.UnreadableValue`, which is a way of indicating to the user interface that the value couldn't be read for some reason (but that it isn't fatal). There are currently four different reasons a value may be unreadable: * **Unreadble**: values which are empty because the data cannot be read * **Unparsable**: values which are empty because the data cannot be interpreted correctly * **NotApplicable**: values which are empty because they don't make sense for this particular entry * **NotAvailable**: values which cannot be provided now (but might in a future run, via new symbols or an updated plugin) This is a safety provision to ensure that the data returned by the Volatility library is accurate and describes why information may not be provided. The plugin then takes the process's ``BaseDllName`` value, and calls :py:meth:`~volatility3.framework.symbols.windows.extensions.UNICODE_STRING.get_string` on it. All structure attributes, as defined by the symbols, are directly accessible and use the case-style of the symbol library it came from (in Windows, attributes are CamelCase), such as ``entry.BaseDllName`` in this instance. Any attribtues not defined by the symbol but added by Volatility extensions cannot be properties (in case they overlap with the attributes defined in the symbol libraries) and are therefore always methods and prepended with ``get_``, in this example ``BaseDllName.get_string()``. Finally, ``FullDllName`` is populated. These operations read from memory, and as such, the memory image may be unable to read the data at a particular offset. This will cause an exception to be thrown. In Volatility 3, exceptions are thrown as a means of communicating when something exceptional happens. It is the responsibility of the plugin developer to appropriately catch and handle any non-fatal exceptions and otherwise allow the exception to be thrown by the user interface. In this instance, the :py:class:`~volatility3.framework.exceptions.InvalidAddressException` class is caught, which is thrown by any layer which cannot access an offset requested of it. Since we have already populated both values with ``UnreadableValue`` we do not need to write code for the exception handler. Finally, we yield the record in the format required by the :py:class:`~volatility3.framework.interfaces.renderers.TreeGrid`, a tuple, listing the indentation level (for trees) and then the list of values for each column. This plugin demonstrates casting a value ``ImageFileName`` to ensure it's returned as a string with a specific maximum length, rather than its original type (potentially an array of characters, etc). This is carried out using the :py:meth:`~volatility3.framework.interfaces.objects.ObjectInterface.cast` method which takes a type (either a native type, such as string or pointer, or a structure type defined in a :py:class:`SymbolTable ` such as ``!_UNICODE``) and the parameters to that type. Since the cast value must populate a string typed column, it had to be a Python string (such as being cast to the native type string) and could not have been a special Structure such as ``_UNICODE``. For the format hint columns, the format hint type must be used to ensure the error checking does not fail. volatility3-1.0.1/doc/source/symbol-tables.rst000066400000000000000000000065471405267600400213700ustar00rootroot00000000000000Creating New Symbol Tables ========================== This page details how symbol tables are located and used by Volatility, and documents the tools and methods that can be used to make new symbol tables. How Volatility finds symbol tables ---------------------------------- All files are stored as JSON data, they can be in pure JSON files as ``.json``, or compressed as ``.json.gz`` or ``.json.xz``. Volatility will automatically decompress them on use. It will also cache their contents (compressed) when used, located under the user's home directory, in :file:`.cache/volatility3`, along with other useful data. The cache directory currently cannot be altered. Symbol table JSON files live, by default, under the :file:`volatility3/symbols`, underneath an operating system directory (currently one of :file:`windows`, :file:`mac` or :file:`linux`). The symbols directory is configurable within the framework and can usually be set within the user interface. These files can also be compressed into ZIP files, which Volatility will process in order to locate symbol files. The ZIP file must be named after the appropriate operating system (such as `linux.zip`, `mac.zip` or `windows.zip`). Inside the ZIP file, the directory structure should match the uncompressed operating system directory. Windows symbol tables --------------------- For Windows systems, Volatility accepts a string made up of the GUID and Age of the required PDB file. It then searches all files under the configured symbol directories under the windows subdirectory. Any that match the filename pattern of :file:`/-.json` (or any compressed variant) will be used. If such a symbol table cannot be found, then the associated PDB file will be downloaded from Microsoft's Symbol Server and converted into the appropriate JSON format, and will be saved in the correct location. Windows symbol tables can be manually constructed from an appropriate PDB file. The primary tool for doing this is built into Volatility 3, called :file:`pdbconv.py`. It can be run from the top-level Volatility path, using the following command: :command:`PYTHONPATH="." python volatility3/framework/symbols/windows/pdbconv.py` The :envvar:`PYTHONPATH` environment variable is not required if the Volatility library is installed in the system's library path or a virtual environment. Mac/Linux symbol tables ----------------------- For Mac/Linux systems, both use the same mechanism for identification. JSON files live under the symbol directories, under either the :file:`linux` or :file:`mac` directories. The generated files contain an identifying string (the operating system banner), which Volatility's automagic can detect. Volatility caches the mapping between the strings and the symbol tables they come from, meaning the precise file names don't matter and can be organized under any necessary hierarchy under the operating system directory. Linux and Mac symbol tables can be generated from a DWARF file using a tool called `dwarf2json `_. Currently a kernel with debugging symbols is the only suitable means for recovering all the information required by most Volatility plugins. Once a kernel with debugging symbols/appropriate DWARF file has been located, `dwarf2json `_ will convert it into an appropriate JSON file. volatility3-1.0.1/doc/source/using-as-a-library.rst000066400000000000000000000302571405267600400222140ustar00rootroot00000000000000Using Volatility 3 as a Library =============================== This portion of the documentation discusses how to access the Volatility 3 framework from an external application. The general process of using volatility as a library is to as follows: 1. :ref:`create_context` 2. (Optional) :ref:`available_plugins` 3. (Optional) :ref:`config_options` 4. :ref:`context_config` 5. (Optional) :ref:`use_automagic` 6. :ref:`run_plugin` 7. :ref:`render_treegrid` .. _create_context: Creating a context ------------------ First we make sure the volatility framework works the way we expect it (and is the version we expect). The versioning used is semantic versioning, meaning any version with the same major number and a higher or equal minor number will satisfy the requirement. An example is below since the CLI doesn't need any of the features from versions 1.1 or 1.2: :: volatility3.framework.require_interface_version(1, 0, 0) Contexts can be spun up quite easily, just construct one. It's not a singleton, so multiple contexts can be constructed and operate independently, but be aware of which context you're handing where and make sure to use the correct one. Typically once a context has been handed to a plugin, all objects will be created with a reference to that context. :: ctx = contexts.Context() # Construct a blank context .. _available_plugins: Determine what plugins are available ------------------------------------ You can also interrogate the framework to see which plugins are available. First we have to try to load all available plugins. The :py:func:`~volatility3.framework.import_files` method will automatically use the module paths for the provided module (in this case, volatility3.plugins) and walk the directory (or directories) loading up all python files. Any import failures will be provided in the failures return value, unless the second parameter is False in which case the call will raise any exceptions encountered. Any additional directories containing plugins should be added to the `__path__` attribute for the `volatility3.plugins` module. The standard paths should generally also be included, which can be found in `volatility3.constants.PLUGINS_PATH`. :: volatility3.plugins.__path__ = + constants.PLUGINS_PATH failures = framework.import_files(volatility3.plugins, True) Once the plugins have been imported, we can interrogate which plugins are available. The :py:func:`~volatility3.framework.list_plugins` call will return a dictionary of plugin names and the plugin classes. :: plugin_list = framework.list_plugins() .. _config_options: Determine what configuration options a plugin requires ------------------------------------------------------ For each plugin class, we can call the classmethod `requirements` on it, which will return a list of objects that adhere to the :py:class:`~volatility3.framework.interfaces.configuration.RequirementInterface` method. The various types of Requirement are split roughly in two, :py:class:`~volatility3.framework.interfaces.configuration.SimpleTypeRequirement` (such as integers, booleans, floats and strings) and more complex requirements (such as lists, choices, multiple requirements, translation layer requirements or symbol table requirements). A requirement just specifies a type of data and a name, and must be combined with a configuration hierarchy to have meaning. List requirements are a list of simple types (integers, booleans, floats and strings), choices must match the available options, multiple requirements needs all their subrequirements fulfilled and the other types require the names of valid translation layers or symbol tables within the context, respectively. Luckily, each of these requirements can tell you whether they've been fulfilled or not later in the process. For now, they can be used to ask the user to fill in any parameters they made need to. Some requirements are optional, others are not. The plugin is essentially a multiple requirement. It should also be noted that automagic classes can have requirements (as can translation layers). .. _context_config: Set the configuration in the context ------------------------------------ Once you know what requirements the plugin will need, you can populate them within the `context.config`. The configuration is essentially a hierarchical tree of values, much like the windows registry. Each plugin is instantiated at a particular branch within the hierarchy and will look for its configuration options under that hierarchy (if it holds any configurable items, it will likely instantiate those at a point underneaths its own branch). To set the hierarchy, you'll need to know where the configurables will be constructed. For this example, we'll assume plugins' base_config_path is set as `plugins`, and that automagics are configured under the `automagic` tree. We'll see later how to ensure this matches up with the plugins and automagic when they're constructed. Joining configuration options should always be carried out using :py:func:`~volatility3.framework.interfaces.configuration.path_join` in case the separator value gets changed in the future. Configuration items can then be set as follows: :: config_path = path_join(base_config_path, plugin.__class__.__name__, ) context.config['plugins..'] = value .. _use_automagic: Using automagic to complete the configuration --------------------------------------------- Many of the options will require a lot of construction (layers on layers on layers). The automagic functionality is there to help take some of that burden away. There are automagics designed to stack layers (such as compression and file formats, as well as architectures) and automagics for determining critical information from windows, linux and mac layers about the operating system. The list of available automagics can be found using: :: available_automagics = automagic.available(ctx) This again, will require that all automagic modules have been loaded but this should happen simply as part of importing the `automagic` module. The available list will be pre-instantiated copies of the automagic with their configuration path and context provided (based on `constants.AUTOMAGIC_CONFIG_PATH` and the automagic class name). A suitable list of automagics for a particular plugin (based on operating system) can be found using: :: automagics = automagic.choose_automagic(available_automagics, plugin) This will take the plugin module, extract the operating system (first level of the hierarchy) and then return just the automagics which apply to the operating system. These automagics can then be run by providing the list, the context, the plugin to be run, the hierarchy name that the plugin will be constructed on ('plugins' by default) and a progress_callback. This is a callable which takes a percentage of completion and a description string and will be called throughout the process to indicate to the user how much progress has been made. :: errors = automagic.run(automagics, context, plugin, base_config_path, progress_callback = progress_callback) Any exceptions that occur during the execution of the automagic will be returned as a list of exceptions. .. _run_plugin: Run the plugin -------------- Firstly, we should check whether the plugin will be able to run (ie, whether the configuration options it needs have been successfully set). We do this as follow (where plugin_config_path is the base_config_path (which defaults to `plugins` and then the name of the class itself): :: unsatisfied = plugin.unsatisfied(context, plugin_config_path) If unsatisfied is an empty list, then the plugin has been given everything it requires. If not, it will be a Dictionary of the hierarchy paths and their associated requirements that weren't satisfied. The plugin can then be instantiated with the context (containing the plugin's configuration) and the path that the plugin can find its configuration at. A progress_callback can also be provided to give users feedback whilst the plugin is running. Also, should the plugin produce files, an open_method can be set on the plugin, which will be called whenever a plugin produces an auxiliary file. :: constructed = plugin(context, plugin_config_path, progress_callback = progress_callback) constructed.set_open_method(file_handler) The file_handler must adhere to the :py:class:`~volatility3.framework.interfaces.plugins.FileHandlerInterface`, which represents an IO[bytes] object but also contains a `preferred_filename` attribute as a hint. All of this functionality has been condensed into a framework method called `construct_plugin` which will take and run the automagics, and instantiate the plugin on the provided `base_config_path`. It also accepts an optional progress_callback and an optional file_consumer. :: constructed = plugins.construct_plugin(ctx, automagics, plugin, base_config_path, progress_callback, file_consumer) Finally the plugin can be run, and will return a :py:class:`~volatility3.framework.interfaces.renderers.TreeGrid`. :: treegrid = constructed.run() .. _render_treegrid: Render the TreeGrid ------------------- The results are now in a structure of rows, with a hierarchy (allowing a row to be a child of another row). The TreeGrid can tell you what columns it contains, and the types of each column, but does not contain any data yet. It must first be populated. This actually iterates through the results of the plugin, which may have been provided as a generator, meaning this step may take the actual processing time, whilst the plugin does the actual work. This can return an exception if one occurs during the running of the plugin. The results can be accessed either as the results are being processed, or by visiting the nodes in the tree once it is fully populated. In either case, a visitor method will be required. The visitor method should accept a :py:class:`~volatility3.framework.interfaces.renderers.TreeNode` and an `accumulator`. It will return an updated accumulator. When provided a :py:class:`~volatility3.framework.interfaces.renderers.TreeNode`, it can be accessed as a dictionary based on the column names that the treegrid contains. It should be noted that each column can contain only the type specified in the `column.type` field (which can be a simple type like string, integer, float, bytes or a more complex type, like a DateTime, a Disassembly or a descendant of :py:class:`~volatility3.framework.interfaces.renderers.BaseAbsentValue`). The various fields may also be wrapped in `format_hints` designed to tell the user interface how to render the data. These hints can be things like Bin, Hex or HexBytes, so that fields like offsets are displayed in hex form or so that bytes are displayed in their hex form rather than their raw form. Descendants of :py:class:`~volatility3.framework.interfaces.renderers.BaseAbsentValue` can currently be one of :py:class:`~volatility3.framework.renderers.UnreadableValue`, :py:class:`~volatility3.framework.renderers.UnparsableValue`, :py:class:`~volatility3.framework.renderers.NotApplicableValue` or :py:class:`~volatility3.framework.renderers.NotAvailableValue`. These indicate that data could not be read from the memory for some reason, could not be parsed properly, was not applicable or was not available. A simple text renderer (that returns output immediately) would appear as follows. This doesn't use the accumulator, but instead uses print to directly produce the output. This is not recommended: :: for column in grid.columns: print(column.name) def visitor(node, _accumulator): # Nodes always have a path value, giving them a path_depth of at least 1, we use max just in case print("*" * max(0, node.path_depth - 1), end = " ") for column_index in range(len(grid.columns)): column = grid.columns[column_index] print(repr(node.values[column_index]), end = '\t') print('') return None grid.populate(visitor, None) More complex examples of renderers can be found in the default CLI implementation, such as the :py:class:`~volatility3.cli.text_renderer.QuickTextRenderer` or the :py:class:`~volatility3.cli.text_renderer.PrettyTextRenderer`. volatility3-1.0.1/doc/source/vol-cli.rst000066400000000000000000000125771405267600400201600ustar00rootroot00000000000000:orphan: volatility manual page ====================== Synopsis -------- **volatility** [-h] [-c CONFIG] [--parallelism [{processes,threads,off}]] [-e EXTEND] [-p PLUGIN_DIRS] [-s SYMBOL_DIRS] [-v] [-l LOG] [-o OUTPUT_DIR] [-q] [-r RENDERER] [-f FILE] [--write-config] [--single-location SINGLE_LOCATION] [--single-swap-locations SINGLE_SWAP_LOCATIONS] ... Description ----------- Volatility is a program used to analyze memory images from a computer and extract useful information from windows, linux and mac operating systems. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research. The command line tool allows developers to distribute and easily use the plugins of the framework against memory images of their choice. Plugins may define their own options, these are dynamic and therefore not listed in this man page. Plugin options must be listed after the plugin name. A list of the options for a specific plugin is available by running "**volatility** --help". Options ------- -h, --help Shows a help message that lists these options, and the available plugins. If used after a plugin has been chosen, help will show any options which that particular plugin can accept. -c CONFIG, --config CONFIG Loads a JSON configuration from the CONFIG file --parallelism [{processes,threads,off}] Enables parallelism (defaults to processes if no argument given). The parallelism can be either off, or multithreaded (but due to python's GIL still only takes up a single CPU) or multiprocessed (which spawns other processes, but can use the whole of the CPU). Currently parallelism is *experimental* and provides minimal benefits whilst still being developed -e EXTEND, --extend EXTEND Extends an existing configuration with a single directive as specified by EXTEND. Extensions must be of the form **configuration.item.name=value** -p PLUGIN_DIRS, --plugin-dirs PLUGIN_DIRS Specified a semi-colon separated list of paths that contain directories where plugins may be found. These paths are searched before the default paths when loading python files for plugins. This can therefore be used to override built-in plugins. NOTE: All python code within this directory and any subdirectories will be evaluated during normal operation. -s SYMBOL_DIRS, --symbol-dirs SYMBOL_DIRS SYMBOL_DIRS is a semi-colon separated list of paths that contain symbol files or symbol zip packs. Symbols must be within a particular directory structure if they depending on the operating system of the symbols, whilst symbol packs must be in the root of the directory and named after the after the operating system to which they apply. -v, --verbose A flag which can be used multiple times, each time increasing the level of detail in the logs produced. -l LOG, --log LOG Writes all logs (even those not displayed on screen) to the file specified by LOG. -o OUTPUT_DIR, --output-dir OUTPUT_DIR Should volatility generate any files during its run (such as a `dump` plugin), the files will be created in the OUTPUT_DIR directory. This defaults to the current working directory. -q, --quiet When present, this flag mutes the progress feedback for operations. This can be beneficial when piping the output directly to a file or another tool. This also removes the -r RENDERER, --renderer RENDERER Specifies the output format in which to display results. The default is the quick renderer, which produces output immediately at the cost of spacing for columns. Pretty outputs the results at the end, but aligns them all to column width. json and jsonl output JSON (or JSON lines) format, which can be used directly in conjunction with -q. -f FILE, --file FILE This takes the FILE value, and formats it as a file:// URL for use with the --single-location field, which is the image that the automagic will attempt to build upon, and can be considered the input for the program. --write-config This flag specifies that volatility should write or overwrite a file called config.json in the current directory. The file will contain the necessary JSON configuration to recreate the environment that the plugin was previously run in. This configuration *may* be accepted by other plugins, but there's no guarantee that plugins use the same configuration options. --single-location SINGLE_LOCATION This specifies a URL which will be downloaded if necessary, and built upon by the automagic and, since most plugins require a single memory image, can be considered the input for the program. --single-swap-locations SINGLE_SWAP_LOCATIONS A comma-separated list of swap files to be considered as part of the memory image specified by the single-location or file parameters. **** The name of the plugin to execute (these are usually categorized by the operating system, such as `windows.pslist.PsList`). Any subtring that uniquely matches the desired plugin name can be used. As such `hivescan` would match `windows.registry.hivescan.HiveScan`, but `pslist` is ambiguous because it could match `windows.pslist` or `linux.pslist`. volatility3-1.0.1/doc/source/vol2to3.rst000066400000000000000000000130121405267600400201040ustar00rootroot00000000000000Changes between Volatility 2 and Volatility 3 ============================================= Library and Context ------------------- Volatility 3 has been designed from the ground up to be a library, this means the components are independent and all state required to run a particular plugin at a particular time is self-contained in an object derived from a :py:class:`~volatility3.framework.interfaces.context.ContextInterface`. The context contains the two core components that make up Volatility, layers of data and the available symbols. Symbols and Types ----------------- Volatility 3 no longer uses profiles, it comes with an extensive library of :py:class:`symbol tables `, and can generate new symbol tables for most windows memory images, based on the memory image itself. This allows symbol tables to include specific offsets for locations (symbol locations) based on that operating system in particular. This means it is easier and quicker to identify structures within an operating system, by having known offsets for those structures provided by the official debugging information. Object Model changes -------------------- The object model has changed as well, objects now inherit directly from their Python counterparts, meaning an integer object is actually a Python integer (and has all the associated methods, and can be used whereever a normal int could). In Volatility 2, a complex proxy object was constructed which tried to emulate all the methods of the host object, but ultimately it was a different type and could not be used in the same places (critically, it could make the ordering of operations important, since a + b might not work, but b + a might work fine). Volatility 3 has also had significant speed improvements, where Volatility 2 was designed to allow access to live memory images and situations in which the underlying data could change during the run of the plugin, in Volatility 3 the data is now read once at the time of object construction, and will remain static, even if the underlying layer changes. This was because live memory analysis was barely ever used, and this feature could cause a particular value to be re-read many times over for no benefit (particularly since each re-read could result in many additional image reads from following page table translations). Finally, in order to provide Volatility specific information without impact on the ability for structures to have members with arbitrary names, all the metadata about the object (such as its layer or offset) have been moved to a read-only :py:meth:`~volatility3.framework.interfaces.objects.ObjectInterface.vol` dictionary. Further the distinction between a :py:class:`~volatility3.framework.interfaces.objects.Template` (the thing that constructs an object) and the :py:class:`Object ` itself has been made more explicit. In Volatility 2, some information (such as size) could only be determined from a constructed object, leading to instantiating a template on an empty buffer, just to determine the size. In Volatility 3, templates contain information such as their size, which can be queried directly without constructing the object. Layer and Layer dependencies ---------------------------- Address spaces in Volatility 2, are now more accurately referred to as :py:class:`Translation Layers `, since each one typically sits atop another and can translate addresses between the higher logical layer and the lower physical layer. Address spaces in Volatility 2 were strictly limited to a stack, one on top of one other. In Volatility 3, layers can have multiple "dependencies" (lower layers), which allows for the integration of features such as swap space. Automagic --------- In Volatility 2, we often tried to make this simpler for both users and developers. This resulted in something was referred to as automagic, in that it was magic that happened automatically. We've now codified that more, so that the automagic processes are clearly defined and can be enabled or disabled as necessary for any particular run. We also included a stacker automagic to emulate the most common feature of Volatility 2, automatically stacking address spaces (now translation layers) on top of each other. Searching and Scanning ---------------------- Scanning is very similar to scanning in Volatility 2, a scanner object (such as a :py:class:`~volatility3.framework.layers.scanners.BytesScanner` or :py:class:`~volatility.framework.layers.scanners.RegExScanner`) is primed with the data to be searched for, and the :py:meth:`~volatility3.framework.interfaces.layers.DataLayerInterface.scan` method is called on the layer to be searched. Output Rendering ---------------- This is extremely similar to Volatility 2, because we were developing it for Volatility 3 when we added it to Volatility 2. We now require that all plugins produce output in a :py:class:`~volatility3.framework.interfaces.renderers.TreeGrid` object, which ensure that the library can be used regardless of which interface is driving it. An example web GUI is also available called Volumetric which allows all the plugins that can be run from the command line to be run from a webpage, and offers features such as automatic formatting and sorting of the data, which previously couldn't be provided easily from the CLI. There is also the ability to provide file output such that the user interface can provide a means to render or save those files. volatility3-1.0.1/mypy.ini000066400000000000000000000001171405267600400154760ustar00rootroot00000000000000[mypy] mypy_path = ./stubs show_traceback = True ignore_missing_imports = True volatility3-1.0.1/setup.py000066400000000000000000000044561405267600400155230ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import setuptools from volatility3.framework import constants with open("README.md", "r", encoding="utf-8") as fh: long_description = fh.read() setuptools.setup(name = "volatility3", description = "Memory forensics framework", version = constants.PACKAGE_VERSION, license = "VSL", keywords = "volatility memory forensics framework windows linux volshell", author = "Volatility Foundation", long_description = long_description, long_description_content_type = "text/markdown", author_email = "volatility@volatilityfoundation.org", url = "https://github.com/volatilityfoundation/volatility3/", project_urls = { "Bug Tracker": "https://github.com/volatilityfoundation/volatility3/issues", "Documentation": "https://volatility3.readthedocs.io/", "Source Code": "https://github.com/volatilityfoundation/volatility3", }, python_requires = '>=3.5.3', include_package_data = True, exclude_package_data = { '': ['development', 'development.*'], 'development': ['*'] }, packages = setuptools.find_packages(exclude = ["development", "development.*"]), entry_points = { 'console_scripts': [ 'vol = volatility3.cli:main', 'volshell = volatility3.cli.volshell:main', ], }, install_requires = ["pefile"], extras_require = { 'jsonschema': ["jsonschema>=2.3.0"], 'yara': ["yara-python>=3.8.0"], 'crypto': ["pycryptodome>=3"], 'disasm': ["capstone;platform_system=='Linux'", "capstone-windows;platform_system=='Windows'"], 'doc': ["sphinx>=1.8.2", "sphinx_autodoc_typehints>=1.4.0", "sphinx-rtd-theme>=0.4.3"], }) volatility3-1.0.1/vol.py000077500000000000000000000004421405267600400151550ustar00rootroot00000000000000#!/usr/bin/env python3 # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import volatility3.cli if __name__ == '__main__': volatility3.cli.main() volatility3-1.0.1/vol.spec000066400000000000000000000124571405267600400154650ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import os import sys from PyInstaller.building.api import PYZ, EXE from PyInstaller.building.build_main import Analysis from PyInstaller.utils.hooks import collect_submodules, collect_data_files, collect_dynamic_libs block_cipher = None # NOTE: Issues with default pyinstaller build: # jsonschema: # - https://github.com/pyinstaller/pyinstaller/issues/4100 # - https://github.com/pyinstaller/pyinstaller/pull/4168 binaries = [] try: import capstone binaries = collect_dynamic_libs('capstone') except ImportError: pass # Volatility must be findable in sys.path in order for collect_submodules to work # This adds the current working directory, which should usually do the trick sys.path.append(os.getcwd()) vol_analysis = Analysis(['vol.py'], pathex = [], binaries = binaries, datas = collect_data_files('volatility3.framework') + \ collect_data_files('volatility3.framework.automagic', include_py_files = True) + \ collect_data_files('volatility3.framework.plugins', include_py_files = True) + \ collect_data_files('volatility3.framework.layers', include_py_files = True) + \ collect_data_files('volatility3.schemas') + \ collect_data_files('volatility3.plugins', include_py_files = True), hiddenimports = collect_submodules('volatility3.framework.automagic') + \ collect_submodules('volatility3.framework.plugins') + \ collect_submodules('volatility3.framework.symbols'), hookspath = [], runtime_hooks = [], excludes = [], win_no_prefer_redirects = False, win_private_assemblies = False, cipher = block_cipher, noarchive = False) ###### # Multipackage spec files are broken in pyinstaller 3.0 (see bug 1527) ###### # The following can be uncommented once multipackage spec files work again # volshell_analysis = Analysis(['volshell.py'], # pathex = [], # binaries = [], # datas = collect_data_files('volatility3.framework') + \ # collect_data_files('volatility3.framework.automagic', include_py_files = True) + \ # collect_data_files('volatility3.framework.plugins', include_py_files = True) + \ # collect_data_files('volatility3.framework.layers', include_py_files = True) + \ # collect_data_files('volatility3.cli', include_py_files = True) + \ # collect_data_files('volatility3.schemas') + \ # collect_data_files('volatility3.plugins', include_py_files = True), # hiddenimports = collect_submodules('volatility3.framework.automagic') + \ # collect_submodules('volatility3.framework.plugins') + \ # collect_submodules('volatility3.framework.symbols'), # hookspath = [], # runtime_hooks = [], # excludes = [], # win_no_prefer_redirects = False, # win_private_assemblies = False, # cipher = block_cipher, # noarchive = False) # MERGE((vol_analysis, 'vol', 'vol'), (volshell_analysis, 'volshell', 'volshell')) vol_pyz = PYZ(vol_analysis.pure, vol_analysis.zipped_data, cipher = block_cipher) vol_exe = EXE(vol_pyz, vol_analysis.scripts, vol_analysis.binaries, vol_analysis.zipfiles, vol_analysis.datas, [('u', None, 'OPTION')], name = 'vol', icon = os.path.join('doc', 'source', '_static', 'favicon.ico'), debug = False, bootloader_ignore_signals = False, strip = False, upx = True, runtime_tmpdir = None, console = True) # volshell_pyz = PYZ(volshell_analysis.pure, volshell_analysis.zipped_data, # cipher = block_cipher) # volshell_exe = EXE(volshell_pyz, # volshell_analysis.scripts, # volshell_analysis.binaries, # volshell_analysis.zipfiles, # volshell_analysis.datas, # [('u', None, 'OPTION')], # name = 'vol', # icon = os.path.join('doc', 'source', '_static', 'favicon.ico'), # debug = False, # bootloader_ignore_signals = False, # strip = False, # upx = True, # runtime_tmpdir = None, # console = True) volatility3-1.0.1/volatility3/000077500000000000000000000000001405267600400162635ustar00rootroot00000000000000volatility3-1.0.1/volatility3/__init__.py000066400000000000000000000051161405267600400203770ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """Volatility 3 - An open-source memory forensics framework""" import inspect import sys from importlib import abc from typing import List, TypeVar, Callable, Any, Optional _T = TypeVar("_T") _S = TypeVar("_S") class classproperty(property): """Class property decorator. Note this will change the return type """ def __init__(self, func: Callable[[_S], _T]) -> None: self._func = func super().__init__() def __get__(self, obj: Any, type: Optional[_S] = None) -> _T: if type is not None: return self._func(type) raise TypeError("Classproperty was not applied properly") class WarningFindSpec(abc.MetaPathFinder): """Checks import attempts and throws a warning if the name shouldn't be used.""" @staticmethod def find_spec(fullname: str, path: Optional[List[str]], target: None = None, **kwargs) -> None: """Mock find_spec method that just checks the name, this must go first.""" if fullname.startswith("volatility3.framework.plugins."): warning = "Please do not use the volatility3.framework.plugins namespace directly, only use volatility3.plugins" # Pyinstaller uses walk_packages to import, but needs to read the modules to figure out dependencies # As such, we only print the warning when directly imported rather than from within walk_packages if inspect.stack()[-2].function != 'walk_packages': raise Warning(warning) warning_find_spec = [WarningFindSpec()] # type: List[abc.MetaPathFinder] sys.meta_path = warning_find_spec + sys.meta_path # We point the volatility3.plugins __path__ variable at BOTH # volatility3/plugins # volatility3/framework/plugins # in that order. # # This will allow our users to override any component of any plugin without monkey patching, # but it also allows us to clear out the plugins directory to get back to proper functionality. # This offered the greatest flexibility for users whilst allowing us to keep the core separate and clean. # # This means that all plugins should be imported as volatility3.plugins (otherwise they'll be imported twice, # once as volatility3.plugins.NAME and once as volatility3.framework.plugins.NAME). We therefore throw an error # if anyone tries to import anything under the volatility3.framework.plugins.* namespace # # The remediation is to only ever import form volatility3.plugins instead. volatility3-1.0.1/volatility3/cli/000077500000000000000000000000001405267600400170325ustar00rootroot00000000000000volatility3-1.0.1/volatility3/cli/__init__.py000066400000000000000000000671501405267600400211540ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """A CommandLine User Interface for the volatility framework. User interfaces make use of the framework to: * determine available plugins * request necessary information for those plugins from the user * determine what "automagic" modules will be used to populate information the user does not provide * run the plugin * display the results """ import argparse import inspect import io import json import logging import os import sys import tempfile import traceback from typing import Dict, Type, Union, Any from urllib import parse, request import volatility3.plugins import volatility3.symbols from volatility3 import framework from volatility3.cli import text_renderer, volargparse from volatility3.framework import automagic, constants, contexts, exceptions, interfaces, plugins, configuration from volatility3.framework.automagic import stacker from volatility3.framework.configuration import requirements # Make sure we log everything vollog = logging.getLogger() console = logging.StreamHandler() console.setLevel(logging.WARNING) formatter = logging.Formatter('%(levelname)-8s %(name)-12s: %(message)s') # Trim the console down by default console.setFormatter(formatter) class PrintedProgress(object): """A progress handler that prints the progress value and the description onto the command line.""" def __init__(self): self._max_message_len = 0 def __call__(self, progress: Union[int, float], description: str = None): """A simple function for providing text-based feedback. .. warning:: Only for development use. Args: progress: Percentage of progress of the current procedure """ message = "\rProgress: {0: 7.2f}\t\t{1:}".format(round(progress, 2), description or '') message_len = len(message) self._max_message_len = max([self._max_message_len, message_len]) sys.stderr.write(message + (' ' * (self._max_message_len - message_len)) + '\r') class MuteProgress(PrintedProgress): """A dummy progress handler that produces no output when called.""" def __call__(self, progress: Union[int, float], description: str = None): pass class CommandLine: """Constructs a command-line interface object for users to run plugins.""" CLI_NAME = 'volatility' def __init__(self): self.setup_logging() self.output_dir = None @classmethod def setup_logging(cls): # Delay the setting of vollog for those that want to import volatility3.cli (issue #241) vollog.setLevel(1) vollog.addHandler(console) def run(self): """Executes the command line module, taking the system arguments, determining the plugin to run and then running it.""" volatility3.framework.require_interface_version(1, 0, 0) renderers = dict([(x.name.lower(), x) for x in framework.class_subclasses(text_renderer.CLIRenderer)]) parser = volargparse.HelpfulArgParser(add_help = False, prog = self.CLI_NAME, description = "An open-source memory forensics framework") parser.add_argument( "-h", "--help", action = "help", default = argparse.SUPPRESS, help = "Show this help message and exit, for specific plugin options use '{} --help'".format( parser.prog)) parser.add_argument("-c", "--config", help = "Load the configuration from a json file", default = None, type = str) parser.add_argument("--parallelism", help = "Enables parallelism (defaults to off if no argument given)", nargs = '?', choices = ['processes', 'threads', 'off'], const = 'processes', default = None, type = str) parser.add_argument("-e", "--extend", help = "Extend the configuration with a new (or changed) setting", default = None, action = 'append') parser.add_argument("-p", "--plugin-dirs", help = "Semi-colon separated list of paths to find plugins", default = "", type = str) parser.add_argument("-s", "--symbol-dirs", help = "Semi-colon separated list of paths to find symbols", default = "", type = str) parser.add_argument("-v", "--verbosity", help = "Increase output verbosity", default = 0, action = "count") parser.add_argument("-l", "--log", help = "Log output to a file as well as the console", default = None, type = str) parser.add_argument("-o", "--output-dir", help = "Directory in which to output any generated files", default = os.getcwd(), type = str) parser.add_argument("-q", "--quiet", help = "Remove progress feedback", default = False, action = 'store_true') parser.add_argument("-r", "--renderer", metavar = 'RENDERER', help = "Determines how to render the output ({})".format(", ".join(list(renderers))), default = "quick", choices = list(renderers)) parser.add_argument("-f", "--file", metavar = 'FILE', default = None, type = str, help = "Shorthand for --single-location=file:// if single-location is not defined") parser.add_argument("--write-config", help = "Write configuration JSON file out to config.json", default = False, action = 'store_true') parser.add_argument("--clear-cache", help = "Clears out all short-term cached items", default = False, action = 'store_true') # We have to filter out help, otherwise parse_known_args will trigger the help message before having # processed the plugin choice or had the plugin subparser added. known_args = [arg for arg in sys.argv if arg != '--help' and arg != '-h'] partial_args, _ = parser.parse_known_args(known_args) banner_output = sys.stdout if renderers[partial_args.renderer].structured_output: banner_output = sys.stderr banner_output.write("Volatility 3 Framework {}\n".format(constants.PACKAGE_VERSION)) if partial_args.plugin_dirs: volatility3.plugins.__path__ = [os.path.abspath(p) for p in partial_args.plugin_dirs.split(";")] + constants.PLUGINS_PATH if partial_args.symbol_dirs: volatility3.symbols.__path__ = [os.path.abspath(p) for p in partial_args.symbol_dirs.split(";")] + constants.SYMBOL_BASEPATHS if partial_args.log: file_logger = logging.FileHandler(partial_args.log) file_logger.setLevel(1) file_formatter = logging.Formatter(datefmt = '%y-%m-%d %H:%M:%S', fmt = '%(asctime)s %(name)-12s %(levelname)-8s %(message)s') file_logger.setFormatter(file_formatter) vollog.addHandler(file_logger) vollog.info("Logging started") if partial_args.verbosity < 3: console.setLevel(30 - (partial_args.verbosity * 10)) else: console.setLevel(10 - (partial_args.verbosity - 2)) vollog.info("Volatility plugins path: {}".format(volatility3.plugins.__path__)) vollog.info("Volatility symbols path: {}".format(volatility3.symbols.__path__)) # Set the PARALLELISM if partial_args.parallelism == 'processes': constants.PARALLELISM = constants.Parallelism.Multiprocessing elif partial_args.parallelism == 'threads': constants.PARALLELISM = constants.Parallelism.Threading else: constants.PARALLELISM = constants.Parallelism.Off if partial_args.clear_cache: framework.clear_cache() # Do the initialization ctx = contexts.Context() # Construct a blank context failures = framework.import_files(volatility3.plugins, True) # Will not log as console's default level is WARNING if failures: parser.epilog = "The following plugins could not be loaded (use -vv to see why): " + \ ", ".join(sorted(failures)) vollog.info(parser.epilog) automagics = automagic.available(ctx) plugin_list = framework.list_plugins() seen_automagics = set() chosen_configurables_list = {} for amagic in automagics: if amagic in seen_automagics: continue seen_automagics.add(amagic) if isinstance(amagic, interfaces.configuration.ConfigurableInterface): self.populate_requirements_argparse(parser, amagic.__class__) subparser = parser.add_subparsers(title = "Plugins", dest = "plugin", description = "For plugin specific options, run '{} --help'".format( self.CLI_NAME), action = volargparse.HelpfulSubparserAction) for plugin in sorted(plugin_list): plugin_parser = subparser.add_parser(plugin, help = plugin_list[plugin].__doc__) self.populate_requirements_argparse(plugin_parser, plugin_list[plugin]) ### # PASS TO UI ### # Hand the plugin requirements over to the CLI (us) and let it construct the config tree # Run the argparser args = parser.parse_args() if args.plugin is None: parser.error("Please select a plugin to run") vollog.log(constants.LOGLEVEL_VVV, "Cache directory used: {}".format(constants.CACHE_PATH)) plugin = plugin_list[args.plugin] chosen_configurables_list[args.plugin] = plugin base_config_path = "plugins" plugin_config_path = interfaces.configuration.path_join(base_config_path, plugin.__name__) # Special case the -f argument because people use is so frequently # It has to go here so it can be overridden by single-location if it's defined # NOTE: This will *BREAK* if LayerStacker, or the automagic configuration system, changes at all ### if args.file: file_name = os.path.abspath(args.file) if not os.path.exists(file_name): vollog.log(logging.INFO, "File does not exist: {}".format(file_name)) else: single_location = "file:" + request.pathname2url(file_name) ctx.config['automagic.LayerStacker.single_location'] = single_location # UI fills in the config, here we load it from the config file and do it before we process the CL parameters if args.config: with open(args.config, "r") as f: json_val = json.load(f) ctx.config.splice(plugin_config_path, interfaces.configuration.HierarchicalDict(json_val)) # It should be up to the UI to determine which automagics to run, so this is before BACK TO THE FRAMEWORK automagics = automagic.choose_automagic(automagics, plugin) for amagic in automagics: chosen_configurables_list[amagic.__class__.__name__] = amagic if ctx.config.get('automagic.LayerStacker.stackers', None) is None: ctx.config['automagic.LayerStacker.stackers'] = stacker.choose_os_stackers(plugin) self.output_dir = args.output_dir if not os.path.exists(self.output_dir): parser.error("The output directory specified does not exist: {}".format(self.output_dir)) self.populate_config(ctx, chosen_configurables_list, args, plugin_config_path) if args.extend: for extension in args.extend: if '=' not in extension: raise ValueError("Invalid extension (extensions must be of the format \"conf.path.value='value'\")") address, value = extension[:extension.find('=')], json.loads(extension[extension.find('=') + 1:]) ctx.config[address] = value ### # BACK TO THE FRAMEWORK ### constructed = None try: progress_callback = PrintedProgress() if args.quiet: progress_callback = MuteProgress() constructed = plugins.construct_plugin(ctx, automagics, plugin, base_config_path, progress_callback, self.file_handler_class_factory()) if args.write_config: vollog.debug("Writing out configuration data to config.json") with open("config.json", "w") as f: json.dump(dict(constructed.build_configuration()), f, sort_keys = True, indent = 2) except exceptions.UnsatisfiedException as excp: self.process_unsatisfied_exceptions(excp) parser.exit(1, "Unable to validate the plugin requirements: {}\n".format([x for x in excp.unsatisfied])) try: # Construct and run the plugin if constructed: renderers[args.renderer]().render(constructed.run()) except (exceptions.VolatilityException) as excp: self.process_exceptions(excp) def process_exceptions(self, excp): """Provide useful feedback if an exception occurs during a run of a plugin.""" # Ensure there's nothing in the cache sys.stdout.write("\n\n") sys.stdout.flush() sys.stderr.flush() # Log the full exception at a high level for easy access fulltrace = traceback.TracebackException.from_exception(excp).format(chain = True) vollog.debug("".join(fulltrace)) if isinstance(excp, exceptions.InvalidAddressException): general = "Volatility was unable to read a requested page:" if isinstance(excp, exceptions.SwappedInvalidAddressException): detail = "Swap error {} in layer {} ({})".format(hex(excp.invalid_address), excp.layer_name, excp) caused_by = [ "No suitable swap file having been provided (locate and provide the correct swap file)", "An intentionally invalid page (operating system protection)" ] elif isinstance(excp, exceptions.PagedInvalidAddressException): detail = "Page error {} in layer {} ({})".format(hex(excp.invalid_address), excp.layer_name, excp) caused_by = [ "Memory smear during acquisition (try re-acquiring if possible)", "An intentionally invalid page lookup (operating system protection)", "A bug in the plugin/volatility3 (re-run with -vvv and file a bug)" ] else: detail = "{} in layer {} ({})".format(hex(excp.invalid_address), excp.layer_name, excp) caused_by = [ "The base memory file being incomplete (try re-acquiring if possible)", "Memory smear during acquisition (try re-acquiring if possible)", "An intentionally invalid page lookup (operating system protection)", "A bug in the plugin/volatility3 (re-run with -vvv and file a bug)" ] elif isinstance(excp, exceptions.SymbolError): general = "Volatility experienced a symbol-related issue:" detail = "{}{}{}: {}".format(excp.table_name, constants.BANG, excp.symbol_name, excp) caused_by = [ "An invalid symbol table", "A plugin requesting a bad symbol", "A plugin requesting a symbol from the wrong table", ] elif isinstance(excp, exceptions.SymbolSpaceError): general = "Volatility experienced an issue related to a symbol table:" detail = "{}".format(excp) caused_by = [ "An invalid symbol table", "A plugin requesting a bad symbol", "A plugin requesting a symbol from the wrong table" ] elif isinstance(excp, exceptions.LayerException): general = "Volatility experienced a layer-related issue: {}".format(excp.layer_name) detail = "{}".format(excp) caused_by = ["A faulty layer implementation (re-run with -vvv and file a bug)"] elif isinstance(excp, exceptions.MissingModuleException): general = "Volatility could not import a necessary module: {}".format(excp.module) detail = "{}".format(excp) caused_by = ["A required python module is not installed (install the module and re-run)"] else: general = "Volatilty encountered an unexpected situation." detail = "" caused_by = [ "Please re-run using with -vvv and file a bug with the output", "at {}".format(constants.BUG_URL) ] # Code that actually renders the exception output = sys.stderr output.write(general + "\n") output.write(detail + "\n\n") for cause in caused_by: output.write("\t* " + cause + "\n") output.write("\nNo further results will be produced\n") sys.exit(1) def process_unsatisfied_exceptions(self, excp): """Provide useful feedback if an exception occurs during requirement fulfillment.""" # Add a blank newline print("") translation_failed = False symbols_failed = False for config_path in excp.unsatisfied: translation_failed = translation_failed or isinstance( excp.unsatisfied[config_path], configuration.requirements.TranslationLayerRequirement) symbols_failed = symbols_failed or isinstance(excp.unsatisfied[config_path], configuration.requirements.SymbolTableRequirement) print("Unsatisfied requirement {}: {}".format(config_path, excp.unsatisfied[config_path].description)) if symbols_failed: print("\nA symbol table requirement was not fulfilled. Please verify that:\n" "\tYou have the correct symbol file for the requirement\n" "\tThe symbol file is under the correct directory or zip file\n" "\tThe symbol file is named appropriately or contains the correct banner\n") if translation_failed: print("\nA translation layer requirement was not fulfilled. Please verify that:\n" "\tA file was provided to create this layer (by -f, --single-location or by config)\n" "\tThe file exists and is readable\n" "\tThe necessary symbols are present and identified by volatility3") def populate_config(self, context: interfaces.context.ContextInterface, configurables_list: Dict[str, Type[interfaces.configuration.ConfigurableInterface]], args: argparse.Namespace, plugin_config_path: str) -> None: """Populate the context config based on the returned args. We have already determined these elements must be descended from ConfigurableInterface Args: context: The volatility3 context to operate on configurables_list: A dictionary of configurable items that can be configured on the plugin args: An object containing the arguments necessary plugin_config_path: The path within the context's config containing the plugin's configuration """ vargs = vars(args) for configurable in configurables_list: for requirement in configurables_list[configurable].get_requirements(): value = vargs.get(requirement.name, None) if value is not None: if isinstance(requirement, requirements.URIRequirement): if isinstance(value, str): scheme = parse.urlparse(value).scheme if not scheme or len(scheme) <= 1: if not os.path.exists(value): raise FileNotFoundError( "Non-existant file {} passed to URIRequirement".format(value)) value = "file://" + request.pathname2url(os.path.abspath(value)) if isinstance(requirement, requirements.ListRequirement): if not isinstance(value, list): raise TypeError("Configuration for ListRequirement was not a list: {}".format( requirement.name)) value = [requirement.element_type(x) for x in value] if not inspect.isclass(configurables_list[configurable]): config_path = configurables_list[configurable].config_path else: # We must be the plugin, so name it appropriately: config_path = plugin_config_path extended_path = interfaces.configuration.path_join(config_path, requirement.name) context.config[extended_path] = value def file_handler_class_factory(self, direct = True): output_dir = self.output_dir class CLIFileHandler(interfaces.plugins.FileHandlerInterface): def _get_final_filename(self): """Gets the final filename""" if output_dir is None: raise TypeError("Output directory is not a string") os.makedirs(output_dir, exist_ok = True) pref_name_array = self.preferred_filename.split('.') filename, extension = os.path.join(output_dir, '.'.join(pref_name_array[:-1])), pref_name_array[-1] output_filename = "{}.{}".format(filename, extension) counter = 1 while os.path.exists(output_filename): output_filename = "{}-{}.{}".format(filename, counter, extension) counter += 1 return output_filename class CLIMemFileHandler(io.BytesIO, CLIFileHandler): def __init__(self, filename: str): io.BytesIO.__init__(self) CLIFileHandler.__init__(self, filename) def close(self): # Don't overcommit if self.closed: return self.seek(0) output_filename = self._get_final_filename() with open(output_filename, "wb") as current_file: current_file.write(self.read()) self._committed = True vollog.log(logging.INFO, "Saved stored plugin file: {}".format(output_filename)) super().close() class CLIDirectFileHandler(CLIFileHandler): def __init__(self, filename: str): fd, self._name = tempfile.mkstemp(suffix = '.vol3', prefix = 'tmp_', dir = output_dir) self._file = io.open(fd, mode = 'w+b') CLIFileHandler.__init__(self, filename) for item in dir(self._file): if not item.startswith('_') and not item in ['closed', 'close', 'mode', 'name']: setattr(self, item, getattr(self._file, item)) def __getattr__(self, item): return getattr(self._file, item) @property def closed(self): return self._file.closed @property def mode(self): return self._file.mode @property def name(self): return self._file.name def close(self): """Closes and commits the file (by moving the temporary file to the correct name""" # Don't overcommit if self._file.closed: return self._file.close() output_filename = self._get_final_filename() os.rename(self._name, output_filename) if direct: return CLIDirectFileHandler else: return CLIMemFileHandler def populate_requirements_argparse(self, parser: Union[argparse.ArgumentParser, argparse._ArgumentGroup], configurable: Type[interfaces.configuration.ConfigurableInterface]): """Adds the plugin's simple requirements to the provided parser. Args: parser: The parser to add the plugin's (simple) requirements to configurable: The plugin object to pull the requirements from """ if not issubclass(configurable, interfaces.configuration.ConfigurableInterface): raise TypeError("Expected ConfigurableInterface type, not: {}".format(type(configurable))) # Construct an argparse group for requirement in configurable.get_requirements(): additional = {} # type: Dict[str, Any] if not isinstance(requirement, interfaces.configuration.RequirementInterface): raise TypeError("Plugin contains requirements that are not RequirementInterfaces: {}".format( configurable.__name__)) if isinstance(requirement, interfaces.configuration.SimpleTypeRequirement): additional["type"] = requirement.instance_type if isinstance(requirement, requirements.IntRequirement): additional["type"] = lambda x: int(x, 0) if isinstance(requirement, requirements.BooleanRequirement): additional["action"] = "store_true" if "type" in additional: del additional["type"] elif isinstance(requirement, volatility3.framework.configuration.requirements.ListRequirement): additional["type"] = requirement.element_type nargs = '*' if requirement.optional else '+' additional["nargs"] = nargs elif isinstance(requirement, volatility3.framework.configuration.requirements.ChoiceRequirement): additional["type"] = str additional["choices"] = requirement.choices else: continue parser.add_argument("--" + requirement.name.replace('_', '-'), help = requirement.description, default = requirement.default, dest = requirement.name, required = not requirement.optional, **additional) def main(): """A convenience function for constructing and running the :class:`CommandLine`'s run method.""" CommandLine().run() volatility3-1.0.1/volatility3/cli/text_renderer.py000066400000000000000000000341561405267600400222670ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import datetime import json import logging import random import string import sys from functools import wraps from typing import Callable, Any, List, Tuple, Dict from volatility3.framework import interfaces, renderers from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) try: CAPSTONE_PRESENT = True import capstone except ImportError: CAPSTONE_PRESENT = False vollog.debug("Disassembly library capstone not found") def hex_bytes_as_text(value: bytes) -> str: """Renders HexBytes as text. Args: value: A series of bytes to convert to text Returns: A text representation of the hexadecimal bytes plus their ascii equivalents, separated by newline characters """ if not isinstance(value, bytes): raise TypeError("hex_bytes_as_text takes bytes not: {}".format(type(value))) ascii = [] hex = [] count = 0 output = "" for byte in value: hex.append("{:02x}".format(byte)) ascii.append(chr(byte) if 0x20 < byte <= 0x7E else ".") if (count % 8) == 7: output += "\n" output += " ".join(hex[count - 7:count + 1]) output += "\t" output += "".join(ascii[count - 7:count + 1]) count += 1 return output def multitypedata_as_text(value: format_hints.MultiTypeData) -> str: """Renders the bytes as a string where possible, otherwise it displays hex data This attempts to convert the string based on its encoding and if no data's been lost due to the split on the null character, then it displays it as is """ if value.show_hex: return hex_bytes_as_text(value) string_representation = str(value, encoding = value.encoding, errors = 'replace') if value.split_nulls and ((len(value) / 2 - 1) <= len(string_representation) <= (len(value) / 2)): return "\n".join(string_representation.split("\x00")) if len(string_representation) - 1 <= len(string_representation.split("\x00")[0]) <= len(string_representation): return string_representation.split("\x00")[0] return hex_bytes_as_text(value) def optional(func: Callable) -> Callable: @wraps(func) def wrapped(x: Any) -> str: if isinstance(x, interfaces.renderers.BaseAbsentValue): if isinstance(x, renderers.NotApplicableValue): return "N/A" else: return "-" return func(x) return wrapped def quoted_optional(func: Callable) -> Callable: @wraps(func) def wrapped(x: Any) -> str: result = optional(func)(x) if result == "-" or result == "N/A": return "" if isinstance(x, format_hints.MultiTypeData) and x.converted_int: return "{}".format(result) if isinstance(x, int) and not isinstance(x, (format_hints.Hex, format_hints.Bin)): return "{}".format(result) return "\"{}\"".format(result) return wrapped def display_disassembly(disasm: interfaces.renderers.Disassembly) -> str: """Renders a disassembly renderer type into string format. Args: disasm: Input disassembly objects Returns: A string as rendererd by capstone where available, otherwise output as if it were just bytes """ if CAPSTONE_PRESENT: disasm_types = { 'intel': capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_32), 'intel64': capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_64), 'arm': capstone.Cs(capstone.CS_ARCH_ARM, capstone.CS_MODE_ARM), 'arm64': capstone.Cs(capstone.CS_ARCH_ARM64, capstone.CS_MODE_ARM) } output = "" if disasm.architecture is not None: for i in disasm_types[disasm.architecture].disasm(disasm.data, disasm.offset): output += "\n0x%x:\t%s\t%s" % (i.address, i.mnemonic, i.op_str) return output return QuickTextRenderer._type_renderers[bytes](disasm.data) class CLIRenderer(interfaces.renderers.Renderer): """Class to add specific requirements for CLI renderers.""" name = "unnamed" structured_output = False class QuickTextRenderer(CLIRenderer): _type_renderers = { format_hints.Bin: optional(lambda x: "0b{:b}".format(x)), format_hints.Hex: optional(lambda x: "0x{:x}".format(x)), format_hints.HexBytes: optional(hex_bytes_as_text), format_hints.MultiTypeData: quoted_optional(multitypedata_as_text), interfaces.renderers.Disassembly: optional(display_disassembly), bytes: optional(lambda x: " ".join(["{0:02x}".format(b) for b in x])), datetime.datetime: optional(lambda x: x.strftime("%Y-%m-%d %H:%M:%S.%f %Z")), 'default': optional(lambda x: "{}".format(x)) } name = "quick" def get_render_options(self): pass def render(self, grid: interfaces.renderers.TreeGrid) -> None: """Renders each column immediately to stdout. This does not format each line's width appropriately, it merely tab separates each field Args: grid: The TreeGrid object to render """ # TODO: Docstrings # TODO: Improve text output outfd = sys.stdout line = [] for column in grid.columns: # Ignore the type because namedtuples don't realize they have accessible attributes line.append("{}".format(column.name)) outfd.write("\n{}\n".format("\t".join(line))) def visitor(node: interfaces.renderers.TreeNode, accumulator): accumulator.write("\n") # Nodes always have a path value, giving them a path_depth of at least 1, we use max just in case accumulator.write("*" * max(0, node.path_depth - 1) + ("" if (node.path_depth <= 1) else " ")) line = [] for column_index in range(len(grid.columns)): column = grid.columns[column_index] renderer = self._type_renderers.get(column.type, self._type_renderers['default']) line.append(renderer(node.values[column_index])) accumulator.write("{}".format("\t".join(line))) accumulator.flush() return accumulator if not grid.populated: grid.populate(visitor, outfd) else: grid.visit(node = None, function = visitor, initial_accumulator = outfd) outfd.write("\n") class CSVRenderer(CLIRenderer): _type_renderers = { format_hints.Bin: quoted_optional(lambda x: "0b{:b}".format(x)), format_hints.Hex: quoted_optional(lambda x: "0x{:x}".format(x)), format_hints.HexBytes: quoted_optional(hex_bytes_as_text), format_hints.MultiTypeData: quoted_optional(multitypedata_as_text), interfaces.renderers.Disassembly: quoted_optional(display_disassembly), bytes: quoted_optional(lambda x: " ".join(["{0:02x}".format(b) for b in x])), datetime.datetime: quoted_optional(lambda x: x.strftime("%Y-%m-%d %H:%M:%S.%f %Z")), 'default': quoted_optional(lambda x: "{}".format(x)) } name = "csv" structured_output = True def get_render_options(self): pass def render(self, grid: interfaces.renderers.TreeGrid) -> None: """Renders each row immediately to stdout. Args: grid: The TreeGrid object to render """ outfd = sys.stdout line = ['"TreeDepth"'] for column in grid.columns: # Ignore the type because namedtuples don't realize they have accessible attributes line.append("{}".format('"' + column.name + '"')) outfd.write("{}".format(",".join(line))) def visitor(node: interfaces.renderers.TreeNode, accumulator): accumulator.write("\n") # Nodes always have a path value, giving them a path_depth of at least 1, we use max just in case accumulator.write(str(max(0, node.path_depth - 1)) + ",") line = [] for column_index in range(len(grid.columns)): column = grid.columns[column_index] renderer = self._type_renderers.get(column.type, self._type_renderers['default']) line.append(renderer(node.values[column_index])) accumulator.write("{}".format(",".join(line))) return accumulator if not grid.populated: grid.populate(visitor, outfd) else: grid.visit(node = None, function = visitor, initial_accumulator = outfd) outfd.write("\n") class PrettyTextRenderer(CLIRenderer): _type_renderers = QuickTextRenderer._type_renderers name = "pretty" def get_render_options(self): pass def render(self, grid: interfaces.renderers.TreeGrid) -> None: """Renders each column immediately to stdout. This does not format each line's width appropriately, it merely tab separates each field Args: grid: The TreeGrid object to render """ # TODO: Docstrings # TODO: Improve text output outfd = sys.stdout sys.stderr.write("Formatting...\n") display_alignment = ">" column_separator = " | " tree_indent_column = ''.join(random.choice(string.ascii_uppercase + string.digits) for _ in range(20)) max_column_widths = dict([(column.name, len(column.name)) for column in grid.columns]) def visitor( node: interfaces.renderers.TreeNode, accumulator: List[Tuple[int, Dict[interfaces.renderers.Column, bytes]]] ) -> List[Tuple[int, Dict[interfaces.renderers.Column, bytes]]]: # Nodes always have a path value, giving them a path_depth of at least 1, we use max just in case max_column_widths[tree_indent_column] = max(max_column_widths.get(tree_indent_column, 0), node.path_depth) line = {} for column_index in range(len(grid.columns)): column = grid.columns[column_index] renderer = self._type_renderers.get(column.type, self._type_renderers['default']) data = renderer(node.values[column_index]) max_column_widths[column.name] = max(max_column_widths.get(column.name, len(column.name)), len("{}".format(data))) line[column] = data accumulator.append((node.path_depth, line)) return accumulator final_output = [] # type: List[Tuple[int, Dict[interfaces.renderers.Column, bytes]]] if not grid.populated: grid.populate(visitor, final_output) else: grid.visit(node = None, function = visitor, initial_accumulator = final_output) # Always align the tree to the left format_string_list = ["{0:<" + str(max_column_widths.get(tree_indent_column, 0)) + "s}"] for column_index in range(len(grid.columns)): column = grid.columns[column_index] format_string_list.append("{" + str(column_index + 1) + ":" + display_alignment + str(max_column_widths[column.name]) + "s}") format_string = column_separator.join(format_string_list) + "\n" column_titles = [""] + [column.name for column in grid.columns] outfd.write(format_string.format(*column_titles)) for (depth, line) in final_output: outfd.write(format_string.format("*" * depth, *[line[column] for column in grid.columns])) class JsonRenderer(CLIRenderer): _type_renderers = { format_hints.HexBytes: quoted_optional(hex_bytes_as_text), interfaces.renderers.Disassembly: quoted_optional(display_disassembly), format_hints.MultiTypeData: quoted_optional(multitypedata_as_text), bytes: optional(lambda x: " ".join(["{0:02x}".format(b) for b in x])), datetime.datetime: lambda x: x.isoformat() if not isinstance(x, interfaces.renderers.BaseAbsentValue) else None, 'default': lambda x: x } name = 'JSON' structured_output = True def get_render_options(self) -> List[interfaces.renderers.RenderOption]: pass def output_result(self, outfd, result): """Outputs the JSON data to a file in a particular format""" outfd.write(json.dumps(result, indent = 2, sort_keys = True)) def render(self, grid: interfaces.renderers.TreeGrid): outfd = sys.stdout outfd.write("\n") final_output = ( {}, []) # type: Tuple[Dict[str, List[interfaces.renderers.TreeNode]], List[interfaces.renderers.TreeNode]] def visitor( node: interfaces.renderers.TreeNode, accumulator: Tuple[Dict[str, Dict[str, Any]], List[Dict[str, Any]]] ) -> Tuple[Dict[str, Dict[str, Any]], List[Dict[str, Any]]]: # Nodes always have a path value, giving them a path_depth of at least 1, we use max just in case acc_map, final_tree = accumulator node_dict = {'__children': []} # type: Dict[str, Any] for column_index in range(len(grid.columns)): column = grid.columns[column_index] renderer = self._type_renderers.get(column.type, self._type_renderers['default']) data = renderer(list(node.values)[column_index]) if isinstance(data, interfaces.renderers.BaseAbsentValue): data = None node_dict[column.name] = data if node.parent: acc_map[node.parent.path]['__children'].append(node_dict) else: final_tree.append(node_dict) acc_map[node.path] = node_dict return (acc_map, final_tree) if not grid.populated: grid.populate(visitor, final_output) else: grid.visit(node = None, function = visitor, initial_accumulator = final_output) self.output_result(outfd, final_output[1]) class JsonLinesRenderer(JsonRenderer): name = 'JSONL' def output_result(self, outfd, result): """Outputs the JSON results as JSON lines""" for line in result: outfd.write(json.dumps(line, sort_keys = True)) outfd.write("\n") volatility3-1.0.1/volatility3/cli/volargparse.py000066400000000000000000000075661405267600400217470ustar00rootroot00000000000000# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import argparse import gettext import re from typing import List # This effectively overrides/monkeypatches the core argparse module to provide more helpful output around choices # We shouldn't really steal a private member from argparse, but otherwise we're just duplicating code # HelpfulSubparserAction gives more information about the possible choices from a subparsed choice # HelpfulArgParser gives the list of choices when no arguments are provided to a choice option whilst still using a METAVAR class HelpfulSubparserAction(argparse._SubParsersAction): """Class to either select a unique plugin based on a substring, or identify the alternatives.""" def __init__(self, *args, **kwargs) -> None: super().__init__(*args, **kwargs) # We don't want the action self-check to kick in, so we remove the choices list, the check happens in __call__ self.choices = None def __call__(self, parser: 'HelpfulArgParser', namespace: argparse.Namespace, values: List[str], option_string: None = None) -> None: parser_name = values[0] arg_strings = values[1:] # set the parser name if requested if self.dest != argparse.SUPPRESS: setattr(namespace, self.dest, parser_name) matched_parsers = [name for name in self._name_parser_map if parser_name in name] if len(matched_parsers) < 1: msg = 'invalid choice {} (choose from {})'.format(parser_name, ', '.join(self._name_parser_map)) raise argparse.ArgumentError(self, msg) if len(matched_parsers) > 1: msg = 'plugin {} matches multiple plugins ({})'.format(parser_name, ', '.join(matched_parsers)) raise argparse.ArgumentError(self, msg) parser = self._name_parser_map[matched_parsers[0]] setattr(namespace, 'plugin', matched_parsers[0]) # parse all the remaining options into the namespace # store any unrecognized options on the object, so that the top # level parser can decide what to do with them # In case this subparser defines new defaults, we parse them # in a new namespace object and then update the original # namespace for the relevant parts. subnamespace, arg_strings = parser.parse_known_args(arg_strings, None) for key, value in vars(subnamespace).items(): setattr(namespace, key, value) if arg_strings: vars(namespace).setdefault(argparse._UNRECOGNIZED_ARGS_ATTR, []) getattr(namespace, argparse._UNRECOGNIZED_ARGS_ATTR).extend(arg_strings) class HelpfulArgParser(argparse.ArgumentParser): def _match_argument(self, action, arg_strings_pattern) -> int: # match the pattern for this action to the arg strings nargs_pattern = self._get_nargs_pattern(action) match = re.match(nargs_pattern, arg_strings_pattern) # raise an exception if we weren't able to find a match if match is None: nargs_errors = { None: gettext.gettext('expected one argument'), argparse.OPTIONAL: gettext.gettext('expected at most one argument'), argparse.ONE_OR_MORE: gettext.gettext('expected at least one argument'), } msg = nargs_errors.get(action.nargs) if msg is None: msg = gettext.ngettext('expected %s argument', 'expected %s arguments', action.nargs) % action.nargs if action.choices: msg = "{} (from: {})".format(msg, ", ".join(action.choices)) raise argparse.ArgumentError(action, msg) # return the number of arguments matched return len(match.group(1)) volatility3-1.0.1/volatility3/cli/volshell/000077500000000000000000000000001405267600400206625ustar00rootroot00000000000000volatility3-1.0.1/volatility3/cli/volshell/__init__.py000066400000000000000000000266021405267600400230010ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import argparse import json import logging import os import sys from urllib import request import volatility3.plugins import volatility3.symbols from volatility3 import cli, framework from volatility3.cli.volshell import generic, windows, linux, mac from volatility3.framework import automagic, constants, contexts, exceptions, interfaces, plugins # Make sure we log everything vollog = logging.getLogger() vollog.setLevel(0) # Trim the console down by default console = logging.StreamHandler() console.setLevel(logging.WARNING) formatter = logging.Formatter('%(levelname)-8s %(name)-12s: %(message)s') console.setFormatter(formatter) vollog.addHandler(console) class VolShell(cli.CommandLine): """Program to allow interactive interaction with a memory image. This allows a memory image to be examined through an interactive python terminal with all the volatility support calls available. """ CLI_NAME = "volshell" def __init__(self): super().__init__() self.output_dir = None def run(self): """Executes the command line module, taking the system arguments, determining the plugin to run and then running it.""" sys.stdout.write("Volshell (Volatility 3 Framework) {}\n".format(constants.PACKAGE_VERSION)) framework.require_interface_version(1, 0, 0) parser = argparse.ArgumentParser(prog = self.CLI_NAME, description = "A tool for interactivate forensic analysis of memory images") parser.add_argument("-c", "--config", help = "Load the configuration from a json file", default = None, type = str) parser.add_argument("-e", "--extend", help = "Extend the configuration with a new (or changed) setting", default = None, action = 'append') parser.add_argument("-p", "--plugin-dirs", help = "Semi-colon separated list of paths to find plugins", default = "", type = str) parser.add_argument("-s", "--symbol-dirs", help = "Semi-colon separated list of paths to find symbols", default = "", type = str) parser.add_argument("-v", "--verbosity", help = "Increase output verbosity", default = 0, action = "count") parser.add_argument("-o", "--output-dir", help = "Directory in which to output any generated files", default = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', '..')), type = str) parser.add_argument("-q", "--quiet", help = "Remove progress feedback", default = False, action = 'store_true') parser.add_argument("--log", help = "Log output to a file as well as the console", default = None, type = str) parser.add_argument("-f", "--file", metavar = 'FILE', default = None, type = str, help = "Shorthand for --single-location=file:// if single-location is not defined") parser.add_argument("--write-config", help = "Write configuration JSON file out to config.json", default = False, action = 'store_true') parser.add_argument("--clear-cache", help = "Clears out all short-term cached items", default = False, action = 'store_true') # Volshell specific flags os_specific = parser.add_mutually_exclusive_group(required = False) os_specific.add_argument("-w", "--windows", default = False, action = "store_true", help = "Run a Windows volshell") os_specific.add_argument("-l", "--linux", default = False, action = "store_true", help = "Run a Linux volshell") os_specific.add_argument("-m", "--mac", default = False, action = "store_true", help = "Run a Mac volshell") # We have to filter out help, otherwise parse_known_args will trigger the help message before having # processed the plugin choice or had the plugin subparser added. known_args = [arg for arg in sys.argv if arg != '--help' and arg != '-h'] partial_args, _ = parser.parse_known_args(known_args) if partial_args.plugin_dirs: volatility3.plugins.__path__ = [os.path.abspath(p) for p in partial_args.plugin_dirs.split(";")] + constants.PLUGINS_PATH if partial_args.symbol_dirs: volatility3.symbols.__path__ = [os.path.abspath(p) for p in partial_args.symbol_dirs.split(";")] + constants.SYMBOL_BASEPATHS vollog.info("Volatility plugins path: {}".format(volatility3.plugins.__path__)) vollog.info("Volatility symbols path: {}".format(volatility3.symbols.__path__)) if partial_args.log: file_logger = logging.FileHandler(partial_args.log) file_logger.setLevel(0) file_formatter = logging.Formatter(datefmt = '%y-%m-%d %H:%M:%S', fmt = '%(asctime)s %(name)-12s %(levelname)-8s %(message)s') file_logger.setFormatter(file_formatter) vollog.addHandler(file_logger) vollog.info("Logging started") if partial_args.verbosity < 3: console.setLevel(30 - (partial_args.verbosity * 10)) else: console.setLevel(10 - (partial_args.verbosity - 2)) if partial_args.clear_cache: for cache_filename in glob.glob(os.path.join(constants.CACHE_PATH, '*.cache')): os.unlink(cache_filename) # Do the initialization ctx = contexts.Context() # Construct a blank context failures = framework.import_files(volatility3.plugins, True) # Will not log as console's default level is WARNING if failures: parser.epilog = "The following plugins could not be loaded (use -vv to see why): " + \ ", ".join(sorted(failures)) vollog.info(parser.epilog) automagics = automagic.available(ctx) # Initialize the list of plugins in case volshell needs it framework.list_plugins() seen_automagics = set() configurables_list = {} for amagic in automagics: if amagic in seen_automagics: continue seen_automagics.add(amagic) if isinstance(amagic, interfaces.configuration.ConfigurableInterface): self.populate_requirements_argparse(parser, amagic.__class__) configurables_list[amagic.__class__.__name__] = amagic # We don't list plugin arguments, because they can be provided within python volshell_plugin_list = {'generic': generic.Volshell, 'windows': windows.Volshell} for plugin in volshell_plugin_list: subparser = parser.add_argument_group(title = plugin.capitalize(), description = "Configuration options based on {} options".format( plugin.capitalize())) self.populate_requirements_argparse(subparser, volshell_plugin_list[plugin]) configurables_list[plugin] = volshell_plugin_list[plugin] ### # PASS TO UI ### # Hand the plugin requirements over to the CLI (us) and let it construct the config tree # Run the argparser args = parser.parse_args() vollog.log(constants.LOGLEVEL_VVV, "Cache directory used: {}".format(constants.CACHE_PATH)) plugin = generic.Volshell if args.windows: plugin = windows.Volshell if args.linux: plugin = linux.Volshell if args.mac: plugin = mac.Volshell base_config_path = "plugins" plugin_config_path = interfaces.configuration.path_join(base_config_path, plugin.__name__) # Special case the -f argument because people use is so frequently # It has to go here so it can be overridden by single-location if it's defined # NOTE: This will *BREAK* if LayerStacker, or the automagic configuration system, changes at all ### if args.file: file_name = os.path.abspath(args.file) if not os.path.exists(file_name): vollog.log(logging.INFO, "File does not exist: {}".format(file_name)) else: single_location = "file:" + request.pathname2url(file_name) ctx.config['automagic.LayerStacker.single_location'] = single_location # UI fills in the config, here we load it from the config file and do it before we process the CL parameters if args.config: with open(args.config, "r") as f: json_val = json.load(f) ctx.config.splice(plugin_config_path, interfaces.configuration.HierarchicalDict(json_val)) self.populate_config(ctx, configurables_list, args, plugin_config_path) if args.extend: for extension in args.extend: if '=' not in extension: raise ValueError("Invalid extension (extensions must be of the format \"conf.path.value='value'\")") address, value = extension[:extension.find('=')], json.loads(extension[extension.find('=') + 1:]) ctx.config[address] = value # It should be up to the UI to determine which automagics to run, so this is before BACK TO THE FRAMEWORK automagics = automagic.choose_automagic(automagics, plugin) self.output_dir = args.output_dir ### # BACK TO THE FRAMEWORK ### try: progress_callback = cli.PrintedProgress() if args.quiet: progress_callback = cli.MuteProgress() constructed = plugins.construct_plugin(ctx, automagics, plugin, base_config_path, progress_callback, self.file_handler_class_factory()) if args.write_config: vollog.debug("Writing out configuration data to config.json") with open("config.json", "w") as f: json.dump(dict(constructed.build_configuration()), f, sort_keys = True, indent = 2) # Construct and run the plugin constructed.run() except exceptions.VolatilityException as excp: self.process_exceptions(excp) parser.exit(1, "Unable to validate the plugin requirements: {}\n".format([x for x in excp.unsatisfied])) def main(): """A convenience function for constructing and running the :class:`CommandLine`'s run method.""" VolShell().run() volatility3-1.0.1/volatility3/cli/volshell/generic.py000066400000000000000000000431531405267600400226560ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import binascii import code import io import random import string import struct import sys from typing import Any, Dict, List, Optional, Tuple, Union, Type from urllib import request from volatility3.cli import text_renderer from volatility3.framework import renderers, interfaces, objects, plugins, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.layers import intel, physical try: import capstone has_capstone = True except ImportError: has_capstone = False class Volshell(interfaces.plugins.PluginInterface): """Shell environment to directly interact with a memory image.""" _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self.__current_layer = None # type: Optional[str] def random_string(self, length: int = 32) -> str: return ''.join(random.sample(string.ascii_uppercase + string.digits, length)) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel')] def run(self, additional_locals: Dict[str, Any] = None) -> interfaces.renderers.TreeGrid: """Runs the interactive volshell plugin. Returns: Return a TreeGrid but this is always empty since the point of this plugin is to run interactively """ self._current_layer = self.config['primary'] # Try to enable tab completion try: import readline except ImportError: pass else: import rlcompleter completer = rlcompleter.Completer(namespace = self._construct_locals_dict()) readline.set_completer(completer.complete) readline.parse_and_bind("tab: complete") print("Readline imported successfully") # TODO: provide help, consider generic functions (pslist?) and/or providing windows/linux functions mode = self.__module__.split('.')[-1] mode = mode[0].upper() + mode[1:] banner = """ Call help() to see available functions Volshell mode: {} Current Layer: {} """.format(mode, self.current_layer) sys.ps1 = "({}) >>> ".format(self.current_layer) code.interact(banner = banner, local = self._construct_locals_dict()) return renderers.TreeGrid([("Terminating", str)], None) def help(self, *args): """Describes the available commands""" if args: help(*args) return variables = [] print("\nMethods:") for aliases, item in self.construct_locals(): name = ", ".join(aliases) if item.__doc__ and callable(item): print("* {}".format(name)) print(" {}".format(item.__doc__)) else: variables.append(name) print("\nVariables:") for var in variables: print(" {}".format(var)) def construct_locals(self) -> List[Tuple[List[str], Any]]: """Returns a dictionary listing the functions to be added to the environment.""" return [(['dt', 'display_type'], self.display_type), (['db', 'display_bytes'], self.display_bytes), (['dw', 'display_words'], self.display_words), (['dd', 'display_doublewords'], self.display_doublewords), (['dq', 'display_quadwords'], self.display_quadwords), (['dis', 'disassemble'], self.disassemble), (['cl', 'change_layer'], self.change_layer), (['context'], self.context), (['self'], self), (['dpo', 'display_plugin_output'], self.display_plugin_output), (['gt', 'generate_treegrid'], self.generate_treegrid), (['rt', 'render_treegrid'], self.render_treegrid), (['ds', 'display_symbols'], self.display_symbols), (['hh', 'help'], self.help), (['cc', 'create_configurable'], self.create_configurable), (['lf', 'load_file'], self.load_file)] def _construct_locals_dict(self) -> Dict[str, Any]: """Returns a dictionary of the locals """ result = {} for aliases, value in self.construct_locals(): for alias in aliases: result[alias] = value return result def _read_data(self, offset, count = 128, layer_name = None): """Reads the bytes necessary for the display_* methods""" return self.context.layers[layer_name or self.current_layer].read(offset, count) def _display_data(self, offset: int, remaining_data: bytes, format_string: str = "B", ascii: bool = True): """Display a series of bytes""" chunk_size = struct.calcsize(format_string) data_length = len(remaining_data) remaining_data = remaining_data[:data_length - (data_length % chunk_size)] while remaining_data: current_line, remaining_data = remaining_data[:16], remaining_data[16:] data_blocks = [current_line[chunk_size * i:chunk_size * (i + 1)] for i in range(16 // chunk_size)] data_blocks = [x for x in data_blocks if x != b''] valid_data = [("{:0" + str(2 * chunk_size) + "x}").format(struct.unpack(format_string, x)[0]) for x in data_blocks] padding_data = [" " * 2 * chunk_size for _ in range((16 - len(current_line)) // chunk_size)] hex_data = " ".join(valid_data + padding_data) ascii_data = "" if ascii: connector = " " if chunk_size < 2: connector = "" ascii_data = connector.join([self._ascii_bytes(x) for x in valid_data]) print(hex(offset), " ", hex_data, " ", ascii_data) offset += 16 @staticmethod def _ascii_bytes(bytes): """Converts bytes into an ascii string""" return "".join([chr(x) if 32 < x < 127 else '.' for x in binascii.unhexlify(bytes)]) @property def current_layer(self): return self._current_layer def change_layer(self, layer_name = None): """Changes the current default layer""" if not layer_name: layer_name = self.config['primary'] self._current_layer = layer_name sys.ps1 = "({}) >>> ".format(self.current_layer) def display_bytes(self, offset, count = 128, layer_name = None): """Displays byte values and ASCII characters""" remaining_data = self._read_data(offset, count = count, layer_name = layer_name) self._display_data(offset, remaining_data) def display_quadwords(self, offset, count = 128, layer_name = None): """Displays quad-word values (8 bytes) and corresponding ASCII characters""" remaining_data = self._read_data(offset, count = count, layer_name = layer_name) self._display_data(offset, remaining_data, format_string = "Q") def display_doublewords(self, offset, count = 128, layer_name = None): """Displays double-word values (4 bytes) and corresponding ASCII characters""" remaining_data = self._read_data(offset, count = count, layer_name = layer_name) self._display_data(offset, remaining_data, format_string = "I") def display_words(self, offset, count = 128, layer_name = None): """Displays word values (2 bytes) and corresponding ASCII characters""" remaining_data = self._read_data(offset, count = count, layer_name = layer_name) self._display_data(offset, remaining_data, format_string = "H") def disassemble(self, offset, count = 128, layer_name = None, architecture = None): """Disassembles a number of instructions from the code at offset""" remaining_data = self._read_data(offset, count = count, layer_name = layer_name) if not has_capstone: print("Capstone not available - please install it to use the disassemble command") else: if isinstance(self.context.layers[layer_name or self.current_layer], intel.Intel32e): architecture = 'intel64' elif isinstance(self.context.layers[layer_name or self.current_layer], intel.Intel): architecture = 'intel' disasm_types = { 'intel': capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_32), 'intel64': capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_64), 'arm': capstone.Cs(capstone.CS_ARCH_ARM, capstone.CS_MODE_ARM), 'arm64': capstone.Cs(capstone.CS_ARCH_ARM64, capstone.CS_MODE_ARM) } if architecture is not None: for i in disasm_types[architecture].disasm(remaining_data, offset): print("0x%x:\t%s\t%s" % (i.address, i.mnemonic, i.op_str)) def display_type(self, object: Union[str, interfaces.objects.ObjectInterface, interfaces.objects.Template], offset: int = None): """Display Type describes the members of a particular object in alphabetical order""" if not isinstance(object, (str, interfaces.objects.ObjectInterface, interfaces.objects.Template)): print("Cannot display information about non-type object") return if not isinstance(object, str): # Mypy requires us to order things this way volobject = object elif offset is None: # Str and no offset volobject = self.context.symbol_space.get_type(object) else: # Str and offset volobject = self.context.object(object, layer_name = self.current_layer, offset = offset) if offset is not None: volobject = self.context.object(volobject.vol.type_name, layer_name = self.current_layer, offset = offset) if hasattr(volobject.vol, 'size'): print("{} ({} bytes)".format(volobject.vol.type_name, volobject.vol.size)) elif hasattr(volobject.vol, 'data_format'): data_format = volobject.vol.data_format print("{} ({} bytes, {} endian, {})".format(volobject.vol.type_name, data_format.length, data_format.byteorder, 'signed' if data_format.signed else 'unsigned')) if hasattr(volobject.vol, 'members'): longest_member = longest_offset = longest_typename = 0 for member in volobject.vol.members: relative_offset, member_type = volobject.vol.members[member] longest_member = max(len(member), longest_member) longest_offset = max(len(hex(relative_offset)), longest_offset) longest_typename = max(len(member_type.vol.type_name), longest_typename) for member in sorted(volobject.vol.members, key = lambda x: (volobject.vol.members[x][0], x)): relative_offset, member_type = volobject.vol.members[member] len_offset = len(hex(relative_offset)) len_member = len(member) len_typename = len(member_type.vol.type_name) if isinstance(volobject, interfaces.objects.ObjectInterface): # We're an instance, so also display the data print(" " * (longest_offset - len_offset), hex(relative_offset), ": ", member, " " * (longest_member - len_member), " ", member_type.vol.type_name, " " * (longest_typename - len_typename), " ", self._display_value(getattr(volobject, member))) else: print(" " * (longest_offset - len_offset), hex(relative_offset), ": ", member, " " * (longest_member - len_member), " ", member_type.vol.type_name) @classmethod def _display_value(self, value: Any) -> str: if isinstance(value, objects.PrimitiveObject): return repr(value) elif isinstance(value, objects.Array): return repr([self._display_value(val) for val in value]) else: return hex(value.vol.offset) def generate_treegrid(self, plugin: Type[interfaces.plugins.PluginInterface], **kwargs) -> Optional[interfaces.renderers.TreeGrid]: """Generates a TreeGrid based on a specific plugin passing in kwarg configuration values""" path_join = interfaces.configuration.path_join # Generate a temporary configuration path plugin_config_suffix = self.random_string() plugin_path = path_join(self.config_path, plugin_config_suffix) # Populate the configuration for name, value in kwargs.items(): self.config[path_join(plugin_config_suffix, plugin.__name__, name)] = value try: constructed = plugins.construct_plugin(self.context, [], plugin, plugin_path, None, NullFileHandler) return constructed.run() except exceptions.UnsatisfiedException as excp: print("Unable to validate the plugin requirements: {}\n".format([x for x in excp.unsatisfied])) return None def render_treegrid(self, treegrid: interfaces.renderers.TreeGrid, renderer: Optional[interfaces.renderers.Renderer] = None) -> None: """Renders a treegrid as produced by generate_treegrid""" if renderer is None: renderer = text_renderer.QuickTextRenderer() renderer.render(treegrid) def display_plugin_output(self, plugin: Type[interfaces.plugins.PluginInterface], **kwargs) -> None: """Displays the output for a particular plugin (with keyword arguments)""" treegrid = self.generate_treegrid(plugin, **kwargs) if treegrid is not None: self.render_treegrid(treegrid) def display_symbols(self, symbol_table: str = None): """Prints an alphabetical list of symbols for a symbol table""" if symbol_table is None: print("No symbol table provided") return longest_offset = longest_name = 0 table = self.context.symbol_space[symbol_table] for symbol_name in table.symbols: symbol = table.get_symbol(symbol_name) longest_offset = max(longest_offset, len(hex(symbol.address))) longest_name = max(longest_name, len(symbol.name)) for symbol_name in sorted(table.symbols): symbol = table.get_symbol(symbol_name) len_offset = len(hex(symbol.address)) print(" " * (longest_offset - len_offset), hex(symbol.address), " ", symbol.name) def load_file(self, location: str = None, filename: str = ''): """Loads a file into a Filelayer and returns the name of the layer""" layer_name = self.context.layers.free_layer_name() if location is None: location = "file:" + request.pathname2url(filename) current_config_path = 'volshell.layers.' + layer_name self.context.config[interfaces.configuration.path_join(current_config_path, "location")] = location layer = physical.FileLayer(self.context, current_config_path, layer_name) self.context.add_layer(layer) return layer_name def create_configurable(self, clazz: Type[interfaces.configuration.ConfigurableInterface], **kwargs): """Creates a configurable object, converting arguments to configuration""" config_name = self.random_string() config_path = 'volshell.configurable.' + config_name constructor_args = {} constructor_keywords = [] if issubclass(clazz, interfaces.layers.DataLayerInterface): constructor_keywords = [('name', self.context.layers.free_layer_name(config_name)), ('metadata', None)] if issubclass(clazz, interfaces.symbols.SymbolTableInterface): constructor_keywords = [('name', self.context.symbol_space.free_table_name(config_name)), ('native_types', None), ('table_mapping', None), ('class_types', None)] for argname, default in constructor_keywords: constructor_args[argname] = kwargs.get(argname, default) if argname in kwargs: del kwargs[argname] for keyword in kwargs: val = kwargs[keyword] if not isinstance(val, interfaces.configuration.BasicTypes) and not isinstance(val, list): if not isinstance(val, list) or all([isinstance(x, interfaces.configuration.BasicTypes) for x in val]): raise TypeError("Configurable values must be simple types (int, bool, str, bytes)") self.context.config[config_path + '.' + keyword] = val constructed = clazz(self.context, config_path, **constructor_args) if isinstance(constructed, interfaces.layers.DataLayerInterface): self.context.add_layer(constructed) if isinstance(constructed, interfaces.symbols.SymbolTableInterface): self.context.symbol_space.append(constructed) return constructed class NullFileHandler(io.BytesIO, interfaces.plugins.FileHandlerInterface): """Null FileHandler that swallows files whole without consuming memory""" def __init__(self, preferred_name: str): interfaces.plugins.FileHandlerInterface.__init__(self, preferred_name) super().__init__() def writelines(self, lines): """Dummy method""" pass def write(self, data): """Dummy method""" return len(data) volatility3-1.0.1/volatility3/cli/volshell/linux.py000066400000000000000000000056671405267600400224110ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from typing import Any, List, Tuple, Union from volatility3.cli.volshell import generic from volatility3.framework import interfaces, constants from volatility3.framework.configuration import requirements from volatility3.plugins.linux import pslist class Volshell(generic.Volshell): """Shell environment to directly interact with a linux memory image.""" @classmethod def get_requirements(cls): return (super().get_requirements() + [ requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), requirements.IntRequirement(name = 'pid', description = "Process ID", optional = True) ]) def change_task(self, pid = None): """Change the current process and layer, based on a process ID""" tasks = self.list_tasks() for task in tasks: if task.pid == pid: process_layer = task.add_process_layer() if process_layer is not None: self.change_layer(process_layer) return print("Layer for task ID {} could not be constructed".format(pid)) return print("No task with task ID {} found".format(pid)) def list_tasks(self): """Returns a list of task objects from the primary layer""" # We always use the main kernel memory and associated symbols return list(pslist.PsList.list_tasks(self.context, self.config['primary'], self.config['vmlinux'])) def construct_locals(self) -> List[Tuple[List[str], Any]]: result = super().construct_locals() result += [ (['ct', 'change_task', 'cp'], self.change_task), (['lt', 'list_tasks', 'ps'], self.list_tasks), (['symbols'], self.context.symbol_space[self.config['vmlinux']]), ] if self.config.get('pid', None) is not None: self.change_task(self.config['pid']) return result def display_type(self, object: Union[str, interfaces.objects.ObjectInterface, interfaces.objects.Template], offset: int = None): """Display Type describes the members of a particular object in alphabetical order""" if isinstance(object, str): if constants.BANG not in object: object = self.config['vmlinux'] + constants.BANG + object return super().display_type(object, offset) def display_symbols(self, symbol_table: str = None): """Prints an alphabetical list of symbols for a symbol table""" if symbol_table is None: symbol_table = self.config['vmlinux'] return super().display_symbols(symbol_table) volatility3-1.0.1/volatility3/cli/volshell/mac.py000066400000000000000000000056611405267600400220040ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from typing import Any, List, Tuple, Union from volatility3.cli.volshell import generic from volatility3.framework import constants, interfaces from volatility3.framework.configuration import requirements from volatility3.plugins.mac import pslist class Volshell(generic.Volshell): """Shell environment to directly interact with a mac memory image.""" @classmethod def get_requirements(cls): return (super().get_requirements() + [ requirements.SymbolTableRequirement(name = "darwin", description = "Darwin kernel symbols"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), requirements.IntRequirement(name = 'pid', description = "Process ID", optional = True) ]) def change_task(self, pid = None): """Change the current process and layer, based on a process ID""" tasks = self.list_tasks() for task in tasks: if task.p_pid == pid: process_layer = task.add_process_layer() if process_layer is not None: self.change_layer(process_layer) return print("Layer for task ID {} could not be constructed".format(pid)) return print("No task with task ID {} found".format(pid)) def list_tasks(self): """Returns a list of task objects from the primary layer""" # We always use the main kernel memory and associated symbols return list(pslist.PsList.list_tasks(self.context, self.config['primary'], self.config['darwin'])) def construct_locals(self) -> List[Tuple[List[str], Any]]: result = super().construct_locals() result += [ (['ct', 'change_task', 'cp'], self.change_task), (['lt', 'list_tasks', 'ps'], self.list_tasks), (['symbols'], self.context.symbol_space[self.config['darwin']]), ] if self.config.get('pid', None) is not None: self.change_task(self.config['pid']) return result def display_type(self, object: Union[str, interfaces.objects.ObjectInterface, interfaces.objects.Template], offset: int = None): """Display Type describes the members of a particular object in alphabetical order""" if isinstance(object, str): if constants.BANG not in object: object = self.config['darwin'] + constants.BANG + object return super().display_type(object, offset) def display_symbols(self, symbol_table: str = None): """Prints an alphabetical list of symbols for a symbol table""" if symbol_table is None: symbol_table = self.config['darwin'] return super().display_symbols(symbol_table) volatility3-1.0.1/volatility3/cli/volshell/windows.py000066400000000000000000000055551405267600400227400ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from typing import Any, List, Tuple, Union from volatility3.cli.volshell import generic from volatility3.framework import interfaces, constants from volatility3.framework.configuration import requirements from volatility3.plugins.windows import pslist class Volshell(generic.Volshell): """Shell environment to directly interact with a windows memory image.""" @classmethod def get_requirements(cls): return (super().get_requirements() + [ requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.IntRequirement(name = 'pid', description = "Process ID", optional = True) ]) def change_process(self, pid = None): """Change the current process and layer, based on a process ID""" processes = self.list_processes() for process in processes: if process.UniqueProcessId == pid: process_layer = process.add_process_layer() self.change_layer(process_layer) return print("No process with process ID {} found".format(pid)) def list_processes(self): """Returns a list of EPROCESS objects from the primary layer""" # We always use the main kernel memory and associated symbols return list(pslist.PsList.list_processes(self.context, self.config['primary'], self.config['nt_symbols'])) def construct_locals(self) -> List[Tuple[List[str], Any]]: result = super().construct_locals() result += [ (['cp', 'change_process'], self.change_process), (['lp', 'list_processes', 'ps'], self.list_processes), (['symbols'], self.context.symbol_space[self.config['nt_symbols']]), ] if self.config.get('pid', None) is not None: self.change_process(self.config['pid']) return result def display_type(self, object: Union[str, interfaces.objects.ObjectInterface, interfaces.objects.Template], offset: int = None): """Display Type describes the members of a particular object in alphabetical order""" if isinstance(object, str): if constants.BANG not in object: object = self.config['nt_symbols'] + constants.BANG + object return super().display_type(object, offset) def display_symbols(self, symbol_table: str = None): """Prints an alphabetical list of symbols for a symbol table""" if symbol_table is None: symbol_table = self.config['nt_symbols'] return super().display_symbols(symbol_table) volatility3-1.0.1/volatility3/framework/000077500000000000000000000000001405267600400202605ustar00rootroot00000000000000volatility3-1.0.1/volatility3/framework/__init__.py000066400000000000000000000127151405267600400223770ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """Volatility 3 framework.""" # Check the python version to ensure it's suitable # We currently require 3.5.3 since 3.5.1 has no typing.Type and 3.5.2 is broken for ''/delayed encapsulated types import glob import sys required_python_version = (3, 5, 3) if (sys.version_info.major != required_python_version[0] or sys.version_info.minor < required_python_version[1] or (sys.version_info.minor == required_python_version[1] and sys.version_info.micro < required_python_version[2])): raise RuntimeError( "Volatility framework requires python version {}.{}.{} or greater".format(*required_python_version)) import importlib import inspect import logging import os from typing import Any, Dict, Generator, List, Tuple, Type, TypeVar from volatility3.framework import constants, interfaces # ## # # SemVer version scheme # # Increment the: # # MAJOR version when you make incompatible API changes, # MINOR version when you add functionality in a backwards compatible manner, and # PATCH version when you make backwards compatible bug fixes. def interface_version() -> Tuple[int, int, int]: """Provides the so version number of the library.""" return constants.VERSION_MAJOR, constants.VERSION_MINOR, constants.VERSION_PATCH vollog = logging.getLogger(__name__) def require_interface_version(*args) -> None: """Checks the required version of a plugin.""" if len(args): if args[0] != interface_version()[0]: raise RuntimeError("Framework interface version {} is incompatible with required version {}".format( interface_version()[0], args[0])) if len(args) > 1: if args[1] > interface_version()[1]: raise RuntimeError( "Framework interface version {} is an older revision than the required version {}".format( ".".join([str(x) for x in interface_version()[0:1]]), ".".join([str(x) for x in args[0:2]]))) class noninheritable(object): def __init__(self, value: Any, cls: Type) -> None: self.default_value = value self.cls = cls def __get__(self, obj: Any, type: Type = None) -> Any: if type == self.cls: if hasattr(self.default_value, '__get__'): return self.default_value.__get__(obj, type) return self.default_value raise AttributeError def hide_from_subclasses(cls: Type) -> Type: cls.hidden = noninheritable(True, cls) return cls T = TypeVar('T') def class_subclasses(cls: Type[T]) -> Generator[Type[T], None, None]: """Returns all the (recursive) subclasses of a given class.""" if not inspect.isclass(cls): raise TypeError("class_subclasses parameter not a valid class: {}".format(cls)) for clazz in cls.__subclasses__(): # The typing system is not clever enough to realize that clazz has a hidden attr after the hasattr check if not hasattr(clazz, 'hidden') or not clazz.hidden: # type: ignore yield clazz for return_value in class_subclasses(clazz): yield return_value def import_files(base_module, ignore_errors = False) -> List[str]: """Imports all plugins present under plugins module namespace.""" failures = [] if not isinstance(base_module.__path__, list): raise TypeError("[base_module].__path__ must be a list of paths") vollog.log(constants.LOGLEVEL_VVVV, "Importing from the following paths: {}".format(", ".join(base_module.__path__))) for path in base_module.__path__: for root, _, files in os.walk(path, followlinks = True): # TODO: Figure out how to import pycache files if root.endswith("__pycache__"): continue for f in files: if (f.endswith(".py") or f.endswith(".pyc") or f.endswith(".pyo")) and not f.startswith("__"): modpath = os.path.join(root[len(path) + len(os.path.sep):], f[:f.rfind(".")]) module = modpath.replace(os.path.sep, ".") if base_module.__name__ + "." + module not in sys.modules: try: importlib.import_module(base_module.__name__ + "." + module) except ImportError as e: vollog.debug(str(e)) vollog.debug("Failed to import module {} based on file: {}".format( base_module.__name__ + "." + module, modpath)) failures.append(base_module.__name__ + "." + module) if not ignore_errors: raise return failures def list_plugins() -> Dict[str, Type[interfaces.plugins.PluginInterface]]: plugin_list = {} for plugin in class_subclasses(interfaces.plugins.PluginInterface): plugin_name = plugin.__module__ + "." + plugin.__name__ if plugin_name.startswith("volatility3.plugins."): plugin_name = plugin_name[len("volatility3.plugins."):] plugin_list[plugin_name] = plugin return plugin_list def clear_cache(complete = False): glob_pattern = '*.cache' if not complete: glob_pattern = 'data_' + glob_pattern for cache_filename in glob.glob(os.path.join(constants.CACHE_PATH, glob_pattern)): os.unlink(cache_filename) volatility3-1.0.1/volatility3/framework/automagic/000077500000000000000000000000001405267600400222315ustar00rootroot00000000000000volatility3-1.0.1/volatility3/framework/automagic/__init__.py000066400000000000000000000142551405267600400243510ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """Automagic modules allow the framework to populate configuration elements that a user has not provided. Automagic objects accept a `context` and a `configurable`, and will make appropriate changes to the `context` in an attempt to fulfill the requirements of the `configurable` object (or objects upon which that configurable may rely). Several pre-existing modules include one to stack layers on top of each other (allowing automatic detection and loading of file format types) as well as a module to reconstruct layers based on their provided requirements. """ import logging import sys import traceback from typing import List, Type, Union from volatility3.framework import class_subclasses, import_files, interfaces, constants from volatility3.framework.configuration import requirements vollog = logging.getLogger(__name__) windows_automagic = ['ConstructionMagic', 'LayerStacker', 'WintelHelper', 'KernelPDBScanner', 'WinSwapLayers'] linux_automagic = ['ConstructionMagic', 'LayerStacker', 'LinuxBannerCache', 'LinuxSymbolFinder'] mac_automagic = ['ConstructionMagic', 'LayerStacker', 'MacBannerCache', 'MacSymbolFinder'] def available(context: interfaces.context.ContextInterface) -> List[interfaces.automagic.AutomagicInterface]: """Returns an ordered list of all subclasses of :class:`~volatility3.framework.interfaces.automagic.AutomagicInterface`. The order is based on the priority attributes of the subclasses, in order to ensure the automagics are listed in an appropriate order. Args: context: The context that will contain any automagic configuration values. """ import_files(sys.modules[__name__]) config_path = constants.AUTOMAGIC_CONFIG_PATH return sorted([ clazz(context, interfaces.configuration.path_join(config_path, clazz.__name__)) for clazz in class_subclasses(interfaces.automagic.AutomagicInterface) ], key = lambda x: x.priority) def choose_automagic( automagics: List[interfaces.automagic.AutomagicInterface], plugin: Type[interfaces.plugins.PluginInterface]) -> List[Type[interfaces.automagic.AutomagicInterface]]: """Chooses which automagics to run, maintaining the order they were handed in.""" plugin_category = "None" plugin_categories = plugin.__module__.split('.') lowest_index = len(plugin_categories) automagic_categories = {'windows': windows_automagic, 'linux': linux_automagic, 'mac': mac_automagic} for os in automagic_categories: try: if plugin_categories.index(os) < lowest_index: lowest_index = plugin_categories.index(os) plugin_category = os except ValueError: # The value wasn't found, try the next one pass if plugin_category not in automagic_categories: vollog.info("No plugin category detected") return automagics vollog.info("Detected a {} category plugin".format(plugin_category)) output = [] for amagic in automagics: if amagic.__class__.__name__ in automagic_categories[plugin_category]: output += [amagic] return output def run(automagics: List[interfaces.automagic.AutomagicInterface], context: interfaces.context.ContextInterface, configurable: Union[interfaces.configuration.ConfigurableInterface, Type[interfaces.configuration.ConfigurableInterface]], config_path: str, progress_callback: constants.ProgressCallback = None) -> List[traceback.TracebackException]: """Runs through the list of `automagics` in order, allowing them to make changes to the context. Args: automagics: A list of :class:`~volatility3.framework.interfaces.automagic.AutomagicInterface` objects context: The context (that inherits from :class:`~volatility3.framework.interfaces.context.ContextInterface`) for modification configurable: An object that inherits from :class:`~volatility3.framework.interfaces.configuration.ConfigurableInterface` config_path: The path within the `context.config` for options required by the `configurable` progress_callback: A function that takes a percentage (and an optional description) that will be called periodically This is where any automagic is allowed to run, and alter the context in order to satisfy/improve all requirements Returns a list of traceback objects that occurred during the autorun procedure Note: The order of the `automagics` list is important. An `automagic` that populates configurations may be necessary for an `automagic` that populates the context based on the configuration information. """ for automagic in automagics: if not isinstance(automagic, interfaces.automagic.AutomagicInterface): raise TypeError("Automagics must only contain AutomagicInterface subclasses") if (not isinstance(configurable, interfaces.configuration.ConfigurableInterface) and not issubclass(configurable, interfaces.configuration.ConfigurableInterface)): raise TypeError("Automagic operates on configurables only") # TODO: Fix need for top level config element just because we're using a MultiRequirement to group the # configurable's config requirements # configurable_class: Type[interfaces.configuration.ConfigurableInterface] if isinstance(configurable, interfaces.configuration.ConfigurableInterface): configurable_class = configurable.__class__ else: configurable_class = configurable requirement = requirements.MultiRequirement(name = configurable_class.__name__) for req in configurable.get_requirements(): requirement.add_requirement(req) exceptions = [] for automagic in automagics: try: vollog.info("Running automagic: {}".format(automagic.__class__.__name__)) automagic(context, config_path, requirement, progress_callback) except Exception as excp: exceptions.append(traceback.TracebackException.from_exception(excp)) return exceptions volatility3-1.0.1/volatility3/framework/automagic/construct_layers.py000066400000000000000000000066301405267600400262130ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """An automagic module to use configuration data to configure and then construct classes that fulfill the descendants of a :class:`~volatility3.framewo rk.interfaces.configuration.ConfigurableInterface`.""" import logging import sys from typing import List from volatility3 import framework from volatility3.framework import constants from volatility3.framework import interfaces vollog = logging.getLogger(__name__) class ConstructionMagic(interfaces.automagic.AutomagicInterface): """Constructs underlying layers. Class to run through the requirement tree of the :class:`~volatility3.framework.interfaces.configuration.ConfigurableInterface` and from the bottom of the tree upwards, attempt to construct all :class:`~volatility3.framework.interfaces.configuration.ConstructableRequirementInterface` based classes. :warning: This `automagic` should run first to allow existing configurations to have been constructed for use by later automagic """ priority = 0 def __call__(self, context: interfaces.context.ContextInterface, config_path: str, requirement: interfaces.configuration.RequirementInterface, progress_callback = None, optional = False) -> List[str]: # Make sure we import the layers, so they can reconstructed framework.import_files(sys.modules['volatility3.framework.layers']) result = [] # type: List[str] if requirement.unsatisfied(context, config_path): # Having called validate at the top level tells us both that we need to dig deeper # but also ensures that TranslationLayerRequirements have got the correct subrequirements if their class is populated subreq_config_path = interfaces.configuration.path_join(config_path, requirement.name) for subreq in requirement.requirements.values(): try: self(context, subreq_config_path, subreq, optional = optional or subreq.optional) except Exception as e: # We don't really care if this fails, it tends to mean the configuration isn't complete for that item vollog.log(constants.LOGLEVEL_VVVV, "Construction Exception occurred: {}".format(e)) invalid = subreq.unsatisfied(context, subreq_config_path) # We want to traverse optional paths, so don't check until we've tried to validate # We also don't want to emit a debug message when a parent is optional, hence the optional parameter if invalid and not (optional or subreq.optional): vollog.log(constants.LOGLEVEL_V, "Failed on requirement: {}".format(subreq_config_path)) result.append(interfaces.configuration.path_join(subreq_config_path, subreq.name)) if result: return result elif isinstance(requirement, interfaces.configuration.ConstructableRequirementInterface): # We know all the subrequirements are filled, so let's populate requirement.construct(context, config_path) if progress_callback is not None: progress_callback(100, "Reconstruction finished") return [] volatility3-1.0.1/volatility3/framework/automagic/linux.py000066400000000000000000000163511405267600400237500ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import Optional, Tuple, Type from volatility3.framework import interfaces, constants from volatility3.framework.automagic import symbol_cache, symbol_finder from volatility3.framework.layers import intel, scanners from volatility3.framework.symbols import linux vollog = logging.getLogger(__name__) class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): stack_order = 45 exclusion_list = ['mac', 'windows'] @classmethod def stack(cls, context: interfaces.context.ContextInterface, layer_name: str, progress_callback: constants.ProgressCallback = None) -> Optional[interfaces.layers.DataLayerInterface]: """Attempts to identify linux within this layer.""" # Bail out by default unless we can stack properly layer = context.layers[layer_name] join = interfaces.configuration.path_join # Never stack on top of an intel layer # FIXME: Find a way to improve this check if isinstance(layer, intel.Intel): return None linux_banners = LinuxBannerCache.load_banners() # If we have no banners, don't bother scanning if not linux_banners: vollog.info("No Linux banners found - if this is a linux plugin, please check your symbol files location") return None mss = scanners.MultiStringScanner([x for x in linux_banners if x is not None]) for _, banner in layer.scan(context = context, scanner = mss, progress_callback = progress_callback): dtb = None vollog.debug("Identified banner: {}".format(repr(banner))) symbol_files = linux_banners.get(banner, None) if symbol_files: isf_path = symbol_files[0] table_name = context.symbol_space.free_table_name('LintelStacker') table = linux.LinuxKernelIntermedSymbols(context, 'temporary.' + table_name, name = table_name, isf_url = isf_path) context.symbol_space.append(table) kaslr_shift, aslr_shift = cls.find_aslr(context, table_name, layer_name, progress_callback = progress_callback) layer_class = intel.Intel # type: Type if 'init_top_pgt' in table.symbols: layer_class = intel.Intel32e dtb_symbol_name = 'init_top_pgt' elif 'init_level4_pgt' in table.symbols: layer_class = intel.Intel32e dtb_symbol_name = 'init_level4_pgt' else: dtb_symbol_name = 'swapper_pg_dir' dtb = cls.virtual_to_physical_address(table.get_symbol(dtb_symbol_name).address + kaslr_shift) # Build the new layer new_layer_name = context.layers.free_layer_name("IntelLayer") config_path = join("IntelHelper", new_layer_name) context.config[join(config_path, "memory_layer")] = layer_name context.config[join(config_path, "page_map_offset")] = dtb context.config[join(config_path, LinuxSymbolFinder.banner_config_key)] = str(banner, 'latin-1') layer = layer_class(context, config_path = config_path, name = new_layer_name, metadata = {'kaslr_value': aslr_shift}) if layer and dtb: vollog.debug("DTB was found at: 0x{:0x}".format(dtb)) return layer vollog.debug("No suitable linux banner could be matched") return None @classmethod def find_aslr(cls, context: interfaces.context.ContextInterface, symbol_table: str, layer_name: str, progress_callback: constants.ProgressCallback = None) \ -> Tuple[int, int]: """Determines the offset of the actual DTB in physical space and its symbol offset.""" init_task_symbol = symbol_table + constants.BANG + 'init_task' init_task_json_address = context.symbol_space.get_symbol(init_task_symbol).address swapper_signature = rb"swapper(\/0|\x00\x00)\x00\x00\x00\x00\x00\x00" module = context.module(symbol_table, layer_name, 0) address_mask = context.symbol_space[symbol_table].config.get('symbol_mask', None) task_symbol = module.get_type('task_struct') comm_child_offset = task_symbol.relative_child_offset('comm') for offset in context.layers[layer_name].scan(scanner = scanners.RegExScanner(swapper_signature), context = context, progress_callback = progress_callback): init_task_address = offset - comm_child_offset init_task = module.object(object_type = 'task_struct', offset = init_task_address, absolute = True) if init_task.pid != 0: continue elif init_task.has_member('state') and init_task.state.cast('unsigned int') != 0: continue # This we get for free aslr_shift = init_task.files.cast('long unsigned int') - module.get_symbol('init_files').address kaslr_shift = init_task_address - cls.virtual_to_physical_address(init_task_json_address) if address_mask: aslr_shift = aslr_shift & address_mask if aslr_shift & 0xfff != 0 or kaslr_shift & 0xfff != 0: continue vollog.debug("Linux ASLR shift values determined: physical {:0x} virtual {:0x}".format( kaslr_shift, aslr_shift)) return kaslr_shift, aslr_shift # We don't throw an exception, because we may legitimately not have an ASLR shift, but we report it vollog.debug("Scanners could not determine any ASLR shifts, using 0 for both") return 0, 0 @classmethod def virtual_to_physical_address(cls, addr: int) -> int: """Converts a virtual linux address to a physical one (does not account of ASLR)""" if addr > 0xffffffff80000000: return addr - 0xffffffff80000000 return addr - 0xc0000000 class LinuxBannerCache(symbol_cache.SymbolBannerCache): """Caches the banners found in the Linux symbol files.""" os = "linux" symbol_name = "linux_banner" banner_path = constants.LINUX_BANNERS_PATH class LinuxSymbolFinder(symbol_finder.SymbolFinder): """Linux symbol loader based on uname signature strings.""" banner_config_key = "kernel_banner" banner_cache = LinuxBannerCache symbol_class = "volatility3.framework.symbols.linux.LinuxKernelIntermedSymbols" find_aslr = lambda cls, *args: LinuxIntelStacker.find_aslr(*args)[1] volatility3-1.0.1/volatility3/framework/automagic/mac.py000066400000000000000000000216641405267600400233540ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging import struct from typing import Optional from volatility3.framework import interfaces, constants, layers from volatility3.framework.automagic import symbol_cache, symbol_finder from volatility3.framework.layers import intel, scanners from volatility3.framework.symbols import mac vollog = logging.getLogger(__name__) class MacIntelStacker(interfaces.automagic.StackerLayerInterface): stack_order = 45 exclusion_list = ['windows', 'linux'] @classmethod def stack(cls, context: interfaces.context.ContextInterface, layer_name: str, progress_callback: constants.ProgressCallback = None) -> Optional[interfaces.layers.DataLayerInterface]: """Attempts to identify mac within this layer.""" # Bail out by default unless we can stack properly layer = context.layers[layer_name] new_layer = None join = interfaces.configuration.path_join # Never stack on top of an intel layer # FIXME: Find a way to improve this check if isinstance(layer, intel.Intel): return None mac_banners = MacBannerCache.load_banners() # If we have no banners, don't bother scanning if not mac_banners: vollog.info("No Mac banners found - if this is a mac plugin, please check your symbol files location") return None mss = scanners.MultiStringScanner([x for x in mac_banners if x]) for banner_offset, banner in layer.scan(context = context, scanner = mss, progress_callback = progress_callback): dtb = None vollog.debug("Identified banner: {}".format(repr(banner))) symbol_files = mac_banners.get(banner, None) if symbol_files: isf_path = symbol_files[0] table_name = context.symbol_space.free_table_name('MacintelStacker') table = mac.MacKernelIntermedSymbols(context = context, config_path = join('temporary', table_name), name = table_name, isf_url = isf_path) context.symbol_space.append(table) kaslr_shift = cls.find_aslr(context = context, symbol_table = table_name, layer_name = layer_name, compare_banner = banner, compare_banner_offset = banner_offset, progress_callback = progress_callback) if kaslr_shift == 0: vollog.log(constants.LOGLEVEL_VVV, "Invalid kalsr_shift found at offset: {}".format(banner_offset)) continue bootpml4_addr = cls.virtual_to_physical_address(table.get_symbol("BootPML4").address + kaslr_shift) new_layer_name = context.layers.free_layer_name("MacDTBTempLayer") config_path = join("automagic", "MacIntelHelper", new_layer_name) context.config[join(config_path, "memory_layer")] = layer_name context.config[join(config_path, "page_map_offset")] = bootpml4_addr layer = layers.intel.Intel32e(context, config_path = config_path, name = new_layer_name, metadata = {'os': 'Mac'}) idlepml4_ptr = table.get_symbol("IdlePML4").address + kaslr_shift idlepml4_str = layer.read(idlepml4_ptr, 4) idlepml4_addr = struct.unpack(" int: """Determines the offset of the actual DTB in physical space and its symbol offset.""" version_symbol = symbol_table + constants.BANG + 'version' version_json_address = context.symbol_space.get_symbol(version_symbol).address version_major_symbol = symbol_table + constants.BANG + 'version_major' version_major_json_address = context.symbol_space.get_symbol(version_major_symbol).address version_major_phys_offset = cls.virtual_to_physical_address(version_major_json_address) version_minor_symbol = symbol_table + constants.BANG + 'version_minor' version_minor_json_address = context.symbol_space.get_symbol(version_minor_symbol).address version_minor_phys_offset = cls.virtual_to_physical_address(version_minor_json_address) if not compare_banner_offset or not compare_banner: offset_generator = cls._scan_generator(context, layer_name, progress_callback) else: offset_generator = [(compare_banner_offset, compare_banner)] aslr_shift = 0 for offset, banner in offset_generator: banner_major, banner_minor = [int(x) for x in banner[22:].split(b".")[0:2]] tmp_aslr_shift = offset - cls.virtual_to_physical_address(version_json_address) major_string = context.layers[layer_name].read(version_major_phys_offset + tmp_aslr_shift, 4) major = struct.unpack(" int: """Converts a virtual mac address to a physical one (does not account of ASLR)""" if addr > 0xffffff8000000000: addr = addr - 0xffffff8000000000 else: addr = addr - 0xff8000000000 return addr @classmethod def _scan_generator(cls, context, layer_name, progress_callback): darwin_signature = rb"Darwin Kernel Version \d{1,3}\.\d{1,3}\.\d{1,3}: [^\x00]+\x00" for offset in context.layers[layer_name].scan(scanner = scanners.RegExScanner(darwin_signature), context = context, progress_callback = progress_callback): banner = context.layers[layer_name].read(offset, 128) idx = banner.find(b"\x00") if idx != -1: banner = banner[:idx] yield offset, banner class MacBannerCache(symbol_cache.SymbolBannerCache): """Caches the banners found in the Mac symbol files.""" os = "mac" symbol_name = "version" banner_path = constants.MAC_BANNERS_PATH class MacSymbolFinder(symbol_finder.SymbolFinder): """Mac symbol loader based on uname signature strings.""" banner_config_key = 'kernel_banner' banner_cache = MacBannerCache find_aslr = MacIntelStacker.find_aslr symbol_class = "volatility3.framework.symbols.mac.MacKernelIntermedSymbols" volatility3-1.0.1/volatility3/framework/automagic/pdbscan.py000066400000000000000000000413661405267600400242270ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """A module for scanning translation layers looking for Windows PDB records from loaded PE files. This module contains a standalone scanner, and also a :class:`~volatility3.framework.interfaces.layers.ScannerInterface` based scanner for use within the framework by calling :func:`~volatility3.framework.interfaces.layers.DataLayerInterface.scan`. """ import logging import math import os from typing import Any, Dict, Iterable, List, Optional, Set, Tuple, Union from volatility3.framework import constants, exceptions, interfaces, layers from volatility3.framework.configuration import requirements from volatility3.framework.layers import intel, scanners from volatility3.framework.symbols import native from volatility3.framework.symbols.windows.pdbutil import PDBUtility if __name__ == "__main__": import sys sys.path.append(os.path.dirname(os.path.dirname(os.path.dirname(os.path.dirname(__file__))))) vollog = logging.getLogger(__name__) ValidKernelType = Tuple[str, int, Dict[str, Optional[Union[bytes, str, int]]]] KernelsType = Iterable[Dict[str, Any]] class KernelPDBScanner(interfaces.automagic.AutomagicInterface): """Windows symbol loader based on PDB signatures. An Automagic object that looks for all Intel translation layers and scans each of them for a pdb signature. When found, a search for a corresponding Intermediate Format data file is carried out and if found an appropriate symbol space is automatically loaded. Once a specific kernel PDB signature has been found, a virtual address for the loaded kernel is determined by one of two methods. The first method assumes a specific mapping from the kernel's physical address to its virtual address (typically the kernel is loaded at its physical location plus a specific offset). The second method searches for a particular structure that lists the kernel module's virtual address, its size (not checked) and the module's name. This value is then used if one was not found using the previous method. """ priority = 30 max_pdb_size = 0x400000 def find_virtual_layers_from_req(self, context: interfaces.context.ContextInterface, config_path: str, requirement: interfaces.configuration.RequirementInterface) -> List[str]: """Traverses the requirement tree, rooted at `requirement` looking for virtual layers that might contain a windows PDB. Returns a list of possible layers Args: context: The context in which the `requirement` lives config_path: The path within the `context` for the `requirement`'s configuration variables requirement: The root of the requirement tree to search for :class:~`volatility3.framework.interfaces.layers.TranslationLayerRequirement` objects to scan progress_callback: Means of providing the user with feedback during long processes Returns: A list of (layer_name, scan_results) """ sub_config_path = interfaces.configuration.path_join(config_path, requirement.name) results = [] # type: List[str] if isinstance(requirement, requirements.TranslationLayerRequirement): # Check for symbols in this layer # FIXME: optionally allow a full (slow) scan # FIXME: Determine the physical layer no matter the virtual layer virtual_layer_name = context.config.get(sub_config_path, None) layer_name = context.config.get(interfaces.configuration.path_join(sub_config_path, "memory_layer"), None) if layer_name and virtual_layer_name: memlayer = context.layers[virtual_layer_name] if isinstance(memlayer, intel.Intel): results = [virtual_layer_name] else: for subreq in requirement.requirements.values(): results += self.find_virtual_layers_from_req(context, sub_config_path, subreq) return results def recurse_symbol_fulfiller(self, context: interfaces.context.ContextInterface, valid_kernel: ValidKernelType, progress_callback: constants.ProgressCallback = None) -> None: """Fulfills the SymbolTableRequirements in `self._symbol_requirements` found by the `recurse_symbol_requirements`. This pass will construct any requirements that may need it in the context it was passed Args: context: Context on which to operate valid_kernel: A list of offsets where valid kernels have been found """ for sub_config_path, requirement in self._symbol_requirements: # TODO: Potentially think about multiple symbol requirements in both the same and different levels of the requirement tree # TODO: Consider whether a single found kernel can fulfill multiple requirements if valid_kernel: # TODO: Check that the symbols for this kernel will fulfill the requirement virtual_layer, _kvo, kernel = valid_kernel if not isinstance(kernel['pdb_name'], str) or not isinstance(kernel['GUID'], str): raise TypeError("PDB name or GUID not a string value") PDBUtility.load_windows_symbol_table( context = context, guid = kernel['GUID'], age = kernel['age'], pdb_name = kernel['pdb_name'], symbol_table_class = "volatility3.framework.symbols.windows.WindowsKernelIntermedSymbols", config_path = sub_config_path, progress_callback = progress_callback) else: vollog.debug("No suitable kernel pdb signature found") def set_kernel_virtual_offset(self, context: interfaces.context.ContextInterface, valid_kernel: ValidKernelType) -> None: """Traverses the requirement tree, looking for kernel_virtual_offset values that may need setting and sets it based on the previously identified `valid_kernel`. Args: context: Context on which to operate and provide the kernel virtual offset valid_kernel: List of valid kernels and offsets """ if valid_kernel: # Set the virtual offset under the TranslationLayer it applies to virtual_layer, kvo, kernel = valid_kernel kvo_path = interfaces.configuration.path_join(context.layers[virtual_layer].config_path, 'kernel_virtual_offset') context.config[kvo_path] = kvo vollog.debug("Setting kernel_virtual_offset to {}".format(hex(kvo))) def get_physical_layer_name(self, context, vlayer): return context.config.get(interfaces.configuration.path_join(vlayer.config_path, 'memory_layer'), None) def method_fixed_mapping(self, context: interfaces.context.ContextInterface, vlayer: layers.intel.Intel, progress_callback: constants.ProgressCallback = None) -> Optional[ValidKernelType]: # TODO: Verify this is a windows image vollog.debug("Kernel base determination - testing fixed base address") valid_kernel = None virtual_layer_name = vlayer.name physical_layer_name = self.get_physical_layer_name(context, vlayer) kernel_pdb_names = [bytes(name + ".pdb", "utf-8") for name in constants.windows.KERNEL_MODULE_NAMES] kernels = PDBUtility.pdbname_scan(ctx = context, layer_name = physical_layer_name, page_size = vlayer.page_size, pdb_names = kernel_pdb_names, progress_callback = progress_callback) for kernel in kernels: # It seems the kernel is loaded at a fixed mapping (presumably because the memory manager hasn't started yet) if kernel['mz_offset'] is None or not isinstance(kernel['mz_offset'], int): # Rule out kernels that couldn't find a suitable MZ header continue if vlayer.bits_per_register == 64: kvo = kernel['mz_offset'] + (31 << int(math.ceil(math.log2(vlayer.maximum_address + 1)) - 5)) else: kvo = kernel['mz_offset'] + (1 << (vlayer.bits_per_register - 1)) try: kvp = vlayer.mapping(kvo, 0) if (any([(p == kernel['mz_offset'] and layer_name == physical_layer_name) for (_, _, p, _, layer_name) in kvp])): valid_kernel = (virtual_layer_name, kvo, kernel) break else: vollog.debug("Potential kernel_virtual_offset did not map to expected location: {}".format( hex(kvo))) except exceptions.InvalidAddressException: vollog.debug("Potential kernel_virtual_offset caused a page fault: {}".format(hex(kvo))) return valid_kernel def _method_offset(self, context: interfaces.context.ContextInterface, vlayer: layers.intel.Intel, pattern: bytes, result_offset: int, progress_callback: constants.ProgressCallback = None) -> Optional[ValidKernelType]: """Method for finding a suitable kernel offset based on a module table.""" vollog.debug("Kernel base determination - searching layer module list structure") valid_kernel = None # type: Optional[ValidKernelType] # If we're here, chances are high we're in a Win10 x64 image with kernel base randomization physical_layer_name = self.get_physical_layer_name(context, vlayer) physical_layer = context.layers[physical_layer_name] # TODO: On older windows, this might be \WINDOWS\system32\nt rather than \SystemRoot\system32\nt results = physical_layer.scan(context, scanners.BytesScanner(pattern), progress_callback = progress_callback) seen = set() # type: Set[int] # Because this will launch a scan of the virtual layer, we want to be careful for result in results: # TODO: Identify the specific structure we're finding and document this a bit better pointer = context.object("pdbscan!unsigned long long", offset = (result + result_offset), layer_name = physical_layer_name) address = pointer & vlayer.address_mask if address in seen: continue seen.add(address) valid_kernel = self.check_kernel_offset(context, vlayer, address, progress_callback) if valid_kernel: break return valid_kernel def method_module_offset(self, context: interfaces.context.ContextInterface, vlayer: layers.intel.Intel, progress_callback: constants.ProgressCallback = None) -> ValidKernelType: return self._method_offset(context, vlayer, b"\\SystemRoot\\system32\\nt", -16 - int(vlayer.bits_per_register / 8), progress_callback) def method_kdbg_offset(self, context: interfaces.context.ContextInterface, vlayer: layers.intel.Intel, progress_callback: constants.ProgressCallback = None) -> ValidKernelType: return self._method_offset(context, vlayer, b"KDBG", 8, progress_callback) def check_kernel_offset(self, context: interfaces.context.ContextInterface, vlayer: layers.intel.Intel, address: int, progress_callback: constants.ProgressCallback = None) -> Optional[ValidKernelType]: """Scans a virtual address.""" # Scan a few megs of the virtual space at the location to see if they're potential kernels valid_kernel = None # type: Optional[ValidKernelType] kernel_pdb_names = [bytes(name + ".pdb", "utf-8") for name in constants.windows.KERNEL_MODULE_NAMES] virtual_layer_name = vlayer.name try: if vlayer.read(address, 0x2) == b'MZ': res = list( PDBUtility.pdbname_scan(ctx = context, layer_name = vlayer.name, page_size = vlayer.page_size, pdb_names = kernel_pdb_names, progress_callback = progress_callback, start = address, end = address + self.max_pdb_size)) if res: valid_kernel = (virtual_layer_name, address, res[0]) except exceptions.InvalidAddressException: pass return valid_kernel # List of methods to be run, in order, to determine the valid kernels methods = [method_kdbg_offset, method_module_offset, method_fixed_mapping] def determine_valid_kernel(self, context: interfaces.context.ContextInterface, potential_layers: List[str], progress_callback: constants.ProgressCallback = None) -> Optional[ValidKernelType]: """Runs through the identified potential kernels and verifies their suitability. This carries out a scan using the pdb_signature scanner on a physical layer. It uses the results of the scan to determine the virtual offset of the kernel. On early windows implementations there is a fixed mapping between the physical and virtual addresses of the kernel. On more recent versions a search is conducted for a structure that will identify the kernel's virtual offset. Args: context: Context on which to operate potential_kernels: Dictionary containing `GUID`, `age`, `pdb_name` and `mz_offset` keys progress_callback: Function taking a percentage and optional description to be called during expensive computations to indicate progress Returns: A dictionary of valid kernels """ valid_kernel = None # type: Optional[ValidKernelType] for virtual_layer_name in potential_layers: vlayer = context.layers.get(virtual_layer_name, None) if isinstance(vlayer, layers.intel.Intel): for method in self.methods: valid_kernel = method(self, context, vlayer, progress_callback) if valid_kernel: break if not valid_kernel: vollog.info("No suitable kernels found during pdbscan") return valid_kernel def __call__(self, context: interfaces.context.ContextInterface, config_path: str, requirement: interfaces.configuration.RequirementInterface, progress_callback: constants.ProgressCallback = None) -> None: if requirement.unsatisfied(context, config_path): if "pdbscan" not in context.symbol_space: context.symbol_space.append(native.NativeTable("pdbscan", native.std_ctypes)) # TODO: check if this is a windows symbol requirement, otherwise ignore it self._symbol_requirements = self.find_requirements(context, config_path, requirement, requirements.SymbolTableRequirement) potential_layers = self.find_virtual_layers_from_req(context = context, config_path = config_path, requirement = requirement) for sub_config_path, symbol_req in self._symbol_requirements: parent_path = interfaces.configuration.parent_path(sub_config_path) if symbol_req.unsatisfied(context, parent_path): valid_kernel = self.determine_valid_kernel(context, potential_layers, progress_callback) if valid_kernel: self.recurse_symbol_fulfiller(context, valid_kernel, progress_callback) self.set_kernel_virtual_offset(context, valid_kernel) if progress_callback is not None: progress_callback(100, "PDB scanning finished") volatility3-1.0.1/volatility3/framework/automagic/stacker.py000066400000000000000000000322021405267600400242360ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """This module attempts to automatically stack layers. This automagic module fulfills :class:`~volatility3.framework.interfaces.configuration.TranslationLayerRequirement` that are not already fulfilled, by attempting to stack as many layers on top of each other as possible. The base/lowest layer is derived from the "automagic.general.single_location" configuration path. Layers are then attempting in likely height order, and once a layer successfully stacks on top of the existing layers, it is removed from the possible choices list (so no layer type can exist twice in the layer stack). """ import logging import sys import traceback from typing import Any, List, Optional, Tuple, Type from volatility3 import framework from volatility3.framework import interfaces, constants from volatility3.framework.automagic import construct_layers from volatility3.framework.configuration import requirements from volatility3.framework.layers import physical vollog = logging.getLogger(__name__) class LayerStacker(interfaces.automagic.AutomagicInterface): """Builds up layers in a single stack. This class mimics the volatility 2 style of stacking address spaces. It builds up various layers based on separate :class:`~volatility3.framework.interfaces.automagic.StackerLayerInterface` classes. These classes are built up based on a `stack_order` class variable each has. This has a high priority to provide other automagic modules as complete a context/configuration tree as possible. Upon completion it will re-call the :class:`~volatility3.framework.automagic.construct_layers.ConstructionMagic`, so that any stacked layers are actually constructed and added to the context. """ # Most important automagic, must happen first! priority = 10 def __init__(self, *args, **kwargs) -> None: super().__init__(*args, **kwargs) self._cached = None def __call__(self, context: interfaces.context.ContextInterface, config_path: str, requirement: interfaces.configuration.RequirementInterface, progress_callback: constants.ProgressCallback = None) -> Optional[List[str]]: """Runs the automagic over the configurable.""" framework.import_files(sys.modules['volatility3.framework.layers']) # Quick exit if we're not needed if not requirement.unsatisfied(context, config_path): return None # Bow out quickly if the UI hasn't provided a single_location unsatisfied = self.unsatisfied(self.context, self.config_path) if unsatisfied: vollog.info("Unable to run LayerStacker, unsatisfied requirement: {}".format(unsatisfied)) return list(unsatisfied) if not self.config or not self.config.get('single_location', None): raise ValueError("Unable to run LayerStacker, single_location parameter not provided") # Search for suitable requirements self.stack(context, config_path, requirement, progress_callback) if progress_callback is not None: progress_callback(100, "Stacking attempts finished") return None def stack(self, context: interfaces.context.ContextInterface, config_path: str, requirement: interfaces.configuration.RequirementInterface, progress_callback: constants.ProgressCallback) -> None: """Stacks the various layers and attaches these to a specific requirement. Args: context: Context on which to operate config_path: Configuration path under which to store stacking data requirement: Requirement that should have layers stacked on it progress_callback: Function to provide callback progress """ # If we're cached, find Now we need to find where to apply the stack configuration if self._cached: top_layer_name, subconfig = self._cached result = self.find_suitable_requirements(context, config_path, requirement, [top_layer_name]) if result: appropriate_config_path, layer_name = result context.config.merge(appropriate_config_path, subconfig) context.config[appropriate_config_path] = top_layer_name return self._cached = None new_context = context.clone() location = self.config.get('single_location', None) # Setup the local copy of the resource current_layer_name = context.layers.free_layer_name("FileLayer") current_config_path = interfaces.configuration.path_join(config_path, "stack", current_layer_name) # This must be specific to get us started, setup the config and run new_context.config[interfaces.configuration.path_join(current_config_path, "location")] = location physical_layer = physical.FileLayer(new_context, current_config_path, current_layer_name) new_context.add_layer(physical_layer) stacked_layers = self.stack_layer(new_context, current_layer_name, self.create_stackers_list(), progress_callback) if stacked_layers is not None: # Applies the stacked_layers to each requirement in the requirements list result = self.find_suitable_requirements(new_context, config_path, requirement, stacked_layers) if result: path, layer = result # splice in the new configuration into the original context context.config.merge(path, new_context.layers[layer].build_configuration()) # Call the construction magic now we may have new things to construct constructor = construct_layers.ConstructionMagic( context, interfaces.configuration.path_join(self.config_path, "ConstructionMagic")) constructor(context, config_path, requirement) # Stash the changed config items self._cached = context.config.get(path, None), context.config.branch(path) vollog.debug("Stacked layers: {}".format(stacked_layers)) @classmethod def stack_layer(cls, context: interfaces.context.ContextInterface, initial_layer: str, stack_set: List[Type[interfaces.automagic.StackerLayerInterface]] = None, progress_callback: constants.ProgressCallback = None): """Stacks as many possible layers on top of the initial layer as can be done. WARNING: This modifies the context provided and may pollute it with unnecessary layers Recommended use is to: 1. Pass in context.clone() instead of context 2. When provided the layer list, choose the desired layer 3. Build the configuration using layer.build_configuration() 4. Merge the configuration into the original context with context.config.merge() 5. Call Construction magic to reconstruct the layers from just the configuration Args: context: The context on which to operate initial_layer: The name of the initial layer within the context stack_set: A list of StackerLayerInterface objects in the order they should be stacked progress_callback: A function to report progress during the process Returns: A list of layer names that exist in the provided context, stacked in order (highest to lowest) """ # Repeatedly apply "determine what this is" code and build as much up as possible stacked = True stacked_layers = [initial_layer] if stack_set is None: stack_set = list(framework.class_subclasses(interfaces.automagic.StackerLayerInterface)) for stacker_item in stack_set: if not issubclass(stacker_item, interfaces.automagic.StackerLayerInterface): raise TypeError("Stacker {} is not a descendent of StackerLayerInterface".format(stacker_item.__name__)) while stacked: stacked = False new_layer = None stacker_cls = None for stacker_cls in stack_set: stacker = stacker_cls() try: vollog.log(constants.LOGLEVEL_VV, "Attempting to stack using {}".format(stacker_cls.__name__)) new_layer = stacker.stack(context, initial_layer, progress_callback) if new_layer: context.layers.add_layer(new_layer) vollog.log(constants.LOGLEVEL_VV, "Stacked {} using {}".format(new_layer.name, stacker_cls.__name__)) break except Exception as excp: # Stacking exceptions are likely only of interest to developers, so the lowest level of logging fulltrace = traceback.TracebackException.from_exception(excp).format(chain = True) vollog.log(constants.LOGLEVEL_VVV, "Exception during stacking: {}".format(str(excp))) vollog.log(constants.LOGLEVEL_VVVV, "\n".join(fulltrace)) else: stacked = False if new_layer and stacker_cls: stacked_layers = [new_layer.name] + stacked_layers initial_layer = new_layer.name stacked = True stack_set.remove(stacker_cls) return stacked_layers def create_stackers_list(self) -> List[Type[interfaces.automagic.StackerLayerInterface]]: """Creates the list of stackers to use based on the config option""" stack_set = sorted(framework.class_subclasses(interfaces.automagic.StackerLayerInterface), key = lambda x: x.stack_order) stacker_list = self.config.get('stackers', []) if len(stacker_list): result = [] for stacker in stack_set: if stacker.__name__ in stacker_list: result.append(stacker) stack_set = result return stack_set @classmethod def find_suitable_requirements(cls, context: interfaces.context.ContextInterface, config_path: str, requirement: interfaces.configuration.RequirementInterface, stacked_layers: List[str]) -> Optional[Tuple[str, str]]: """Looks for translation layer requirements and attempts to apply the stacked layers to it. If it succeeds it returns the configuration path and layer name where the stacked nodes were spliced into the tree. Returns: A tuple of a configuration path and layer name for the top of the stacked layers or None if suitable requirements are not found """ child_config_path = interfaces.configuration.path_join(config_path, requirement.name) if isinstance(requirement, requirements.TranslationLayerRequirement): if requirement.unsatisfied(context, config_path): original_setting = context.config.get(child_config_path, None) for layer_name in stacked_layers: context.config[child_config_path] = layer_name if not requirement.unsatisfied(context, config_path): return child_config_path, layer_name # Clean-up to restore the config if original_setting: context.config[child_config_path] = original_setting else: del context.config[child_config_path] else: return child_config_path, context.config.get(child_config_path, None) for req_name, req in requirement.requirements.items(): result = cls.find_suitable_requirements(context, child_config_path, req, stacked_layers) if result: return result return None @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # This is not optional for the stacker to run, so optional must be marked as False return [ requirements.URIRequirement(name = "single_location", description = "Specifies a base location on which to stack", optional = True), requirements.ListRequirement(name = "stackers", description = "List of stackers", optional = True) ] def choose_os_stackers(plugin: Type[interfaces.plugins.PluginInterface]) -> List[str]: """Identifies the stackers that should be run, based on the plugin (and thus os) provided""" plugin_first_level = plugin.__module__.split('.')[2] # Ensure all stackers are loaded framework.import_files(sys.modules['volatility3.framework.layers']) result = [] for stacker in sorted(framework.class_subclasses(interfaces.automagic.StackerLayerInterface), key = lambda x: x.stack_order): if plugin_first_level in stacker.exclusion_list: continue result.append(stacker.__name__) return result volatility3-1.0.1/volatility3/framework/automagic/symbol_cache.py000066400000000000000000000123231405267600400252340ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import gc import json import logging import os import pickle import urllib import urllib.parse import urllib.request from typing import Dict, List, Optional from volatility3.framework import constants, exceptions, interfaces from volatility3.framework.symbols import intermed vollog = logging.getLogger(__name__) BannersType = Dict[bytes, List[str]] class SymbolBannerCache(interfaces.automagic.AutomagicInterface): """Runs through all symbols tables and caches their banners.""" # Since this is necessary for ConstructionMagic, we set a lower priority # The user would run it eventually either way, but running it first means it can be used that run priority = 0 os = None # type: Optional[str] symbol_name = "banner_name" # type: str banner_path = None # type: Optional[str] @classmethod def load_banners(cls) -> BannersType: if not cls.banner_path: raise ValueError("Banner_path not appropriately set") banners = {} # type: BannersType if os.path.exists(cls.banner_path): with open(cls.banner_path, "rb") as f: # We use pickle over JSON because we're dealing with bytes objects banners.update(pickle.load(f)) # Remove possibilities that can't exist locally. remove_banners = [] for banner in banners: for path in banners[banner]: url = urllib.parse.urlparse(path) if url.scheme == 'file' and not os.path.exists(urllib.request.url2pathname(url.path)): vollog.log( constants.LOGLEVEL_VV, "Removing cached path {} for banner {}: file does not exist".format( path, str(banner or b'', 'latin-1'))) banners[banner].remove(path) # This is probably excessive, but it's here if we need it # if url.scheme == 'jar': # zip_file, zip_path = url.path.split("!") # zip_file = urllib.parse.urlparse(zip_file).path # if ((not os.path.exists(zip_file)) or (zip_path not in zipfile.ZipFile(zip_file).namelist())): # vollog.log(constants.LOGLEVEL_VV, # "Removing cached path {} for banner {}: file does not exist".format(path, banner)) # banners[banner].remove(path) if not banners[banner]: remove_banners.append(banner) for remove_banner in remove_banners: del banners[remove_banner] return banners @classmethod def save_banners(cls, banners): with open(cls.banner_path, "wb") as f: pickle.dump(banners, f) def __call__(self, context, config_path, configurable, progress_callback = None): """Runs the automagic over the configurable.""" # Bomb out if we're just the generic interface if self.os is None: return # We only need to be called once, so no recursion necessary banners = self.load_banners() cacheables = list(intermed.IntermediateSymbolTable.file_symbol_url(self.os)) for banner in banners: for json_file in banners[banner]: if json_file in cacheables: cacheables.remove(json_file) total = len(cacheables) if total > 0: vollog.info("Building {} caches...".format(self.os)) for current in range(total): if progress_callback is not None: progress_callback(current * 100 / total, "Building {} caches".format(self.os)) isf_url = cacheables[current] isf = None try: # Loading the symbol table will be very slow until it's been validated isf = intermed.IntermediateSymbolTable(context, config_path, "temp", isf_url, validate = False) # We should store the banner against the filename # We don't bother with the hash (it'll likely take too long to validate) # but we should check at least that the banner matches on load. banner = isf.get_symbol(self.symbol_name).constant_data vollog.log(constants.LOGLEVEL_VV, "Caching banner {} for file {}".format(banner, isf_url)) bannerlist = banners.get(banner, []) bannerlist.append(isf_url) banners[banner] = bannerlist except exceptions.SymbolError: pass except json.JSONDecodeError: vollog.log(constants.LOGLEVEL_VV, "Caching file {} failed due to JSON error".format(isf_url)) finally: # Get rid of the loaded file, in case it sits in memory if isf: del isf gc.collect() # Rewrite the cached banners each run, since writing is faster than the banner_cache validation portion self.save_banners(banners) if progress_callback is not None: progress_callback(100, "Built {} caches".format(self.os)) volatility3-1.0.1/volatility3/framework/automagic/symbol_finder.py000066400000000000000000000165131405267600400254450ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import Any, Iterable, List, Tuple, Type, Optional, Callable from volatility3.framework import interfaces, constants, layers, exceptions from volatility3.framework.automagic import symbol_cache from volatility3.framework.configuration import requirements from volatility3.framework.layers import scanners vollog = logging.getLogger(__name__) class SymbolFinder(interfaces.automagic.AutomagicInterface): """Symbol loader based on signature strings.""" priority = 40 banner_config_key = "banner" # type: str banner_cache = None # type: Optional[Type[symbol_cache.SymbolBannerCache]] symbol_class = None # type: Optional[str] find_aslr = None # type: Optional[Callable] def __init__(self, context: interfaces.context.ContextInterface, config_path: str) -> None: super().__init__(context, config_path) self._requirements = [] # type: List[Tuple[str, interfaces.configuration.RequirementInterface]] self._banners = {} # type: symbol_cache.BannersType @property def banners(self) -> symbol_cache.BannersType: """Creates a cached copy of the results, but only it's been requested.""" if not self._banners: if not self.banner_cache: raise RuntimeError("Cache has not been properly defined for {}".format(self.__class__.__name__)) self._banners = self.banner_cache.load_banners() return self._banners def __call__(self, context: interfaces.context.ContextInterface, config_path: str, requirement: interfaces.configuration.RequirementInterface, progress_callback: constants.ProgressCallback = None) -> None: """Searches for SymbolTableRequirements and attempt to populate them.""" # Bomb out early if our details haven't been configured if self.symbol_class is None: return self._requirements = self.find_requirements( context, config_path, requirement, (requirements.TranslationLayerRequirement, requirements.SymbolTableRequirement), shortcut = False) for (sub_path, requirement) in self._requirements: parent_path = interfaces.configuration.parent_path(sub_path) if (isinstance(requirement, requirements.SymbolTableRequirement) and requirement.unsatisfied(context, parent_path)): for (tl_sub_path, tl_requirement) in self._requirements: tl_parent_path = interfaces.configuration.parent_path(tl_sub_path) # Find the TranslationLayer sibling to the SymbolTableRequirement if (isinstance(tl_requirement, requirements.TranslationLayerRequirement) and tl_parent_path == parent_path): if context.config.get(tl_sub_path, None): self._banner_scan(context, parent_path, requirement, context.config[tl_sub_path], progress_callback) break def _banner_scan(self, context: interfaces.context.ContextInterface, config_path: str, requirement: interfaces.configuration.ConstructableRequirementInterface, layer_name: str, progress_callback: constants.ProgressCallback = None) -> None: """Accepts a context, config_path and SymbolTableRequirement, with a constructed layer_name and scans the layer for banners.""" # Bomb out early if there's no banners if not self.banners: return mss = scanners.MultiStringScanner([x for x in self.banners if x is not None]) layer = context.layers[layer_name] # Check if the Stacker has already found what we're looking for if layer.config.get(self.banner_config_key, None): banner_list = [(0, bytes(layer.config[self.banner_config_key], 'raw_unicode_escape'))] # type: Iterable[Any] else: # Swap to the physical layer for scanning # TODO: Fix this so it works for layers other than just Intel layer = context.layers[layer.config['memory_layer']] banner_list = layer.scan(context = context, scanner = mss, progress_callback = progress_callback) for _, banner in banner_list: vollog.debug("Identified banner: {}".format(repr(banner))) symbol_files = self.banners.get(banner, None) if symbol_files: isf_path = symbol_files[0] vollog.debug("Using symbol library: {}".format(symbol_files[0])) clazz = self.symbol_class # Set the discovered options path_join = interfaces.configuration.path_join context.config[path_join(config_path, requirement.name, "class")] = clazz context.config[path_join(config_path, requirement.name, "isf_url")] = isf_path context.config[path_join(config_path, requirement.name, "symbol_mask")] = layer.address_mask # Set a default symbol_shift when attempt to determine it, # so we can create the symbols which are used in finding the aslr_shift anyway if not context.config.get(path_join(config_path, requirement.name, "symbol_shift"), None): # Don't overwrite it if it's already been set, it will be manually refound if not present prefound_kaslr_value = context.layers[layer_name].metadata.get('kaslr_value', 0) context.config[path_join(config_path, requirement.name, "symbol_shift")] = prefound_kaslr_value # Construct the appropriate symbol table requirement.construct(context, config_path) # Apply the ASLR masking (only if we're not already shifted) if self.find_aslr and not context.config.get(path_join(config_path, requirement.name, "symbol_shift"), None): unmasked_symbol_table_name = context.config.get(path_join(config_path, requirement.name), None) if not unmasked_symbol_table_name: raise exceptions.SymbolSpaceError("Symbol table could not be constructed") if not isinstance(layer, layers.intel.Intel): raise TypeError("Layer name {} is not an intel space") aslr_shift = self.find_aslr(context, unmasked_symbol_table_name, layer.config['memory_layer']) context.config[path_join(config_path, requirement.name, "symbol_shift")] = aslr_shift context.symbol_space.clear_symbol_cache(unmasked_symbol_table_name) break else: if symbol_files: vollog.debug("Symbol library path not found: {}".format(symbol_files[0])) # print("Kernel", banner, hex(banner_offset)) else: vollog.debug("No existing banners found") # TODO: Fallback to generic regex search? volatility3-1.0.1/volatility3/framework/automagic/windows.py000066400000000000000000000543331405267600400243050ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """Module to identify the Directory Table Base and architecture of windows memory images. This module contains a PageMapScanner that scans a physical layer to identify self-referential pointers. All windows versions include a self-referential pointer in their Directory Table Base's top table, in order to have a single offset that will allow manipulation of the page tables themselves. In older windows version the self-referential pointer was at a specific fixed index within the table, which was different for each architecture. In very recent Windows versions, the self-referential pointer index has been randomized, so a different heuristic must be used. In these versions of windows it was found that the physical offset for the DTB was always within the range of 0x1a0000 to 0x1b0000. As such, a search for any self-referential pointer within these pages gives a high probability of being an accurate DTB. The self-referential indices for older versions of windows are listed below: +--------------+-------+ | Architecture | Index | +==============+=======+ | x86 | 0x300 | +--------------+-------+ | PAE | 0x3 | +--------------+-------+ | x64 | 0x1ED | +--------------+-------+ """ import logging import struct from typing import Any, Generator, List, Optional, Tuple, Type from volatility3.framework import interfaces, layers, constants from volatility3.framework.configuration import requirements from volatility3.framework.layers import intel vollog = logging.getLogger(__name__) class DtbTest: """This class generically contains the tests for a page based on a set of class parameters. When constructed it contains all the information necessary to extract a specific index from a page and determine whether it points back to that page's offset. """ def __init__(self, layer_type: Type[layers.intel.Intel], ptr_struct: str, ptr_reference: int, mask: int) -> None: self.layer_type = layer_type self.ptr_struct = ptr_struct self.ptr_size = struct.calcsize(ptr_struct) self.ptr_reference = ptr_reference self.mask = mask self.page_size = layer_type.page_size # type: int def _unpack(self, value: bytes) -> int: return struct.unpack("<" + self.ptr_struct, value)[0] def __call__(self, data: bytes, data_offset: int, page_offset: int) -> Optional[Tuple[int, Any]]: """Tests a specific page in a chunk of data to see if it contains a self-referential pointer. Args: data: The chunk of data that contains the page to be scanned data_offset: Where, within the layer, the chunk of data lives page_offset: Where, within the data, the page to be scanned starts Returns: A valid DTB within this page (and an additional parameter for data) """ value = data[page_offset + (self.ptr_reference * self.ptr_size):page_offset + ((self.ptr_reference + 1) * self.ptr_size)] try: ptr = self._unpack(value) except struct.error: return None # The value *must* be present (bit 0) since it's a mapped page # It's almost always writable (bit 1) # It's occasionally Super, but not reliably so, haven't checked when/why not # The top 3-bits are usually ignore (which in practice means 0 # Need to find out why the middle 3-bits are usually 6 (0110) if ptr != 0 and (ptr & self.mask == data_offset + page_offset) & (ptr & 0xFF1 == 0x61): dtb = (ptr & self.mask) return self.second_pass(dtb, data, data_offset) return None def second_pass(self, dtb: int, data: bytes, data_offset: int) -> Optional[Tuple[int, Any]]: """Re-reads over the whole page to validate other records based on the number of pages marked user vs super. Args: dtb: The identified dtb that needs validating data: The chunk of data that contains the dtb to be validated data_offset: Where, within the layer, the chunk of data lives Returns: A valid DTB within this page """ page = data[dtb - data_offset:dtb - data_offset + self.page_size] usr_count, sup_count = 0, 0 for i in range(0, self.page_size, self.ptr_size): val = self._unpack(page[i:i + self.ptr_size]) if val & 0x1: sup_count += 0 if (val & 0x4) else 1 usr_count += 1 if (val & 0x4) else 0 # print(hex(dtb), usr_count, sup_count, usr_count + sup_count) # We sometimes find bogus DTBs at 0x16000 with a very low sup_count and 0 usr_count # I have a winxpsp2-x64 image with identical usr/sup counts at 0x16000 and 0x24c00 as well as the actual 0x3c3000 if usr_count or sup_count > 5: return dtb, None return None class DtbTest32bit(DtbTest): def __init__(self) -> None: super().__init__(layer_type = layers.intel.WindowsIntel, ptr_struct = "I", ptr_reference = 0x300, mask = 0xFFFFF000) class DtbTest64bit(DtbTest): def __init__(self) -> None: super().__init__(layer_type = layers.intel.WindowsIntel32e, ptr_struct = "Q", ptr_reference = 0x1ED, mask = 0x3FFFFFFFFFF000) class DtbTestPae(DtbTest): def __init__(self) -> None: super().__init__(layer_type = layers.intel.WindowsIntelPAE, ptr_struct = "Q", ptr_reference = 0x3, mask = 0x3FFFFFFFFFF000) def second_pass(self, dtb: int, data: bytes, data_offset: int) -> Optional[Tuple[int, Any]]: """PAE top level directory tables contains four entries and the self- referential pointer occurs in the second level of tables (so as not to use up a full quarter of the space). This is very high in the space, and occurs in the fourht (last quarter) second-level table. The second-level tables appear always to come sequentially directly after the real dtb. The value for the real DTB is therefore four page earlier (and the fourth entry should point back to the `dtb` parameter this function was originally passed. Args: dtb: The identified self-referential pointer that needs validating data: The chunk of data that contains the dtb to be validated data_offset: Where, within the layer, the chunk of data lives Returns: Returns the actual DTB of the PAE space """ dtb -= 0x4000 # If we're not in something that the overlap would pick up if dtb - data_offset >= 0: pointers = data[dtb - data_offset + (3 * self.ptr_size):dtb - data_offset + (4 * self.ptr_size)] val = self._unpack(pointers) if (val & self.mask == dtb + 0x4000) and (val & 0xFFF == 0x001): return dtb, None return None class DtbSelfReferential(DtbTest): """A generic DTB test which looks for a self-referential pointer at *any* index within the page.""" def __init__(self, layer_type: Type[layers.intel.Intel], ptr_struct: str, ptr_reference: int, mask: int) -> None: super().__init__(layer_type = layer_type, ptr_struct = ptr_struct, ptr_reference = ptr_reference, mask = mask) def __call__(self, data: bytes, data_offset: int, page_offset: int) -> Optional[Tuple[int, int]]: page = data[page_offset:page_offset + self.page_size] if not page: return None ref_pages = set() for ref in range(0, self.page_size, self.ptr_size): ptr_data = page[ref:ref + self.ptr_size] if len(ptr_data) == self.ptr_size: ptr, = struct.unpack(self.ptr_struct, ptr_data) if ((ptr & self.mask) == (data_offset + page_offset)) and (data_offset + page_offset > 0): ref_pages.add(ref) # The DTB is extremely unlikely to refer back to itself. so the number of reference should always be exactly 1 if len(ref_pages) == 1: return (data_offset + page_offset), ref_pages.pop() return None class DtbSelfRef32bit(DtbSelfReferential): def __init__(self): super().__init__(layer_type = layers.intel.WindowsIntel, ptr_struct = "I", ptr_reference = 0x300, mask = 0xFFFFF000) class DtbSelfRef64bit(DtbSelfReferential): def __init__(self) -> None: super().__init__(layer_type = layers.intel.WindowsIntel32e, ptr_struct = "Q", ptr_reference = 0x1ED, mask = 0x3FFFFFFFFFF000) class PageMapScanner(interfaces.layers.ScannerInterface): """Scans through all pages using DTB tests to determine a dtb offset and architecture.""" overlap = 0x4000 thread_safe = True tests = [DtbTest64bit(), DtbTest32bit(), DtbTestPae()] """The default tests to run when searching for DTBs""" def __init__(self, tests: List[DtbTest]) -> None: super().__init__() self.tests = tests def __call__(self, data: bytes, data_offset: int) -> Generator[Tuple[DtbTest, int], None, None]: for test in self.tests: for page_offset in range(0, len(data), 0x1000): result = test(data, data_offset, page_offset) if result is not None: yield (test, result[0]) class WintelHelper(interfaces.automagic.AutomagicInterface): """Windows DTB finder based on self-referential pointers. This class adheres to the :class:`~volatility3.framework.interfaces.automagic.AutomagicInterface` interface and both determines the directory table base of an intel layer if one hasn't been specified, and constructs the intel layer if necessary (for example when reconstructing a pre-existing configuration). It will scan for existing TranslationLayers that do not have a DTB using the :class:`PageMapScanner` """ priority = 20 tests = [DtbTest64bit(), DtbTest32bit(), DtbTestPae()] def __call__(self, context: interfaces.context.ContextInterface, config_path: str, requirement: interfaces.configuration.RequirementInterface, progress_callback: constants.ProgressCallback = None) -> None: useful = [] sub_config_path = interfaces.configuration.path_join(config_path, requirement.name) if (isinstance(requirement, requirements.TranslationLayerRequirement) and requirement.requirements.get("class", False) and requirement.unsatisfied(context, config_path)): class_req = requirement.requirements["class"] for test in self.tests: if (test.layer_type.__module__ + "." + test.layer_type.__name__ == class_req.config_value( context, sub_config_path)): useful.append(test) # Determine if a class has been chosen # Once an appropriate class has been chosen, attempt to determine the page_map_offset value if ("memory_layer" in requirement.requirements and not requirement.requirements["memory_layer"].unsatisfied(context, sub_config_path)): # Only bother getting the DTB if we don't already have one page_map_offset_path = interfaces.configuration.path_join(sub_config_path, "page_map_offset") if not context.config.get(page_map_offset_path, None): physical_layer_name = requirement.requirements["memory_layer"].config_value( context, sub_config_path) if not isinstance(physical_layer_name, str): raise TypeError("Physical layer name is not a string: {}".format(sub_config_path)) physical_layer = context.layers[physical_layer_name] # Check lower layer metadata first if physical_layer.metadata.get('page_map_offset', None): context.config[page_map_offset_path] = physical_layer.metadata['page_map_offset'] else: hits = physical_layer.scan(context, PageMapScanner(useful), progress_callback) for test, dtb in hits: context.config[page_map_offset_path] = dtb break else: return None if isinstance(requirement, interfaces.configuration.ConstructableRequirementInterface): requirement.construct(context, config_path) else: for subreq in requirement.requirements.values(): self(context, sub_config_path, subreq) class WindowsIntelStacker(interfaces.automagic.StackerLayerInterface): stack_order = 40 exclusion_list = ['mac', 'linux'] @classmethod def stack(cls, context: interfaces.context.ContextInterface, layer_name: str, progress_callback: constants.ProgressCallback = None) -> Optional[interfaces.layers.DataLayerInterface]: """Attempts to determine and stack an intel layer on a physical layer where possible. Where the DTB scan fails, it attempts a heuristic of checking for the DTB within a specific range. New versions of windows, with randomized self-referential pointers, appear to always load their dtb within a small specific range (`0x1a0000` and `0x1b0000`), so instead we scan for all self-referential pointers in that range, and ignore any that contain multiple self-references (since the DTB is very unlikely to point to itself more than once). """ base_layer = context.layers[layer_name] if isinstance(base_layer, intel.Intel): return None if base_layer.metadata.get('os', None) not in ['Windows', 'Unknown']: return None layer = config_path = None # Check the metadata if (base_layer.metadata.get('os', None) == 'Windows' and base_layer.metadata.get('page_map_offset')): arch = base_layer.metadata.get('architecture', None) if arch not in ['Intel32', 'Intel64']: return None # Set the layer type layer_type = intel.WindowsIntel # type: Type if arch == 'Intel64': layer_type = intel.WindowsIntel32e elif base_layer.metadata.get('pae', False): layer_type = intel.WindowsIntelPAE # Construct the layer new_layer_name = context.layers.free_layer_name("IntelLayer") config_path = interfaces.configuration.path_join("IntelHelper", new_layer_name) context.config[interfaces.configuration.path_join(config_path, "memory_layer")] = layer_name context.config[interfaces.configuration.path_join( config_path, "page_map_offset")] = base_layer.metadata['page_map_offset'] layer = layer_type(context, config_path = config_path, name = new_layer_name, metadata = {'os': 'Windows'}) # Check for the self-referential pointer if layer is None: hits = base_layer.scan(context, PageMapScanner(WintelHelper.tests)) layer = None config_path = None for test, dtb in hits: new_layer_name = context.layers.free_layer_name("IntelLayer") config_path = interfaces.configuration.path_join("IntelHelper", new_layer_name) context.config[interfaces.configuration.path_join(config_path, "memory_layer")] = layer_name context.config[interfaces.configuration.path_join(config_path, "page_map_offset")] = dtb layer = test.layer_type(context, config_path = config_path, name = new_layer_name, metadata = {'os': 'Windows'}) break # Fall back to a heuristic for finding the Windows DTB if layer is None: vollog.debug("Self-referential pointer not in well-known location, moving to recent windows heuristic") # There is a very high chance that the DTB will live in this narrow segment, assuming we couldn't find it previously hits = context.layers[layer_name].scan(context, PageMapScanner([DtbSelfRef64bit()]), sections = [(0x1a0000, 0x50000)], progress_callback = progress_callback) # Flatten the generator hits = list(hits) if hits: # TODO: Decide which to use if there are multiple options test, page_map_offset = hits[0] new_layer_name = context.layers.free_layer_name("IntelLayer") config_path = interfaces.configuration.path_join("IntelHelper", new_layer_name) context.config[interfaces.configuration.path_join(config_path, "memory_layer")] = layer_name context.config[interfaces.configuration.path_join(config_path, "page_map_offset")] = page_map_offset # TODO: Need to determine the layer type (chances are high it's x64, hence this default) layer = layers.intel.WindowsIntel32e(context, config_path = config_path, name = new_layer_name, metadata = {'os': 'Windows'}) if layer is not None and config_path: vollog.debug("DTB was found at: 0x{:0x}".format(context.config[interfaces.configuration.path_join( config_path, "page_map_offset")])) return layer class WinSwapLayers(interfaces.automagic.AutomagicInterface): """Class to read swap_layers filenames from single-swap-layers, create the layers and populate the single-layers swap_layers.""" def __call__(self, context: interfaces.context.ContextInterface, config_path: str, requirement: interfaces.configuration.RequirementInterface, progress_callback: constants.ProgressCallback = None) -> None: """Finds translation layers that can have swap layers added.""" path_join = interfaces.configuration.path_join self._translation_requirement = self.find_requirements(context, config_path, requirement, requirements.TranslationLayerRequirement, shortcut = False) for trans_sub_config, trans_req in self._translation_requirement: if not isinstance(trans_req, requirements.TranslationLayerRequirement): # We need this so the type-checker knows we're a TranslationLayerRequirement continue swap_sub_config, swap_req = self.find_swap_requirement(trans_sub_config, trans_req) counter = 0 swap_config = interfaces.configuration.parent_path(swap_sub_config) if swap_req and swap_req.unsatisfied(context, swap_config): # See if any of them need constructing for swap_location in self.config.get('single_swap_locations', []): # Setup config locations/paths current_layer_name = swap_req.name + str(counter) current_layer_path = path_join(swap_sub_config, current_layer_name) layer_loc_path = path_join(current_layer_path, "location") layer_class_path = path_join(current_layer_path, "class") counter += 1 # Fill in the config if swap_location: context.config[current_layer_path] = current_layer_name context.config[layer_loc_path] = swap_location context.config[layer_class_path] = 'volatility3.framework.layers.physical.FileLayer' # Add the requirement new_req = requirements.TranslationLayerRequirement(name = current_layer_name, description = "Swap Layer", optional = False) swap_req.add_requirement(new_req) context.config[path_join(swap_sub_config, 'number_of_elements')] = counter context.config[swap_sub_config] = True swap_req.construct(context, swap_config) @staticmethod def find_swap_requirement(config: str, requirement: requirements.TranslationLayerRequirement) \ -> Tuple[str, Optional[requirements.LayerListRequirement]]: """Takes a Translation layer and returns its swap_layer requirement.""" swap_req = None for req_name in requirement.requirements: req = requirement.requirements[req_name] if isinstance(req, requirements.LayerListRequirement) and req.name == 'swap_layers': swap_req = req continue swap_config = interfaces.configuration.path_join(config, 'swap_layers') return swap_config, swap_req @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: """Returns the requirements of this plugin.""" return [ requirements.ListRequirement( name = "single_swap_locations", element_type = str, min_elements = 0, max_elements = 16, description = "Specifies a list of swap layer URIs for use with single-location", optional = True) ] volatility3-1.0.1/volatility3/framework/configuration/000077500000000000000000000000001405267600400231275ustar00rootroot00000000000000volatility3-1.0.1/volatility3/framework/configuration/__init__.py000066400000000000000000000003711405267600400252410ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from volatility3.framework.configuration import requirements volatility3-1.0.1/volatility3/framework/configuration/requirements.py000066400000000000000000000512321405267600400262270ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """Contains standard Requirement types that all adhere to the :class:`~volatili ty.framework.interfaces.configuration.RequirementInterface`. These requirement types allow plugins to request simple information types (such as strings, integers, etc) as well as indicating what they expect to be in the context (such as particular layers or symboltables). """ import abc import logging from typing import Any, ClassVar, List, Optional, Type, Dict, Tuple from volatility3.framework import constants, interfaces vollog = logging.getLogger(__name__) class MultiRequirement(interfaces.configuration.RequirementInterface): """Class to hold multiple requirements. Technically the Interface could handle this, but it's an interface, so this is a concrete implementation. """ def unsatisfied(self, context: interfaces.context.ContextInterface, config_path: str) -> Dict[str, interfaces.configuration.RequirementInterface]: return self.unsatisfied_children(context, config_path) class BooleanRequirement(interfaces.configuration.SimpleTypeRequirement): """A requirement type that contains a boolean value.""" # Note, this must be a separate class in order to differentiate between Booleans and other instance requirements class IntRequirement(interfaces.configuration.SimpleTypeRequirement): """A requirement type that contains a single integer.""" instance_type = int # type: ClassVar[Type] class StringRequirement(interfaces.configuration.SimpleTypeRequirement): """A requirement type that contains a single unicode string.""" # TODO: Maybe add string length limits? instance_type = str # type: ClassVar[Type] class URIRequirement(StringRequirement): """A requirement type that contains a single unicode string that is a valid URI.""" # TODO: Maybe a a check that to unsatisfied that the path really is a URL? class BytesRequirement(interfaces.configuration.SimpleTypeRequirement): """A requirement type that contains a byte string.""" instance_type = bytes # type: ClassVar[Type] class ListRequirement(interfaces.configuration.RequirementInterface): """Allows for a list of a specific type of requirement (all of which must be met for this requirement to be met) to be specified. This roughly correlates to allowing a number of arguments to follow a command line parameter, such as a list of integers or a list of strings. It is distinct from a multi-requirement which stores the subrequirements in a dictionary, not a list, and does not allow for a dynamic number of values. """ def __init__(self, element_type: Type[interfaces.configuration.SimpleTypes] = str, max_elements: Optional[int] = 0, min_elements: Optional[int] = None, *args, **kwargs) -> None: """Constructs the object. Args: element_type: The (requirement) type of each element within the list max_elements; The maximum number of acceptable elements this list can contain min_elements: The minimum number of acceptable elements this list can contain """ super().__init__(*args, **kwargs) if not issubclass(element_type, interfaces.configuration.BasicTypes): raise TypeError("ListRequirements can only be populated with simple InstanceRequirements") self.element_type = element_type # type: Type self.min_elements = min_elements or 0 # type: int self.max_elements = max_elements # type: Optional[int] def unsatisfied(self, context: interfaces.context.ContextInterface, config_path: str) -> Dict[str, interfaces.configuration.RequirementInterface]: """Check the types on each of the returned values and their number and then call the element type's check for each one.""" config_path = interfaces.configuration.path_join(config_path, self.name) default = None value = self.config_value(context, config_path, default) if not value and self.min_elements > 0: vollog.log(constants.LOGLEVEL_V, "ListRequirement Unsatisfied - ListRequirement has non-zero min_elements") return {config_path: self} if value is None and not self.optional: # We need to differentiate between no value and an empty list vollog.log(constants.LOGLEVEL_V, "ListRequirement Unsatisfied - Value was not specified") return {config_path: self} elif value is None: context.config[config_path] = [] if not isinstance(value, list): # TODO: Check this is the correct response for an error raise TypeError("Unexpected config value found: {}".format(repr(value))) if not (self.min_elements <= len(value)): vollog.log(constants.LOGLEVEL_V, "TypeError - Too few values provided to list option.") return {config_path: self} if self.max_elements and not (len(value) < self.max_elements): vollog.log(constants.LOGLEVEL_V, "TypeError - Too many values provided to list option.") return {config_path: self} if not all([isinstance(element, self.element_type) for element in value]): vollog.log(constants.LOGLEVEL_V, "TypeError - At least one element in the list is not of the correct type.") return {config_path: self} return {} class ChoiceRequirement(interfaces.configuration.RequirementInterface): """Allows one from a choice of strings.""" def __init__(self, choices: List[str], *args, **kwargs) -> None: """Constructs the object. Args: choices: A list of possible string options that can be chosen from """ super().__init__(*args, **kwargs) if not isinstance(choices, list) or any([not isinstance(choice, str) for choice in choices]): raise TypeError("ChoiceRequirement takes a list of strings as choices") self.choices = choices def unsatisfied(self, context: interfaces.context.ContextInterface, config_path: str) -> Dict[str, interfaces.configuration.RequirementInterface]: """Validates the provided value to ensure it is one of the available choices.""" config_path = interfaces.configuration.path_join(config_path, self.name) value = self.config_value(context, config_path) if value not in self.choices: vollog.log(constants.LOGLEVEL_V, "ValueError - Value is not within the set of available choices") return {config_path: self} return {} class ComplexListRequirement(MultiRequirement, interfaces.configuration.ConfigurableRequirementInterface, metaclass = abc.ABCMeta): """Allows a variable length list of requirements.""" def unsatisfied(self, context: interfaces.context.ContextInterface, config_path: str) -> Dict[str, interfaces.configuration.RequirementInterface]: """Validates the provided value to ensure it is one of the available choices.""" config_path = interfaces.configuration.path_join(config_path, self.name) ret_list = super().unsatisfied(context, config_path) if ret_list: return ret_list if (self.config_value(context, config_path, None) is None or self.config_value(context, interfaces.configuration.path_join(config_path, 'number_of_elements'))): return {config_path: self} return {} @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # This is not optional for the stacker to run, so optional must be marked as False return [ IntRequirement("number_of_elements", description = "Determines how many layers are in this list", optional = False) ] @abc.abstractmethod def construct(self, context: interfaces.context.ContextInterface, config_path: str) -> None: """Method for constructing within the context any required elements from subrequirements.""" @abc.abstractmethod def new_requirement(self, index) -> interfaces.configuration.RequirementInterface: """Builds a new requirement based on the specified index.""" def build_configuration(self, context: interfaces.context.ContextInterface, config_path: str, _: Any) -> interfaces.configuration.HierarchicalDict: result = interfaces.configuration.HierarchicalDict() num_elem_config_path = interfaces.configuration.path_join(config_path, self.name, 'number_of_elements') num_elements = context.config.get(num_elem_config_path, None) if num_elements is not None: result["number_of_elements"] = num_elements for i in range(num_elements): req = self.new_requirement(i) self.add_requirement(req) value_path = interfaces.configuration.path_join(config_path, self.name, req.name) value = context.config.get(value_path, None) if value is not None: result.splice(req.name, context.layers[value].build_configuration()) result[req.name] = value return result class LayerListRequirement(ComplexListRequirement): """Allows a variable length list of layers that must exist.""" def construct(self, context: interfaces.context.ContextInterface, config_path: str) -> None: """Method for constructing within the context any required elements from subrequirements.""" new_config_path = interfaces.configuration.path_join(config_path, self.name) num_layers_path = interfaces.configuration.path_join(new_config_path, "number_of_elements") number_of_layers = context.config[num_layers_path] # Build all the layers that can be built for i in range(number_of_layers): layer_req = self.requirements.get(self.name + str(i), None) if layer_req is not None and isinstance(layer_req, TranslationLayerRequirement): layer_req.construct(context, new_config_path) def new_requirement(self, index) -> interfaces.configuration.RequirementInterface: """Constructs a new requirement based on the specified index.""" return TranslationLayerRequirement(name = self.name + str(index), description = "Layer for swap space", optional = False) class TranslationLayerRequirement(interfaces.configuration.ConstructableRequirementInterface, interfaces.configuration.ConfigurableRequirementInterface): """Class maintaining the limitations on what sort of translation layers are acceptable.""" def __init__(self, name: str, description: str = None, default: interfaces.configuration.ConfigSimpleType = None, optional: bool = False, oses: List = None, architectures: List = None) -> None: """Constructs a Translation Layer Requirement. The configuration option's value will be the name of the layer once it exists in the store Args: name: Name of the configuration requirement description: Description of the configuration requirement default: A default value (should not be used for TranslationLayers) optional: Whether the translation layer is required or not oses: A list of valid operating systems which can satisfy this requirement architectures: A list of valid architectures which can satisfy this requirement """ if oses is None: oses = [] if architectures is None: architectures = [] self.oses = oses self.architectures = architectures super().__init__(name, description, default, optional) def unsatisfied(self, context: interfaces.context.ContextInterface, config_path: str) -> Dict[str, interfaces.configuration.RequirementInterface]: """Validate that the value is a valid layer name and that the layer adheres to the requirements.""" config_path = interfaces.configuration.path_join(config_path, self.name) value = self.config_value(context, config_path, None) if isinstance(value, str): if value not in context.layers: vollog.log(constants.LOGLEVEL_V, "IndexError - Layer not found in memory space: {}".format(value)) return {config_path: self} if self.oses and context.layers[value].metadata.get('os', None) not in self.oses: vollog.log(constants.LOGLEVEL_V, "TypeError - Layer is not the required OS: {}".format(value)) return {config_path: self} if (self.architectures and context.layers[value].metadata.get('architecture', None) not in self.architectures): vollog.log(constants.LOGLEVEL_V, "TypeError - Layer is not the required Architecture: {}".format(value)) return {config_path: self} return {} if value is not None: vollog.log(constants.LOGLEVEL_V, "TypeError - Translation Layer Requirement only accepts string labels: {}".format(repr(value))) return {config_path: self} # TODO: check that the space in the context lives up to the requirements for arch/os etc ### NOTE: This validate method has side effects (the dependencies can change)!!! self._validate_class(context, interfaces.configuration.parent_path(config_path)) vollog.log(constants.LOGLEVEL_V, "IndexError - No configuration provided: {}".format(config_path)) return {config_path: self} def construct(self, context: interfaces.context.ContextInterface, config_path: str) -> None: """Constructs the appropriate layer and adds it based on the class parameter.""" config_path = interfaces.configuration.path_join(config_path, self.name) # Determine the layer name name = self.name counter = 2 while name in context.layers: name = self.name + str(counter) counter += 1 args = {"context": context, "config_path": config_path, "name": name} if any( [subreq.unsatisfied(context, config_path) for subreq in self.requirements.values() if not subreq.optional]): return None obj = self._construct_class(context, config_path, args) if obj is not None and isinstance(obj, interfaces.layers.DataLayerInterface): context.add_layer(obj) # This should already be done by the _construct_class method # context.config[config_path] = obj.name return None def build_configuration(self, context: interfaces.context.ContextInterface, _: str, value: Any) -> interfaces.configuration.HierarchicalDict: """Builds the appropriate configuration for the specified requirement.""" return context.layers[value].build_configuration() class SymbolTableRequirement(interfaces.configuration.ConstructableRequirementInterface, interfaces.configuration.ConfigurableRequirementInterface): """Class maintaining the limitations on what sort of symbol spaces are acceptable.""" def unsatisfied(self, context: interfaces.context.ContextInterface, config_path: str) -> Dict[str, interfaces.configuration.RequirementInterface]: """Validate that the value is a valid within the symbol space of the provided context.""" config_path = interfaces.configuration.path_join(config_path, self.name) value = self.config_value(context, config_path, None) if not isinstance(value, str) and value is not None: vollog.log(constants.LOGLEVEL_V, "TypeError - SymbolTableRequirement only accepts string labels: {}".format(repr(value))) return {config_path: self} if value and value in context.symbol_space: # This is an expected situation, so return rather than raise return {} elif value: vollog.log(constants.LOGLEVEL_V, "IndexError - Value not present in the symbol space: {}".format(value or "")) ### NOTE: This validate method has side effects (the dependencies can change)!!! self._validate_class(context, interfaces.configuration.parent_path(config_path)) vollog.log(constants.LOGLEVEL_V, "Symbol table requirement not yet fulfilled: {}".format(config_path)) return {config_path: self} def construct(self, context: interfaces.context.ContextInterface, config_path: str) -> None: """Constructs the symbol space within the context based on the subrequirements.""" config_path = interfaces.configuration.path_join(config_path, self.name) # Determine the space name name = context.symbol_space.free_table_name(self.name) args = {"context": context, "config_path": config_path, "name": name} if any( [subreq.unsatisfied(context, config_path) for subreq in self.requirements.values() if not subreq.optional]): return None # Fill out the parameter for class creation if not isinstance(self.requirements["class"], interfaces.configuration.ClassRequirement): raise TypeError("Class requirement is not of type ClassRequirement: {}".format( repr(self.requirements["class"]))) cls = self.requirements["class"].cls node_config = context.config.branch(config_path) for req in cls.get_requirements(): if req.name in node_config.data and req.name != "class": args[req.name] = node_config.data[req.name] obj = self._construct_class(context, config_path, args) if obj is not None and isinstance(obj, interfaces.symbols.SymbolTableInterface): context.symbol_space.append(obj) return None def build_configuration(self, context: interfaces.context.ContextInterface, _: str, value: Any) -> interfaces.configuration.HierarchicalDict: """Builds the appropriate configuration for the specified requirement.""" return context.symbol_space[value].build_configuration() class VersionRequirement(interfaces.configuration.RequirementInterface): def __init__(self, name: str, description: str = None, default: bool = False, optional: bool = False, component: Type[interfaces.configuration.VersionableInterface] = None, version: Optional[Tuple[int, ...]] = None) -> None: super().__init__(name = name, description = description, default = default, optional = optional) if component is None: raise TypeError("Component cannot be None") self._component = component if version is None: raise TypeError("Version cannot be None") self._version = version def unsatisfied(self, context: interfaces.context.ContextInterface, config_path: str) -> Dict[str, interfaces.configuration.RequirementInterface]: # Mypy doesn't appreciate our classproperty implementation, self._plugin.version has no type config_path = interfaces.configuration.path_join(config_path, self.name) if len(self._version) > 0 and self._component.version[0] != self._version[0]: return {config_path: self} if len(self._version) > 1 and self._component.version[1] < self._version[1]: return {config_path: self} context.config[interfaces.configuration.path_join(config_path, self.name)] = True return {} class PluginRequirement(VersionRequirement): def __init__(self, name: str, description: str = None, default: bool = False, optional: bool = False, plugin: Type[interfaces.plugins.PluginInterface] = None, version: Optional[Tuple[int, ...]] = None) -> None: super().__init__(name = name, description = description, default = default, optional = optional, component = plugin, version = version) volatility3-1.0.1/volatility3/framework/constants/000077500000000000000000000000001405267600400222745ustar00rootroot00000000000000volatility3-1.0.1/volatility3/framework/constants/__init__.py000066400000000000000000000071521405267600400244120ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """Volatility 3 Constants. Stores all the constant values that are generally fixed throughout volatility This includes default scanning block sizes, etc. """ import enum import os.path import sys from typing import Optional, Callable import volatility3.framework.constants.linux import volatility3.framework.constants.windows PLUGINS_PATH = [ os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "plugins")), os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "plugins")) ] """Default list of paths to load plugins from (volatility3/plugins and volatility3/framework/plugins)""" SYMBOL_BASEPATHS = [ os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "symbols")), os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "symbols")) ] """Default list of paths to load symbols from (volatility3/symbols and volatility3/framework/symbols)""" ISF_EXTENSIONS = ['.json', '.json.xz', '.json.gz', '.json.bz2'] """List of accepted extensions for ISF files""" if hasattr(sys, 'frozen') and sys.frozen: # Ensure we include the executable's directory as the base for plugins and symbols PLUGINS_PATH = [os.path.abspath(os.path.join(os.path.dirname(sys.executable), 'plugins'))] + PLUGINS_PATH SYMBOL_BASEPATHS = [os.path.abspath(os.path.join(os.path.dirname(sys.executable), 'symbols'))] + SYMBOL_BASEPATHS BANG = "!" """Constant used to delimit table names from type names when referring to a symbol""" # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 1 # Number of releases of the library with a breaking change VERSION_MINOR = 0 # Number of changes that only add to the interface VERSION_PATCH = 1 # Number of changes that do not change the interface VERSION_SUFFIX = "" PACKAGE_VERSION = ".".join([str(x) for x in [VERSION_MAJOR, VERSION_MINOR, VERSION_PATCH]]) + VERSION_SUFFIX """The canonical version of the volatility3 package""" AUTOMAGIC_CONFIG_PATH = 'automagic' """The root section within the context configuration for automagic values""" LOGLEVEL_V = 9 """Logging level for a single -v""" LOGLEVEL_VV = 8 """Logging level for -vv""" LOGLEVEL_VVV = 7 """Logging level for -vvv""" LOGLEVEL_VVVV = 6 """Logging level for -vvvv""" CACHE_PATH = os.path.join(os.path.expanduser("~"), ".cache", "volatility3") """Default path to store cached data""" if sys.platform == 'windows': CACHE_PATH = os.path.join(os.environ.get("APPDATA", os.path.expanduser("~")), "volatility3") os.makedirs(CACHE_PATH, exist_ok = True) LINUX_BANNERS_PATH = os.path.join(CACHE_PATH, "linux_banners.cache") """"Default location to record information about available linux banners""" MAC_BANNERS_PATH = os.path.join(CACHE_PATH, "mac_banners.cache") """"Default location to record information about available mac banners""" BUG_URL = "https://github.com/volatilityfoundation/volatility3/issues" ProgressCallback = Optional[Callable[[float, str], None]] """Type information for ProgressCallback objects""" class Parallelism(enum.IntEnum): """An enumeration listing the different types of parallelism applied to volatility.""" Off = 0 Threading = 1 Multiprocessing = 2 PARALLELISM = Parallelism.Off """Default value to the parallelism setting used throughout volatility""" ISF_MINIMUM_SUPPORTED = (2, 0, 0) """The minimum supported version of the Intermediate Symbol Format""" ISF_MINIMUM_DEPRECATED = (3, 9, 9) """The highest version of the ISF that's deprecated (usually higher than supported)""" volatility3-1.0.1/volatility3/framework/constants/linux/000077500000000000000000000000001405267600400234335ustar00rootroot00000000000000volatility3-1.0.1/volatility3/framework/constants/linux/__init__.py000066400000000000000000000007101405267600400255420ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """Volatility 3 Linux Constants. Linux-specific values that aren't found in debug symbols """ KERNEL_NAME = "__kernel__" # arch/x86/include/asm/page_types.h PAGE_SHIFT = 12 """The value hard coded from the Linux Kernel (hence not extracted from the layer itself)""" volatility3-1.0.1/volatility3/framework/constants/windows/000077500000000000000000000000001405267600400237665ustar00rootroot00000000000000volatility3-1.0.1/volatility3/framework/constants/windows/__init__.py000066400000000000000000000006571405267600400261070ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """Volatility 3 Linux Constants. Windows-specific values that aren't found in debug symbols """ KERNEL_MODULE_NAMES = ["ntkrnlmp", "ntkrnlpa", "ntkrpamp", "ntoskrnl"] """The list of names that kernel modules can have within the windows OS""" volatility3-1.0.1/volatility3/framework/contexts/000077500000000000000000000000001405267600400221275ustar00rootroot00000000000000volatility3-1.0.1/volatility3/framework/contexts/__init__.py000066400000000000000000000370201405267600400242420ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """A `Context` maintains the accumulated state required for various plugins and framework functions. This has been made an object to allow quick swapping and changing of contexts, to allow a plugin to act on multiple different contexts without them interfering eith each other. """ import functools import hashlib from typing import Callable, Dict, Iterable, List, Optional, Set, Tuple, Union from volatility3.framework import constants, interfaces, symbols, exceptions from volatility3.framework.objects import templates class Context(interfaces.context.ContextInterface): """Maintains the context within which to construct objects. The context object is the main method of carrying around state that's been constructed for the purposes of investigating memory. It contains a symbol_space of all the symbols that can be accessed by plugins using the context. It also contains the memory made up of data and translation layers, and it contains a factory method for creating new objects. Other context objects can be constructed as long as they support the :class:`~volatility3.framework.interfaces.context.ContextInterface`. This is the primary context object to be used in the volatility framework. It maintains the """ def __init__(self) -> None: """Initializes the context.""" super().__init__() self._symbol_space = symbols.SymbolSpace() self._memory = interfaces.layers.LayerContainer() self._config = interfaces.configuration.HierarchicalDict() # ## Symbol Space Functions @property def config(self) -> interfaces.configuration.HierarchicalDict: """Returns a mutable copy of the configuration, but does not allow the whole configuration to be altered.""" return self._config @config.setter def config(self, value: interfaces.configuration.HierarchicalDict) -> None: if not isinstance(value, interfaces.configuration.HierarchicalDict): raise TypeError("Config must be of type HierarchicalDict") self._config = value @property def symbol_space(self) -> interfaces.symbols.SymbolSpaceInterface: """The space of all symbols that can be accessed within this context.""" return self._symbol_space @property def layers(self) -> interfaces.layers.LayerContainer: """A LayerContainer object, allowing access to all data and translation layers currently available within the context.""" return self._memory # ## Translation Layer Functions def add_layer(self, layer: interfaces.layers.DataLayerInterface) -> None: """Adds a named translation layer to the context. Args: layer: The layer to be added to the memory Raises: volatility3.framework.exceptions.LayerException: if the layer is already present, or has unmet dependencies """ self._memory.add_layer(layer) # ## Object Factory Functions def object(self, object_type: Union[str, interfaces.objects.Template], layer_name: str, offset: int, native_layer_name: Optional[str] = None, **arguments) -> interfaces.objects.ObjectInterface: """Object factory, takes a context, symbol, offset and optional layername. Looks up the layername in the context, finds the object template based on the symbol, and constructs an object using the object template on the layer at the offset. Args: object_type: The name (or template) of the symbol type on which to construct the object. If this is a name, it should contain an explicit table name. layer_name: The name of the layer on which to construct the object offset: The offset within the layer at which the data used to create the object lives native_layer_name: The name of the layer the object references (for pointers) if different to layer_name Returns: A fully constructed object """ if not isinstance(object_type, interfaces.objects.Template): try: object_template = self._symbol_space.get_type(object_type) except exceptions.SymbolError: object_template = self._symbol_space.get_enumeration(object_type) else: if isinstance(object_type, templates.ReferenceTemplate): object_type = self._symbol_space.get_type(object_type.vol.type_name) object_template = object_type # Ensure that if a pre-constructed type is provided we just instantiate it arguments.update(object_template.vol) object_template = object_template.clone() object_template.update_vol(**arguments) return object_template(context = self, object_info = interfaces.objects.ObjectInformation(layer_name = layer_name, offset = offset, native_layer_name = native_layer_name, size = object_template.size)) def module(self, module_name: str, layer_name: str, offset: int, native_layer_name: Optional[str] = None, size: Optional[int] = None) -> interfaces.context.ModuleInterface: """Constructs a new os-independent module. Args: module_name: The name of the module layer_name: The layer within the context in which the module exists offset: The offset at which the module exists in the layer native_layer_name: The default native layer for objects constructed by the module size: The size, in bytes, that the module occupys from offset location within the layer named layer_name """ if size: return SizedModule(self, module_name = module_name, layer_name = layer_name, offset = offset, size = size, native_layer_name = native_layer_name) return Module(self, module_name = module_name, layer_name = layer_name, offset = offset, native_layer_name = native_layer_name) def get_module_wrapper(method: str) -> Callable: """Returns a symbol using the symbol_table_name of the Module.""" def wrapper(self, name: str) -> Callable: if constants.BANG not in name: name = self._module_name + constants.BANG + name else: raise ValueError("Cannot reference another module when calling {}".format(method)) return getattr(self._context.symbol_space, method)(name) for entry in ['__annotations__', '__doc__', '__module__', '__name__', '__qualname__']: proxy_interface = getattr(interfaces.context.ModuleInterface, method) if hasattr(proxy_interface, entry): setattr(wrapper, entry, getattr(proxy_interface, entry)) return wrapper class Module(interfaces.context.ModuleInterface): def object(self, object_type: str, offset: int = None, native_layer_name: Optional[str] = None, absolute: bool = False, **kwargs) -> 'interfaces.objects.ObjectInterface': """Returns an object created using the symbol_table_name and layer_name of the Module. Args: object_type: Name of the type/enumeration (within the module) to construct offset: The location of the object, ignored when symbol_type is SYMBOL native_layer_name: Name of the layer in which constructed objects are made (for pointers) absolute: whether the type's offset is absolute within memory or relative to the module """ if constants.BANG not in object_type: object_type = self.symbol_table_name + constants.BANG + object_type else: raise ValueError("Cannot reference another module when constructing an object") if offset is None: raise TypeError("Offset must not be None for non-symbol objects") if not absolute: offset += self._offset # Ensure we don't use a layer_name other than the module's, why would anyone do that? if 'layer_name' in kwargs: del kwargs['layer_name'] return self._context.object(object_type = object_type, layer_name = self._layer_name, offset = offset, native_layer_name = native_layer_name or self._native_layer_name, **kwargs) def object_from_symbol(self, symbol_name: str, native_layer_name: Optional[str] = None, absolute: bool = False, **kwargs) -> 'interfaces.objects.ObjectInterface': """Returns an object based on a specific symbol (containing type and offset information) and the layer_name of the Module. This will throw a ValueError if the symbol does not contain an associated type, or if the symbol name is invalid. It will throw a SymbolError if the symbol cannot be found. Args: symbol_name: Name of the symbol (within the module) to construct native_layer_name: Name of the layer in which constructed objects are made (for pointers) absolute: whether the symbol's address is absolute or relative to the module """ if constants.BANG not in symbol_name: symbol_name = self.symbol_table_name + constants.BANG + symbol_name else: raise ValueError("Cannot reference another module when constructing an object") # Only set the offset if type is Symbol and we were given a name, not a template symbol_val = self._context.symbol_space.get_symbol(symbol_name) offset = symbol_val.address if not absolute: offset += self._offset if symbol_val.type is None: raise TypeError("Symbol {} has no associated type".format(symbol_val.name)) # Ensure we don't use a layer_name other than the module's, why would anyone do that? if 'layer_name' in kwargs: del kwargs['layer_name'] # Since type may be a template, we don't just call our own module method return self._context.object(object_type = symbol_val.type, layer_name = self._layer_name, offset = offset, native_layer_name = native_layer_name or self._native_layer_name, **kwargs) get_symbol = get_module_wrapper('get_symbol') get_type = get_module_wrapper('get_type') get_enumeration = get_module_wrapper('get_enumeration') has_symbol = get_module_wrapper('has_symbol') has_type = get_module_wrapper('has_type') has_enumeration = get_module_wrapper('has_enumeration') class SizedModule(Module): def __init__(self, context: interfaces.context.ContextInterface, module_name: str, layer_name: str, offset: int, size: int, symbol_table_name: Optional[str] = None, native_layer_name: Optional[str] = None) -> None: super().__init__(context, module_name = module_name, layer_name = layer_name, offset = offset, native_layer_name = native_layer_name, symbol_table_name = symbol_table_name) self._size = size @property def size(self) -> int: """Returns the size of the module (0 for unknown size)""" return self._size @property # type: ignore # FIXME: mypy #5107 @functools.lru_cache() def hash(self) -> str: """Hashes the module for equality checks. The mapping should be sorted and should be quicker than reading the data We turn it into JSON to make a common string and use a quick hash, because collissions are unlikely """ layer = self._context.layers[self.layer_name] if not isinstance(layer, interfaces.layers.TranslationLayerInterface): raise TypeError("Hashing modules on non-TranslationLayers is not allowed") return hashlib.md5(bytes(str(list(layer.mapping(self.offset, self.size, ignore_errors = True))), 'utf-8')).hexdigest() def get_symbols_by_absolute_location(self, offset: int, size: int = 0) -> List[str]: """Returns the symbols within this module that live at the specified absolute offset provided.""" if size < 0: raise ValueError("Size must be strictly non-negative") if offset > self._offset + self.size: return [] return list( self._context.symbol_space.get_symbols_by_location(offset = offset - self._offset, size = size, table_name = self.symbol_table_name)) class ModuleCollection: """Class to contain a collection of SizedModules and reason about their contents.""" def __init__(self, modules: List[SizedModule]) -> None: self._modules = modules def deduplicate(self) -> 'ModuleCollection': """Returns a new deduplicated ModuleCollection featuring no repeated modules (based on data hash) All 0 sized modules will have identical hashes and are therefore included in the deduplicated version """ new_modules = [] seen = set() # type: Set[str] for mod in self._modules: if mod.hash not in seen or mod.size == 0: new_modules.append(mod) seen.add(mod.hash) # type: ignore # FIXME: mypy #5107 return ModuleCollection(new_modules) @property def modules(self) -> Dict[str, List[SizedModule]]: """A name indexed dictionary of modules using that name in this collection.""" return self._generate_module_dict(self._modules) @classmethod def _generate_module_dict(cls, modules: List[SizedModule]) -> Dict[str, List[SizedModule]]: result = {} # type: Dict[str, List[SizedModule]] for module in modules: modlist = result.get(module.name, []) modlist.append(module) result[module.name] = modlist return result def get_module_symbols_by_absolute_location(self, offset: int, size: int = 0) -> Iterable[Tuple[str, List[str]]]: """Returns a tuple of (module_name, list_of_symbol_names) for each module, where symbols live at the absolute offset in memory provided.""" if size < 0: raise ValueError("Size must be strictly non-negative") for module in self._modules: if (offset <= module.offset + module.size) and (offset + size >= module.offset): yield (module.name, module.get_symbols_by_absolute_location(offset, size)) volatility3-1.0.1/volatility3/framework/exceptions.py000066400000000000000000000071351405267600400230210ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """A list of potential exceptions that volatility can throw. These include exceptions that can be thrown on errors by the symbol space or symbol tables, and by layers when an address is invalid. The :class:`PagedInvalidAddressException` contains information about the size of the invalid page. """ from typing import Dict, Optional from volatility3.framework import interfaces class VolatilityException(Exception): """Class to allow filtering of all VolatilityExceptions.""" class PluginVersionException(VolatilityException): """Class to allow determining that a required plugin has an invalid version.""" class PluginRequirementException(VolatilityException): """Class to allow plugins to indicate that a requirement has not been fulfilled.""" class SymbolError(VolatilityException): """Thrown when a symbol lookup has failed.""" def __init__(self, symbol_name: Optional[str], table_name: Optional[str], *args) -> None: super().__init__(*args) self.symbol_name = symbol_name self.table_name = table_name class LayerException(VolatilityException): """Thrown when an error occurs dealing with memory and layers.""" def __init__(self, layer_name: str, *args) -> None: super().__init__(*args) self.layer_name = layer_name class InvalidAddressException(LayerException): """Thrown when an address is not valid in the layer it was requested.""" def __init__(self, layer_name: str, invalid_address: int, *args) -> None: super().__init__(layer_name, *args) self.invalid_address = invalid_address class PagedInvalidAddressException(InvalidAddressException): """Thrown when an address is not valid in the paged space in which it was request. This is a subclass of InvalidAddressException and is only thrown from a paged layer. In most circumstances :class:`InvalidAddressException` is the correct exception to throw, since this will catch all invalid mappings (including paged ones). Includes the invalid address and the number of bits of the address that are invalid """ def __init__(self, layer_name: str, invalid_address: int, invalid_bits: int, entry: int, *args) -> None: super().__init__(layer_name, invalid_address, *args) self.invalid_bits = invalid_bits self.entry = entry class SwappedInvalidAddressException(PagedInvalidAddressException): """Thrown when an address is not valid in the paged layer in which it was requested, but expected to be in an associated swap layer. Includes the swap lookup, as well as the invalid address and the bits of the lookup that were invalid. """ def __init__(self, layer_name: str, invalid_address: int, invalid_bits: int, entry: int, swap_offset: int, *args) -> None: super().__init__(layer_name, invalid_address, invalid_bits, entry, *args) self.swap_offset = swap_offset class SymbolSpaceError(VolatilityException): """Thrown when an error occurs dealing with Symbolspaces and SymbolTables.""" class UnsatisfiedException(VolatilityException): def __init__(self, unsatisfied: Dict[str, interfaces.configuration.RequirementInterface]) -> None: super().__init__() self.unsatisfied = unsatisfied class MissingModuleException(VolatilityException): def __init__(self, module: str, *args, **kwargs) -> None: super().__init__(*args, **kwargs) self.module = module volatility3-1.0.1/volatility3/framework/interfaces/000077500000000000000000000000001405267600400224035ustar00rootroot00000000000000volatility3-1.0.1/volatility3/framework/interfaces/__init__.py000066400000000000000000000014561405267600400245220ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """The interfaces module contains the API interface for the core volatility framework. These interfaces should help developers attempting to write components for the main framework and help them understand how to use the internal components of volatility to write plugins. """ # Import the submodules we want people to be able to use without importing them themselves # This will also avoid namespace issues, because people can use interfaces.layers to # avoid clashing with the layers package from volatility3.framework.interfaces import renderers, configuration, context, layers, objects, plugins, symbols, \ automagic volatility3-1.0.1/volatility3/framework/interfaces/automagic.py000066400000000000000000000145251405267600400247350ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """Defines the automagic interfaces for populating the context before a plugin runs. Automagic objects attempt to automatically fill configuration values that a user has not filled. """ import logging from abc import ABCMeta from typing import Any, List, Optional, Tuple, Union, Type from volatility3.framework import interfaces, constants from volatility3.framework.configuration import requirements vollog = logging.getLogger(__name__) class AutomagicInterface(interfaces.configuration.ConfigurableInterface, metaclass = ABCMeta): """Class that defines an automagic component that can help fulfill `Requirements` These classes are callable with the following parameters: Args: context: The context in which to store configuration data that the automagic might populate config_path: Configuration path where the configurable's data under the context's config lives configurable: The top level configurable whose requirements may need statisfying progress_callback: An optional function accepting a percentage and optional description to indicate progress during long calculations .. note:: The `context` provided here may be different to that provided during initialization. The `context` provided at initialization should be used for local configuration of the automagic itself, the `context` provided during the call is to be populated by the automagic. """ priority = 10 """An ordering to indicate how soon this automagic should be run""" def __init__(self, context: interfaces.context.ContextInterface, config_path: str, *args, **kwargs) -> None: super().__init__(context, config_path) for requirement in self.get_requirements(): if not isinstance(requirement, (interfaces.configuration.SimpleTypeRequirement, requirements.ChoiceRequirement, requirements.ListRequirement)): raise TypeError( "Automagic requirements must be a SimpleTypeRequirement, ChoiceRequirement or ListRequirement") def __call__(self, context: interfaces.context.ContextInterface, config_path: str, requirement: interfaces.configuration.RequirementInterface, progress_callback: constants.ProgressCallback = None) -> Optional[List[Any]]: """Runs the automagic over the configurable.""" return [] # TODO: requirement_type can be made UnionType[Type[T], Tuple[Type[T], ...]] # once mypy properly supports Tuples in instance def find_requirements(self, context: interfaces.context.ContextInterface, config_path: str, requirement_root: interfaces.configuration.RequirementInterface, requirement_type: Union[Tuple[Type[interfaces.configuration.RequirementInterface], ...], Type[interfaces.configuration.RequirementInterface]], shortcut: bool = True) -> List[Tuple[str, interfaces.configuration.RequirementInterface]]: """Determines if there is actually an unfulfilled `Requirement` waiting. This ensures we do not carry out an expensive search when there is no need for a particular `Requirement` Args: context: Context on which to operate config_path: Configuration path of the top-level requirement requirement_root: Top-level requirement whose subrequirements will all be searched requirement_type: Type of requirement to find shortcut: Only returns requirements that live under unsatisfied requirements Returns: A list of tuples containing the config_path, sub_config_path and requirement identifying the unsatisfied `Requirements` """ sub_config_path = interfaces.configuration.path_join(config_path, requirement_root.name) results = [] # type: List[Tuple[str, interfaces.configuration.RequirementInterface]] recurse = not shortcut if isinstance(requirement_root, requirement_type): if recurse or requirement_root.unsatisfied(context, config_path): results.append((sub_config_path, requirement_root)) else: recurse = True if recurse: for subreq in requirement_root.requirements.values(): results += self.find_requirements(context, sub_config_path, subreq, requirement_type, shortcut) return results class StackerLayerInterface(metaclass = ABCMeta): """Class that takes a lower layer and attempts to build on it. stack_order determines the order (from low to high) that stacking layers should be attempted lower levels should have lower `stack_orders` """ stack_order = 0 """The order in which to attempt stacking, the lower the earlier""" exclusion_list = [] # type: List[str] """The list operating systems/first-level plugin hierarchy that should exclude this stacker""" @classmethod def stack(self, context: interfaces.context.ContextInterface, layer_name: str, progress_callback: constants.ProgressCallback = None) -> Optional[interfaces.layers.DataLayerInterface]: """Method to determine whether this builder can operate on the named layer. If so, modify the context appropriately. Returns the name of any new layer stacked on top of this layer or None. The stacking is therefore strictly linear rather than tree driven. Configuration options provided by the context are ignored, and defaults are to be used by this method to build a space where possible. Args: context: Context in which to construct the higher layer layer_name: Name of the layer to stack on top of progress_callback: A callback function to indicate progress through a scan (if one is necessary) """ @classmethod def stacker_slow_warning(cls): vollog.warning( "Reads to this layer are slow, it's recommended to use the layerwriter plugin once to produce a raw file") volatility3-1.0.1/volatility3/framework/interfaces/configuration.py000066400000000000000000000740501405267600400256320ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """The configuration module contains classes and functions for interacting with the configuration and requirement trees. Volatility plugins can specify a list of requirements (which may have subrequirements, thus forming a requirement tree). These requirement trees can contain values, which are contained in a complementary configuration tree. These two trees act as a protocol between the plugins and users. The plugins provide requirements that must be fulfilled, and the users provide configurations values that fulfill those requirements. Where the user does not provide sufficient configuration values, automagic modules may extend the configuration tree themselves. """ import collections.abc import copy import json import logging import random import string import sys from abc import ABCMeta, abstractmethod from typing import Any, ClassVar, Dict, Generator, Iterator, List, Optional, Type, Union, Tuple from volatility3 import classproperty from volatility3.framework import constants, interfaces CONFIG_SEPARATOR = "." """Use to specify the separator between configuration hierarchies""" vollog = logging.getLogger(__name__) BasicTypes = (int, bool, bytes, str) SimpleTypes = Union[int, bool, bytes, str] ConfigSimpleType = Optional[Union[SimpleTypes, List[SimpleTypes]]] def path_join(*args) -> str: """Joins configuration paths together.""" # If a path element (particularly the first) is empty, then remove it from the list args = tuple([arg for arg in args if arg]) return CONFIG_SEPARATOR.join(args) def parent_path(value: str) -> str: """Returns the parent configuration path from a configuration path.""" return CONFIG_SEPARATOR.join(value.split(CONFIG_SEPARATOR)[:-1]) def path_head(value: str) -> str: """Return the top of the configuration path""" return value.split(CONFIG_SEPARATOR)[-1] def path_depth(path: str, depth: int = 1) -> str: """Returns the `path` up to a certain depth. Note that `depth` can be negative (such as `-x`) and will return all elements except for the last `x` components """ return path_join(path.split(CONFIG_SEPARATOR)[:depth]) class HierarchicalDict(collections.abc.Mapping): """The core of configuration data, it is a mapping class that stores keys within itself, and also stores lower hierarchies.""" def __init__(self, initial_dict: Dict[str, 'SimpleTypeRequirement'] = None, separator: str = CONFIG_SEPARATOR) -> None: """ Args: initial_dict: A dictionary to populate the HierachicalDict with initially separator: A custom hierarchy separator (defaults to CONFIG_SEPARATOR) """ if not (isinstance(separator, str) and len(separator) == 1): raise TypeError("Separator must be a one character string: {}".format(separator)) self._separator = separator self._data = {} # type: Dict[str, ConfigSimpleType] self._subdict = {} # type: Dict[str, 'HierarchicalDict'] if isinstance(initial_dict, str): initial_dict = json.loads(initial_dict) if isinstance(initial_dict, dict): for k, v in initial_dict.items(): self[k] = v elif initial_dict is not None: raise TypeError( "Initial_dict must be a dictionary or JSON string containing a dictionary: {}".format(initial_dict)) def __eq__(self, other): """Define equality between HierarchicalDicts""" return dict(self) == dict(other) @property def separator(self) -> str: """Specifies the hierarchy separator in use in this HierarchyDict.""" return self._separator @property def data(self) -> Dict: """Returns just the data-containing mappings on this level of the Hierarchy.""" return self._data.copy() def _key_head(self, key: str) -> str: """Returns the first division of a key based on the dict separator, or the full key if the separator is not present.""" if self.separator in key: return key[:key.index(self.separator)] else: return key def _key_tail(self, key: str) -> str: """Returns all but the first division of a key based on the dict separator, or None if the separator is not in the key.""" if self.separator in key: return key[key.index(self.separator) + 1:] return '' def __iter__(self) -> Iterator[Any]: """Returns an iterator object that supports the iterator protocol.""" return self.generator() def generator(self) -> Generator[str, None, None]: """A generator for the data in this level and lower levels of this mapping. Returns: Returns each item in the top level data, and then all subkeys in a depth first order """ for key in self._data: yield key for subdict_key in self._subdict: for key in self._subdict[subdict_key]: yield subdict_key + self.separator + key def __getitem__(self, key: str) -> ConfigSimpleType: """Gets an item, traversing down the trees to get to the final value.""" try: if self.separator in key: subdict = self._subdict[self._key_head(key)] return subdict[self._key_tail(key)] else: return self._data[key] except KeyError: raise KeyError(key) def __setitem__(self, key: str, value: Any) -> None: """Sets an item or creates a subdict and sets the item within that.""" self._setitem(key, value) def _setitem(self, key: str, value: Any, is_data: bool = True) -> None: """Set an item or appends a whole subtree at a key location.""" if self.separator in key: subdict = self._subdict.get(self._key_head(key), HierarchicalDict(separator = self.separator)) subdict._setitem(self._key_tail(key), value, is_data) self._subdict[self._key_head(key)] = subdict else: if is_data: self._data[key] = self._sanitize_value(value) else: if not isinstance(value, HierarchicalDict): raise TypeError( "HierarchicalDicts can only store HierarchicalDicts within their structure: {}".format( type(value))) self._subdict[key] = value def _sanitize_value(self, value: Any) -> ConfigSimpleType: """Method to ensure all values are standard values and not volatility objects containing contexts.""" if isinstance(value, bool): return bool(value) elif isinstance(value, int): return int(value) elif isinstance(value, str): return str(value) elif isinstance(value, bytes): return bytes(value) elif isinstance(value, list): new_list = [] for element in value: element_value = self._sanitize_value(element) if isinstance(element_value, list): raise TypeError("Configuration list types cannot contain list types") new_list.append(element_value) return new_list elif value is None: return None else: raise TypeError("Invalid type stored in configuration") def __delitem__(self, key: str) -> None: """Deletes an item from the hierarchical dict.""" try: if self.separator in key: subdict = self._subdict[self._key_head(key)] del subdict[self._key_tail(key)] else: del self._data[self._key_head(key)] except KeyError: raise KeyError(key) def __contains__(self, key: Any) -> bool: """Determines whether the key is present in the hierarchy.""" if self.separator in key: try: subdict = self._subdict[self._key_head(key)] return self._key_tail(key) in subdict except KeyError: return False else: return key in self._data def __len__(self) -> int: """Returns the length of all items.""" return len(self._data) + sum([len(subdict) for subdict in self._subdict]) def branch(self, key: str) -> 'HierarchicalDict': """Returns the HierarchicalDict housed under the key. This differs from the data property, in that it is directed by the `key`, and all layers under that key are returned, not just those in that level. Higher layers are not prefixed with the location of earlier layers, so branching a hierarchy containing `a.b.c.d` on `a.b` would return a hierarchy containing `c.d`, not `a.b.c.d`. Args: key: The location within the hierarchy to return higher layers. Returns: The HierarchicalDict underneath the specified key (not just the data at that key location in the tree) """ try: if self.separator in key: return self._subdict[self._key_head(key)].branch(self._key_tail(key)) else: return self._subdict[key] except KeyError: self._setitem(key = key, value = HierarchicalDict(separator = self.separator), is_data = False) return HierarchicalDict() def splice(self, key: str, value: 'HierarchicalDict') -> None: """Splices an existing HierarchicalDictionary under a specific key. This can be thought of as an inverse of :func:`branch`, although `branch` does not remove the requested hierarchy, it simply returns it. """ if not isinstance(key, str) or not isinstance(value, HierarchicalDict): raise TypeError("Splice requires a string key and HierarchicalDict value") self._setitem(key, value, False) def merge(self, key: str, value: 'HierarchicalDict', overwrite: bool = False) -> None: """Acts similarly to splice, but maintains previous values. If overwrite is true, then entries in the new value are used over those that exist within key already Args: key: The location within the hierarchy at which to merge the `value` value: HierarchicalDict to be merged under the key node overwrite: A boolean defining whether the value will be overwritten if it already exists """ if not isinstance(key, str) or not isinstance(value, HierarchicalDict): raise TypeError("Splice requires a string key and HierarchicalDict value") for item in dict(value): if self.get(key + self._separator + item, None) is not None: if overwrite: self[key + self._separator + item] = value[item] else: self[key + self._separator + item] = value[item] def clone(self) -> 'HierarchicalDict': """Duplicates the configuration, allowing changes without affecting the original. Returns: A duplicate HierarchicalDict of this object """ return copy.deepcopy(self) def __str__(self) -> str: """Turns the Hierarchical dict into a string representation.""" return json.dumps(dict([(key, self[key]) for key in sorted(self.generator())]), indent = 2) class RequirementInterface(metaclass = ABCMeta): """Class that defines a requirement. A requirement is a means for plugins and other framework components to request specific configuration data. Requirements can either be simple types (such as :class:`~volatility3.framework.configuration.requirements.SimpleTypeRequirement`, :class:`~volatility3.framework.configuration.requirements.IntRequirement`, :class:`~volatility3.framework.configuration.requirements.BytesRequirement` and :class:`~volatility3.framework.configuration.requirements.StringRequirement`) or complex types (such as :class:`TranslationLayerRequirement`, :class:`SymbolTableRequirement` and :class:`ClassRequirement` """ def __init__(self, name: str, description: str = None, default: ConfigSimpleType = None, optional: bool = False) -> None: """ Args: name: The name of the requirement description: A short textual description of the requirement default: The default value for the requirement if no value is provided optional: Whether the requirement must be satisfied or not """ super().__init__() if CONFIG_SEPARATOR in name: raise ValueError("Name cannot contain the config-hierarchy divider ({})".format(CONFIG_SEPARATOR)) self._name = name self._description = description or "" self._default = default self._optional = optional self._requirements = {} # type: Dict[str, RequirementInterface] def __repr__(self) -> str: return "<" + self.__class__.__name__ + ": " + self.name + ">" @property def name(self) -> str: """The name of the Requirement. Names cannot contain CONFIG_SEPARATOR ('.' by default) since this is used within the configuration hierarchy. """ return self._name @property def description(self) -> str: """A short description of what the Requirement is designed to affect or achieve.""" return self._description @property def default(self) -> ConfigSimpleType: """Returns the default value if one is set.""" return self._default @property def optional(self) -> bool: """Whether the Requirement is optional or not.""" return self._optional @optional.setter def optional(self, value) -> None: """Sets the optional value for a requirement.""" self._optional = bool(value) def config_value(self, context: 'interfaces.context.ContextInterface', config_path: str, default: ConfigSimpleType = None) -> ConfigSimpleType: """Returns the value for this Requirement from its config path. Args: context: the configuration store to find the value for this requirement config_path: the configuration path of the instance of the requirement to be recovered default: a default value to provide if the requirement's configuration value is not found """ return context.config.get(config_path, default) # Child operations @property def requirements(self) -> Dict[str, 'RequirementInterface']: """Returns a dictionary of all the child requirements, indexed by name.""" return self._requirements.copy() def add_requirement(self, requirement: 'RequirementInterface') -> None: """Adds a child to the list of requirements. Args: requirement: The requirement to add as a child-requirement """ self._requirements[requirement.name] = requirement def remove_requirement(self, requirement: 'RequirementInterface') -> None: """Removes a child from the list of requirements. Args: requirement: The requirement to remove as a child-requirement """ del self._requirements[requirement.name] def unsatisfied_children(self, context: 'interfaces.context.ContextInterface', config_path: str) -> Dict[str, 'RequirementInterface']: """Method that will validate all child requirements. Args: context: the context containing the configuration data for this requirement config_path: the configuration path of this instance of the requirement Returns: A dictionary of full configuration paths for each unsatisfied child-requirement """ result = {} for requirement in self.requirements.values(): if not requirement.optional: subresult = requirement.unsatisfied(context, path_join(config_path, self._name)) result.update(subresult) return result # Validation routines @abstractmethod def unsatisfied(self, context: 'interfaces.context.ContextInterface', config_path: str) -> Dict[str, 'RequirementInterface']: """Method to validate the value stored at config_path for the configuration object against a context. Returns a list containing its own name (or multiple unsatisfied requirement names) when invalid Args: context: The context object containing the configuration for this requirement config_path: The configuration path for this requirement to test satisfaction Returns: A dictionary of configuration-paths to requirements that could not be satisfied """ class SimpleTypeRequirement(RequirementInterface): """Class to represent a single simple type (such as a boolean, a string, an integer or a series of bytes)""" instance_type = bool # type: ClassVar[Type] def add_requirement(self, requirement: RequirementInterface): """Always raises a TypeError as instance requirements cannot have children.""" raise TypeError("Instance Requirements cannot have subrequirements") def remove_requirement(self, requirement: RequirementInterface): """Always raises a TypeError as instance requirements cannot have children.""" raise TypeError("Instance Requirements cannot have subrequirements") def unsatisfied(self, context: 'interfaces.context.ContextInterface', config_path: str) -> Dict[str, RequirementInterface]: """Validates the instance requirement based upon its `instance_type`.""" config_path = path_join(config_path, self.name) value = self.config_value(context, config_path, None) if not isinstance(value, self.instance_type): vollog.log( constants.LOGLEVEL_V, "TypeError - {} requirements only accept {} type: {}".format(self.name, self.instance_type.__name__, repr(value))) return {config_path: self} return {} class ClassRequirement(RequirementInterface): """Requires a specific class. This is used as means to serialize specific classes for :class:`TranslationLayerRequirement` and :class:`SymbolTableRequirement` classes. """ def __init__(self, *args, **kwargs) -> None: super().__init__(*args, **kwargs) self._cls = None @property def cls(self) -> Type: """Contains the actual chosen class based on the configuration value's class name.""" return self._cls def unsatisfied(self, context: 'interfaces.context.ContextInterface', config_path: str) -> Dict[str, RequirementInterface]: """Checks to see if a class can be recovered.""" config_path = path_join(config_path, self.name) value = self.config_value(context, config_path, None) self._cls = None if value is not None and isinstance(value, str): if "." in value: # TODO: consider importing the prefix module = sys.modules.get(value[:value.rindex(".")], None) class_name = value[value.rindex(".") + 1:] if hasattr(module, class_name): self._cls = getattr(module, class_name) else: if value in globals(): self._cls = globals()[value] if self._cls is None: return {config_path: self} return {} class ConstructableRequirementInterface(RequirementInterface): """Defines a Requirement that can be constructed based on their own requirements. This effectively offers a means for serializing specific python types, to be reconstructed based on simple configuration data. Each constructable records a `class` requirement, which indicates the object that will be constructed. That class may have its own requirements (which is why validation of a ConstructableRequirement must happen after the class configuration value has been provided). These values are then provided to the object's constructor by name as arguments (as well as the standard `context` and `config_path` arguments. """ def __init__(self, *args, **kwargs) -> None: super().__init__(*args, **kwargs) self.add_requirement(ClassRequirement("class", "Class of the constructable requirement")) self._current_class_requirements = set() @abstractmethod def construct(self, context: 'interfaces.context.ContextInterface', config_path: str) -> None: """Method for constructing within the context any required elements from subrequirements. Args: context: The context object containing the configuration data for the constructable config_path: The configuration path for the specific instance of this constructable """ def _validate_class(self, context: 'interfaces.context.ContextInterface', config_path: str) -> None: """Method to check if the class Requirement is valid and if so populate the other requirements (but no need to validate, since we're invalid already) Args: context: The context object containing the configuration data for the constructable config_path: The configuration path for the specific instance of this constructable """ class_req = self.requirements['class'] subreq_config_path = path_join(config_path, self.name) if not class_req.unsatisfied(context, subreq_config_path) and isinstance(class_req, ClassRequirement): # We have a class, and since it's validated we can construct our requirements from it if issubclass(class_req.cls, ConfigurableInterface): # In case the class has changed, clear out the old requirements for old_req in self._current_class_requirements.copy(): del self._requirements[old_req] self._current_class_requirements.remove(old_req) # And add the new ones for requirement in class_req.cls.get_requirements(): self._current_class_requirements.add(requirement.name) self.add_requirement(requirement) def _construct_class(self, context: 'interfaces.context.ContextInterface', config_path: str, requirement_dict: Dict[str, object] = None) -> Optional['interfaces.objects.ObjectInterface']: """Constructs the class, handing args and the subrequirements as parameters to __init__""" if self.requirements["class"].unsatisfied(context, config_path): return None if not isinstance(self.requirements["class"], ClassRequirement): return None cls = self.requirements["class"].cls # These classes all have a name property # We could subclass this out as a NameableInterface, but it seems a little excessive # FIXME: We can't test this, because importing the other interfaces causes all kinds of import loops # if not issubclass(cls, [interfaces.layers.TranslationLayerInterface, # interfaces.symbols.SymbolTableInterface]): # return None if requirement_dict is None: requirement_dict = {} # Fulfillment must happen, exceptions happening here mean the requirements aren't correct # and these need to be raised and fixed, rather than caught and ignored obj = cls(**requirement_dict) context.config[config_path] = obj.name return obj class ConfigurableRequirementInterface(RequirementInterface): """Simple Abstract class to provide build_required_config.""" def build_configuration(self, context: 'interfaces.context.ContextInterface', config_path: str, value: Any) -> HierarchicalDict: """Proxies to a ConfigurableInterface if necessary.""" class ConfigurableInterface(metaclass = ABCMeta): """Class to allow objects to have requirements and read configuration data from the context config tree.""" def __init__(self, context: 'interfaces.context.ContextInterface', config_path: str) -> None: """Basic initializer that allows configurables to access their own config settings.""" super().__init__() self._context = context self._config_path = config_path self._config_cache = None # type: Optional[HierarchicalDict] @property def context(self) -> 'interfaces.context.ContextInterface': """The context object that this configurable belongs to/configuration is stored in.""" return self._context @property def config_path(self) -> str: """The configuration path on which this configurable lives.""" return self._config_path @config_path.setter def config_path(self, value: str) -> None: """The configuration path on which this configurable lives.""" self._config_path = value self._config_cache = None @property def config(self) -> HierarchicalDict: """The Hierarchical configuration Dictionary for this Configurable object.""" if not hasattr(self, "_config_cache") or self._config_cache is None: self._config_cache = self._context.config.branch(self._config_path) return self._config_cache def build_configuration(self) -> HierarchicalDict: """Constructs a HierarchicalDictionary of all the options required to build this component in the current context. Ensures that if the class has been created, it can be recreated using the configuration built Inheriting classes must override this to ensure any dependent classes update their configurations too """ result = HierarchicalDict() for req in self.get_requirements(): value = self.config.get(req.name, None) # Do not include the name of constructed classes if value is not None and not isinstance(req, ConstructableRequirementInterface): result[req.name] = value if isinstance(req, ConfigurableRequirementInterface): if value is not None: result.splice(req.name, req.build_configuration(self.context, self.config_path, value)) return result @classmethod def get_requirements(cls) -> List[RequirementInterface]: """Returns a list of RequirementInterface objects required by this object.""" return [] @classmethod def unsatisfied(cls, context: 'interfaces.context.ContextInterface', config_path: str) -> Dict[str, RequirementInterface]: """Returns a list of the names of all unsatisfied requirements. Since a satisfied set of requirements will return [], it can be used in tests as follows: .. code-block:: python unmet = configurable.unsatisfied(context, config_path) if unmet: raise RuntimeError("Unsatisfied requirements: {}".format(unmet) """ result = {} for requirement in cls.get_requirements(): if not requirement.optional: subresult = requirement.unsatisfied(context, config_path) result.update(subresult) return result @classmethod def make_subconfig(cls, context: 'interfaces.context.ContextInterface', base_config_path: str, **kwargs) -> str: """Convenience function to allow constructing a new randomly generated sub-configuration path, containing each element from kwargs. Args: context: The context in which to store the new configuration base_config_path: The base configuration path on which to build the new configuration kwargs: Keyword arguments that are used to populate the new configuration path Returns: str: The newly generated full configuration path """ random_config_dict = ''.join(random.SystemRandom().choice(string.ascii_uppercase + string.digits) for _ in range(8)) new_config_path = path_join(base_config_path, random_config_dict) # TODO: Check that the new_config_path is empty, although it's not critical if it's not since the values are merged in # This should check that each k corresponds to a requirement and each v is of the appropriate type # This would require knowledge of the new configurable itself to verify, and they should do validation in the # constructor anyway, however, to prevent bad types getting into the config tree we just verify that v is a simple type for k, v in kwargs.items(): if not isinstance(v, (int, str, bool, float, bytes)): raise TypeError("Config values passed to make_subconfig can only be simple types") context.config[path_join(new_config_path, k)] = v return new_config_path class VersionableInterface: """A class that allows version checking so that plugins can request specific versions of components they made need This currently includes other Plugins and scanners, but may be extended in the future All version number should use semantic versioning """ _version = (0, 0, 0) # type: Tuple[int, int, int] @classproperty def version(cls) -> Tuple[int, int, int]: """The version of the current interface (classmethods available on the component). It is strongly recommended that Semantic Versioning be used (and the default version verification is defined that way): MAJOR version when you make incompatible API changes. MINOR version when you add functionality in a backwards compatible manner. PATCH version when you make backwards compatible bug fixes. """ return cls._version volatility3-1.0.1/volatility3/framework/interfaces/context.py000066400000000000000000000215201405267600400244410ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """Defines an interface for contexts, which hold the core components that a plugin will operate upon when running. These include a `memory` container which holds a series of forest of layers, and a `symbol_space` which contains tables of symbols that can be used to interpret data in a layer. The context also provides some convenience functions, most notably the object constructor function, `object`, which will construct a symbol on a layer at a particular offset. """ import copy from abc import ABCMeta, abstractmethod from typing import Optional, Union from volatility3.framework import interfaces class ContextInterface(metaclass = ABCMeta): """All context-like objects must adhere to the following interface. This interface is present to avoid import dependency cycles. """ def __init__(self) -> None: """Initializes the context with a symbol_space.""" # ## Symbol Space Functions @property @abstractmethod def config(self) -> 'interfaces.configuration.HierarchicalDict': """Returns the configuration object for this context.""" @property @abstractmethod def symbol_space(self) -> 'interfaces.symbols.SymbolSpaceInterface': """Returns the symbol_space for the context. This object must support the :class:`~volatility3.framework.interfaces.symbols.SymbolSpaceInterface` """ # ## Memory Functions @property @abstractmethod def layers(self) -> 'interfaces.layers.LayerContainer': """Returns the memory object for the context.""" raise NotImplementedError("LayerContainer has not been implemented.") def add_layer(self, layer: 'interfaces.layers.DataLayerInterface'): """Adds a named translation layer to the context memory. Args: layer: Layer object to be added to the context memory """ self.layers.add_layer(layer) # ## Object Factory Functions @abstractmethod def object(self, object_type: Union[str, 'interfaces.objects.Template'], layer_name: str, offset: int, native_layer_name: str = None, **arguments): """Object factory, takes a context, symbol, offset and optional layer_name. Looks up the layer_name in the context, finds the object template based on the symbol, and constructs an object using the object template on the layer at the offset. Args: object_type: Either a string name of the type, or a Template of the type to be constructed layer_name: The name of the layer on which to construct the object offset: The address within the layer at which to construct the object native_layer_name: The layer this object references (should it be a pointer or similar) Returns: A fully constructed object """ def clone(self) -> 'ContextInterface': """Produce a clone of the context (and configuration), allowing modifications to be made without affecting any mutable objects in the original. Memory constraints may become an issue for this function depending on how much is actually stored in the context """ return copy.deepcopy(self) def module(self, module_name: str, layer_name: str, offset: int, native_layer_name: Optional[str] = None, size: Optional[int] = None) -> 'ModuleInterface': """Create a module object. A module object is associated with a symbol table, and acts like a context, but offsets locations by a known value and looks up symbols, by default within the associated symbol table. It can also be sized should that information be available. Args: module_name: The name of the module layer_name: The layer the module is associated with (which layer the module lives within) offset: The initial/base offset of the module (used as the offset for relative symbols) native_layer_name: The default native_layer_name to use when the module constructs objects size: The size, in bytes, that the module occupys from offset location within the layer named layer_name Returns: A module object """ class ModuleInterface(metaclass = ABCMeta): """Maintains state concerning a particular loaded module in memory. This object is OS-independent. """ def __init__(self, context: ContextInterface, module_name: str, layer_name: str, offset: int, symbol_table_name: Optional[str] = None, native_layer_name: Optional[str] = None) -> None: """Constructs a new os-independent module. Args: context: The context within which this module will exist module_name: The name of the module layer_name: The layer within the context in which the module exists offset: The offset at which the module exists in the layer symbol_table_name: The name of an associated symbol table native_layer_name: The default native layer for objects constructed by the module """ self._context = context self._module_name = module_name self._layer_name = layer_name self._offset = offset self._native_layer_name = None if native_layer_name: self._native_layer_name = native_layer_name self.symbol_table_name = symbol_table_name or self._module_name super().__init__() @property def name(self) -> str: """The name of the constructed module.""" return self._module_name @property def offset(self) -> int: """Returns the offset that the module resides within the layer of layer_name.""" return self._offset @property def layer_name(self) -> str: """Layer name in which the Module resides.""" return self._layer_name @property def context(self) -> ContextInterface: """Context that the module uses.""" return self._context @abstractmethod def object(self, object_type: str, offset: int = None, native_layer_name: Optional[str] = None, absolute: bool = False, **kwargs) -> 'interfaces.objects.ObjectInterface': """Returns an object created using the symbol_table_name and layer_name of the Module. Args: object_type: The name of object type to construct (using the module's symbol_table) offset: the offset (unless absolute is set) from the start of the module native_layer_name: The native layer for objects that reference a different layer (if not the default provided during module construction) absolute: A boolean specifying whether the offset is absolute within the layer, or relative to the start of the module Returns: The constructed object """ @abstractmethod def object_from_symbol(self, symbol_name: str, native_layer_name: Optional[str] = None, absolute: bool = False, **kwargs) -> 'interfaces.objects.ObjectInterface': """Returns an object created using the symbol_table_name and layer_name of the Module. Args: symbol_name: The name of a symbol (that must be present in the module's symbol table). The symbol's associated type will be used to construct an object at the symbol's offset. native_layer_name: The native layer for objects that reference a different layer (if not the default provided during module construction) absolute: A boolean specifying whether the offset is absolute within the layer, or relative to the start of the module Returns: The constructed object """ def get_type(self, name: str) -> 'interfaces.objects.Template': """Returns a type from the module.""" def get_symbol(self, name: str) -> 'interfaces.symbols.SymbolInterface': """Returns a symbol from the module.""" def get_enumeration(self, name: str) -> 'interfaces.objects.Template': """Returns an enumeration from the module.""" def has_type(self, name: str) -> bool: """Determines whether a type is present in the module.""" def has_symbol(self, name: str) -> bool: """Determines whether a symbol is present in the module.""" def has_enumeration(self, name: str) -> bool: """Determines whether an enumeration is present in the module.""" volatility3-1.0.1/volatility3/framework/interfaces/layers.py000066400000000000000000000651201405267600400242600ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """Defines layers for containing data. One layer may combine other layers, map data based on the data itself, or map a procedure (such as decryption) across another layer of data. """ import collections.abc import functools import logging import math import multiprocessing import multiprocessing.managers import threading import traceback import types from abc import ABCMeta, abstractmethod from typing import Any, Callable, Dict, Iterable, List, Mapping, Optional, Tuple, Union from volatility3.framework import constants, exceptions, interfaces vollog = logging.getLogger(__name__) ProgressValue = Union['DummyProgress', multiprocessing.managers.ValueProxy] IteratorValue = Tuple[List[Tuple[str, int, int]], int] class ScannerInterface(interfaces.configuration.VersionableInterface, metaclass = ABCMeta): """Class for layer scanners that return locations of particular values from within the data. These are designed to be given a chunk of data and return a generator which yields any found items. They should NOT perform complex/time-consuming tasks, these should be carried out by the consumer of the generator on the items returned. They will be provided all *available* data (therefore not necessarily contiguous) in ascending offset order, in chunks no larger than chunk_size + overlap where overlap is the amount of data read twice once at the end of an earlier chunk and once at the start of the next chunk. It should be noted that the scanner can maintain state if necessary. Scanners should balance the size of chunk based on the amount of time scanning the chunk will take (ie, do not set an excessively large chunksize and try not to take a significant amount of time in the __call__ method). Scanners must NOT return results found *after* self.chunk_size (ie, entirely contained within the overlap). It is the responsibility of the scanner not to return such duplicate results. Scanners can mark themselves as thread_safe, if they do not require state in either their own class or the context. This will allow the scanner to be run in parallel against multiple blocks. """ thread_safe = False def __init__(self) -> None: super().__init__() self.chunk_size = 0x1000000 # Default to 16Mb chunks self.overlap = 0x1000 # A page of overlap by default self._context = None # type: Optional[interfaces.context.ContextInterface] self._layer_name = None # type: Optional[str] @property def context(self) -> Optional['interfaces.context.ContextInterface']: return self._context @context.setter def context(self, ctx: 'interfaces.context.ContextInterface') -> None: """Stores the context locally in case the scanner needs to access the layer.""" self._context = ctx @property def layer_name(self) -> Optional[str]: return self._layer_name @layer_name.setter def layer_name(self, layer_name: str) -> None: """Stores the layer_name being scanned locally in case the scanner needs to access the layer.""" self._layer_name = layer_name @abstractmethod def __call__(self, data: bytes, data_offset: int) -> Iterable[Any]: """Searches through a chunk of data for a particular value/pattern/etc Always returns an iterator of the same type of object (need not be a volatility object) data is the chunk of data to search through data_offset is the offset within the layer that the data being searched starts at """ class DataLayerInterface(interfaces.configuration.ConfigurableInterface, metaclass = ABCMeta): """A Layer that directly holds data (and does not translate it). This is effectively a leaf node in a layer tree. It directly accesses a data source and exposes it within volatility. """ _direct_metadata = collections.ChainMap({}, { 'architecture': 'Unknown', 'os': 'Unknown' }) # type: collections.ChainMap def __init__(self, context: 'interfaces.context.ContextInterface', config_path: str, name: str, metadata: Optional[Dict[str, Any]] = None) -> None: super().__init__(context, config_path) self._name = name if metadata: self._direct_metadata.update(metadata) # Standard attributes @property def name(self) -> str: """Returns the layer name.""" return self._name @property @abstractmethod def maximum_address(self) -> int: """Returns the maximum valid address of the space.""" @property @abstractmethod def minimum_address(self) -> int: """Returns the minimum valid address of the space.""" @property def address_mask(self) -> int: """Returns a mask which encapsulates all the active bits of an address for this layer.""" return (1 << int(math.ceil(math.log2(self.maximum_address)))) - 1 @abstractmethod def is_valid(self, offset: int, length: int = 1) -> bool: """Returns a boolean based on whether the entire chunk of data (from offset to length) is valid or not. Args: offset: The address to start determining whether bytes are readable/valid length: The number of bytes from offset of which to test the validity Returns: Whether the bytes are valid and accessible """ @abstractmethod def read(self, offset: int, length: int, pad: bool = False) -> bytes: """Reads an offset for length bytes and returns 'bytes' (not 'str') of length size. If there is a fault of any kind (such as a page fault), an exception will be thrown unless pad is set, in which case the read errors will be replaced by null characters. Args: offset: The offset at which to being reading within the layer length: The number of bytes to read within the layer pad: A boolean indicating whether exceptions should be raised or bad bytes replaced with null characters Returns: The bytes read from the layer, starting at offset for length bytes """ @abstractmethod def write(self, offset: int, data: bytes) -> None: """Writes a chunk of data at offset. Any unavailable sections in the underlying bases will cause an exception to be thrown. Note: Writes are not guaranteed atomic, therefore some data may have been written, even if an exception is thrown. """ def destroy(self) -> None: """Causes a DataLayer to close any open handles, etc. Systems that make use of Data Layers should call destroy when they are done with them. This will close all handles, and make the object unreadable (exceptions will be thrown using a DataLayer after destruction) """ pass @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: """Returns a list of Requirement objects for this type of layer.""" return super().get_requirements() @property def dependencies(self) -> List[str]: """A list of other layer names required by this layer. Note: DataLayers must never define other layers """ return [] # ## General scanning methods def scan(self, context: interfaces.context.ContextInterface, scanner: ScannerInterface, progress_callback: constants.ProgressCallback = None, sections: Iterable[Tuple[int, int]] = None) -> Iterable[Any]: """Scans a Translation layer by chunk. Note: this will skip missing/unmappable chunks of memory Args: context: The context containing the data layer scanner: The constructed Scanner object to be applied progress_callback: Method that is called periodically during scanning to update progress sections: A list of (start, size) tuples defining the portions of the layer to scan Returns: The output iterable from the scanner object having been run against the layer """ if progress_callback is not None and not callable(progress_callback): raise TypeError("Progress_callback is not callable") scanner.context = context scanner.layer_name = self.name if sections is None: sections = [(self.minimum_address, self.maximum_address - self.minimum_address)] sections = list(self._coalesce_sections(sections)) try: progress = DummyProgress() # type: ProgressValue scan_iterator = functools.partial(self._scan_iterator, scanner, sections) scan_metric = self._scan_metric(scanner, sections) if not scanner.thread_safe or constants.PARALLELISM == constants.Parallelism.Off: progress = DummyProgress() scan_chunk = functools.partial(self._scan_chunk, scanner, progress) for value in scan_iterator(): if progress_callback: progress_callback(scan_metric(progress.value), "Scanning {} using {}".format(self.name, scanner.__class__.__name__)) yield from scan_chunk(value) else: progress = multiprocessing.Manager().Value("Q", 0) parallel_module = multiprocessing # type: types.ModuleType if constants.PARALLELISM == constants.Parallelism.Threading: progress = DummyProgress() parallel_module = threading scan_chunk = functools.partial(self._scan_chunk, scanner, progress) with parallel_module.Pool() as pool: result = pool.map_async(scan_chunk, scan_iterator()) while not result.ready(): if progress_callback: # Run the progress_callback progress_callback(scan_metric(progress.value), "Scanning {} using {}".format(self.name, scanner.__class__.__name__)) # Ensures we don't burn CPU cycles going round in a ready waiting loop # without delaying the user too long between progress updates/results result.wait(0.1) for result_value in result.get(): yield from result_value except Exception as e: # We don't care the kind of exception, so catch and report on everything, yielding nothing further vollog.debug("Scan Failure: {}".format(str(e))) vollog.log(constants.LOGLEVEL_VVV, "\n".join(traceback.TracebackException.from_exception(e).format(chain = True))) def _coalesce_sections(self, sections: Iterable[Tuple[int, int]]) -> Iterable[Tuple[int, int]]: """Take a list of (start, length) sections and coalesce any adjacent sections.""" result = [] # type: List[Tuple[int, int]] position = 0 for (start, length) in sorted(sections): if result and start <= position: initial_start, _ = result.pop() result.append((initial_start, (start + length) - initial_start)) else: result.append((start, length)) position = start + length while result and result[0] < (self.minimum_address, 0): first_start, first_length = result[0] if first_start + first_length < self.minimum_address: result = result[1:] elif first_start < self.minimum_address: result[0] = (self.minimum_address, (first_start + first_length) - self.minimum_address) while result and result[-1] > (self.maximum_address, 0): last_start, last_length = result[-1] if last_start > self.maximum_address: result.pop() elif last_start + last_length > self.maximum_address: result[1] = (last_start, self.maximum_address - last_start) return result def _scan_iterator(self, scanner: 'ScannerInterface', sections: Iterable[Tuple[int, int]]) -> Iterable[IteratorValue]: """Iterator that indicates which blocks in the layer are to be read by for the scanning. Returns a list of blocks (potentially in lower layers) that make up this chunk contiguously. Chunks can be no bigger than scanner.chunk_size + scanner.overlap DataLayers by default are assumed to have no holes """ for section_start, section_length in sections: offset, mapped_offset, length, layer_name = section_start, section_start, section_length, self.name while length > 0: chunk_size = min(length, scanner.chunk_size + scanner.overlap) yield [(layer_name, mapped_offset, chunk_size)], offset + chunk_size # It we've got more than the scanner's chunk_size, only move up by the chunk_size if chunk_size > scanner.chunk_size: chunk_size -= scanner.overlap length -= chunk_size mapped_offset += chunk_size offset += chunk_size # We ignore the type due to the iterator_value, actually it only needs to match the output from _scan_iterator def _scan_chunk(self, scanner: 'ScannerInterface', progress: 'ProgressValue', iterator_value: IteratorValue) -> List[Any]: data_to_scan, chunk_end = iterator_value data = b'' for layer_name, address, chunk_size in data_to_scan: try: data += self.context.layers[layer_name].read(address, chunk_size) except exceptions.InvalidAddressException: vollog.debug("Invalid address in layer {} found scanning {} at address {:x}".format( layer_name, self.name, address)) progress.value = chunk_end return list(scanner(data, chunk_end - len(data))) def _scan_metric(self, _scanner: 'ScannerInterface', sections: List[Tuple[int, int]]) -> Callable[[int], float]: if not sections: raise ValueError("Sections have no size, nothing to scan") last_section, last_length = sections[-1] min_address, _ = sections[0] max_address = last_section + last_length def _actual_scan_metric(value: int) -> float: return max(0, ((value - min_address) * 100) / (max_address - min_address)) return _actual_scan_metric def build_configuration(self) -> interfaces.configuration.HierarchicalDict: config = super().build_configuration() # Translation Layers are constructable, and therefore require a class configuration variable config["class"] = self.__class__.__module__ + "." + self.__class__.__name__ return config # ## Metadata methods @property def metadata(self) -> Mapping: """Returns a ReadOnly copy of the metadata published by this layer.""" maps = [self.context.layers[layer_name].metadata for layer_name in self.dependencies] return interfaces.objects.ReadOnlyMapping(collections.ChainMap({}, self._direct_metadata, *maps)) class TranslationLayerInterface(DataLayerInterface, metaclass = ABCMeta): """Provides a layer that translates or transforms another layer or layers. Translation layers always depend on another layer (typically translating offsets in a virtual offset space into a smaller physical offset space). """ @abstractmethod def mapping(self, offset: int, length: int, ignore_errors: bool = False) -> Iterable[Tuple[int, int, int, int, str]]: """Returns a sorted iterable of (offset, sublength, mapped_offset, mapped_length, layer) mappings. ignore_errors will provide all available maps with gaps, but their total length may not add up to the requested length This allows translation layers to provide maps of contiguous regions in one layer """ return [] @property @abstractmethod def dependencies(self) -> List[str]: """Returns a list of layer names that this layer translates onto.""" return [] def _decode_data(self, data: bytes, mapped_offset: int, offset: int, output_length: int) -> bytes: """Decodes any necessary data. Note, additional data may need to be read from the lower layer, such as lookup tables or similar. The data provided to this layer is purely that data which encompasses the requested data range. Args: data: The bytes of data necessary for decoding mapped_offset: The offset in the underlying layer where the data would begin offset: The offset in the higher-layer where the data would begin output_length: The expected length of the returned data Returns: The data to be read from the underlying layer.""" return data def _encode_data(self, layer_name: str, mapped_offset: int, offset: int, value: bytes) -> bytes: """Encodes any necessary data. Args: layer_name: The layer to write data back to mapped_offset: The offset in the underlying layer where the data would begin offset: The offset in the higher-layer where the data would begin value: The new value to encode Returns: The data to be rewritten at mapped_offset.""" return value # ## Read/Write functions for mapped pages @functools.lru_cache(maxsize = 512) def read(self, offset: int, length: int, pad: bool = False) -> bytes: """Reads an offset for length bytes and returns 'bytes' (not 'str') of length size.""" current_offset = offset output = b'' # type: bytes for (layer_offset, sublength, mapped_offset, mapped_length, layer) in self.mapping(offset, length, ignore_errors = pad): if not pad and layer_offset > current_offset: raise exceptions.InvalidAddressException( self.name, current_offset, "Layer {} cannot map offset: {}".format(self.name, current_offset)) elif layer_offset > current_offset: output += b"\x00" * (layer_offset - current_offset) current_offset = layer_offset # The layer_offset can be less than the current_offset in non-linearly mapped layers # it does not suggest an overlap, but that the data is in an encoded block if mapped_length > 0: unprocessed_data = self._context.layers.read(layer, mapped_offset, mapped_length, pad) processed_data = self._decode_data(unprocessed_data, mapped_offset, layer_offset, sublength) if len(processed_data) != sublength: raise ValueError("ProcessedData length does not match expected length of chunk") output += processed_data current_offset += sublength return output + (b"\x00" * (length - len(output))) def write(self, offset: int, value: bytes) -> None: """Writes a value at offset, distributing the writing across any underlying mapping.""" current_offset = offset length = len(value) for (layer_offset, sublength, mapped_offset, mapped_length, layer) in self.mapping(offset, length): if layer_offset > current_offset: raise exceptions.InvalidAddressException( self.name, current_offset, "Layer {} cannot map offset: {}".format(self.name, current_offset)) value_chunk = value[layer_offset - offset:layer_offset - offset + sublength] new_data = self._encode_data(layer, mapped_offset, layer_offset, value_chunk) self._context.layers.write(layer, mapped_offset, new_data) current_offset += len(new_data) def _scan_iterator(self, scanner: 'ScannerInterface', sections: Iterable[Tuple[int, int]], linear: bool = False) -> Iterable[IteratorValue]: """Iterator that indicates which blocks in the layer are to be read by for the scanning. Returns a list of blocks (potentially in lower layers) that make up this chunk contiguously. Chunks can be no bigger than scanner.chunk_size + scanner.overlap DataLayers by default are assumed to have no holes """ for (section_start, section_length) in sections: # For each section, split it into scan size chunks for chunk_start in range(section_start, section_start + section_length, scanner.chunk_size): # Shorten it, if we're at the end of the section chunk_length = min(section_start + section_length - chunk_start, scanner.chunk_size + scanner.overlap) # Prev offset keeps track of the end of the previous subchunk prev_offset = chunk_start output = [] # type: List[Tuple[str, int, int]] # We populate the response based on subchunks that may be mapped all over the place for mapped in self.mapping(chunk_start, chunk_length, ignore_errors = True): # We don't bother with the other data in case the data's been processed by a lower layer offset, sublength, mapped_offset, mapped_length, layer_name = mapped # We need to check if the offset is next to the end of the last one (contiguous) if offset != prev_offset: # Only yield if we've accumulated output if len(output): # Yield all the (joined) items so far # and the ending point of that subchunk (where we'd gotten to previously) yield output, prev_offset output = [] # Shift the marker up to the end of what we just received and add it to the output prev_offset = offset + sublength if not linear: output += [(self.name, offset, sublength)] else: output += [(layer_name, mapped_offset, mapped_length)] # If there's still output left, output it if len(output): yield output, prev_offset class LayerContainer(collections.abc.Mapping): """Container for multiple layers of data.""" def __init__(self) -> None: self._layers = {} # type: Dict[str, DataLayerInterface] def read(self, layer: str, offset: int, length: int, pad: bool = False) -> bytes: """Reads from a particular layer at offset for length bytes. Returns 'bytes' not 'str' Args: layer: The name of the layer to read from offset: Where to begin reading within the layer length: How many bytes to read from the layer pad: Whether to raise exceptions or return null bytes when errors occur Returns: The result of reading from the requested layer """ return self[layer].read(offset, length, pad) def __eq__(self, other): return dict(self) == dict(other) def write(self, layer: str, offset: int, data: bytes) -> None: """Writes to a particular layer at offset for length bytes.""" self[layer].write(offset, data) def add_layer(self, layer: DataLayerInterface) -> None: """Adds a layer to memory model. This will throw an exception if the required dependencies are not met Args: layer: the layer to add to the list of layers (based on layer.name) """ if layer.name in self._layers: raise exceptions.LayerException(layer.name, "Layer already exists: {}".format(layer.name)) if isinstance(layer, TranslationLayerInterface): missing_list = [sublayer for sublayer in layer.dependencies if sublayer not in self._layers] if missing_list: raise exceptions.LayerException( layer.name, "Layer {} has unmet dependencies: {}".format(layer.name, ", ".join(missing_list))) self._layers[layer.name] = layer def del_layer(self, name: str) -> None: """Removes the layer called name. This will throw an exception if other layers depend upon this layer Args: name: The name of the layer to delete """ for layer in self._layers: depend_list = [superlayer for superlayer in self._layers if name in self._layers[layer].dependencies] if depend_list: raise exceptions.LayerException( self._layers[layer].name, "Layer {} is depended upon: {}".format(self._layers[layer].name, ", ".join(depend_list))) self._layers[name].destroy() del self._layers[name] def free_layer_name(self, prefix: str = "layer") -> str: """Returns an unused layer name to ensure no collision occurs when inserting a layer. Args: prefix: A descriptive string with which to prefix the layer name Returns: A string containing a name, prefixed with prefix, not currently in use within the LayerContainer """ if prefix not in self: return prefix count = 1 while "{}_{}".format(prefix, count) in self: count += 1 return "{}_{}".format(prefix, count) def __getitem__(self, name: str) -> DataLayerInterface: """Returns the layer of specified name.""" return self._layers[name] def __len__(self) -> int: return len(self._layers) def __iter__(self): return iter(self._layers) def check_cycles(self) -> None: """Runs through the available layers and identifies if there are cycles in the DAG.""" # TODO: Is having a cycle check necessary? raise NotImplementedError("Cycle checking has not yet been implemented") class DummyProgress(object): """A class to emulate Multiprocessing/threading Value objects.""" def __init__(self) -> None: self.value = 0 volatility3-1.0.1/volatility3/framework/interfaces/objects.py000066400000000000000000000342271405267600400244160ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """Objects are the core of volatility, and provide pythonic access to interpreted values of data from a layer.""" import abc import collections import collections.abc import logging from typing import Any, Dict, List, Mapping, Optional from volatility3.framework import constants, interfaces vollog = logging.getLogger(__name__) class ReadOnlyMapping(collections.abc.Mapping): """A read-only mapping of various values that offer attribute access as well. This ensures that the data stored in the mapping should not be modified, making an immutable mapping. """ def __init__(self, dictionary: Mapping[str, Any]) -> None: self._dict = dictionary def __getattr__(self, attr: str) -> Any: """Returns the item as an attribute.""" if attr == '_dict': return super().__getattribute__(attr) if attr in self._dict: return self._dict[attr] raise AttributeError("Object has no attribute: {}.{}".format(self.__class__.__name__, attr)) def __getitem__(self, name: str) -> Any: """Returns the item requested.""" return self._dict[name] def __iter__(self): """Returns an iterator of the dictionary items.""" return self._dict.__iter__() def __len__(self) -> int: """Returns the length of the internal dictionary.""" return len(self._dict) def __eq__(self, other): return dict(self) == dict(other) class ObjectInformation(ReadOnlyMapping): """Contains common information useful/pertinent only to an individual object (like an instance) This typically contains information such as the layer the object belongs to, the offset where it was constructed, and if it is a subordinate object, its parent. This is primarily used to reduce the number of parameters passed to object constructors and keep them all together in a single place. These values are based on the :class:`ReadOnlyMapping` class, to prevent their modification. """ def __init__(self, layer_name: str, offset: int, member_name: Optional[str] = None, parent: Optional['ObjectInterface'] = None, native_layer_name: Optional[str] = None, size: Optional[int] = None): """Constructs a container for basic information about an object. Args: layer_name: Layer from which the data for the object will be read offset: Offset within the layer at which the data for the object will be read member_name: If the object was accessed as a member of a parent object, this was the name used to access it parent: If the object was accessed as a member of a parent object, this is the parent object native_layer_name: If this object references other objects (such as a pointer), what layer those objects live in size: The size that the whole structure consumes in bytes """ super().__init__({ 'layer_name': layer_name, 'offset': offset, 'member_name': member_name, 'parent': parent, 'native_layer_name': native_layer_name or layer_name, 'size': size }) class ObjectInterface(metaclass = abc.ABCMeta): """A base object required to be the ancestor of every object used in volatility.""" def __init__(self, context: 'interfaces.context.ContextInterface', type_name: str, object_info: 'ObjectInformation', **kwargs) -> None: """Constructs an Object adhering to the ObjectInterface. Args: context: The context associated with the object type_name: The name of the type structure for the object object_info: Basic information relevant to the object (layer, offset, member_name, parent, etc) """ # Since objects are likely to be instantiated often, # we're reliant on type_checking to ensure correctness of context, offset and parent # Everything else may be wrong, but that will get caught later on # Add an empty dictionary at the start to allow objects to add their own data to the vol object # # NOTE: # This allows objects to MASSIVELY MESS with their own internal representation!!! # Changes to offset, type_name, etc should NEVER be done # # Normalize offsets mask = context.layers[object_info.layer_name].address_mask normalized_offset = object_info.offset & mask self._vol = collections.ChainMap({}, object_info, {'type_name': type_name, 'offset': normalized_offset}, kwargs) self._context = context def __getattr__(self, attr: str) -> Any: """Method for ensuring volatility members can be returned.""" raise AttributeError @property def vol(self) -> ReadOnlyMapping: """Returns the volatility specific object information.""" # Wrap the outgoing vol in a read-only proxy return ReadOnlyMapping(self._vol) @abc.abstractmethod def write(self, value: Any): """Writes the new value into the format at the offset the object currently resides at.""" def get_symbol_table_name(self) -> str: """Returns the symbol table name for this particular object. Raises: ValueError: If the object's symbol does not contain an explicit table KeyError: If the table_name is not valid within the object's context """ if constants.BANG not in self.vol.type_name: raise ValueError("Unable to determine table for symbol: {}".format(self.vol.type_name)) table_name = self.vol.type_name[:self.vol.type_name.index(constants.BANG)] if table_name not in self._context.symbol_space: raise KeyError("Symbol table not found in context's symbol_space for symbol: {}".format(self.vol.type_name)) return table_name def cast(self, new_type_name: str, **additional) -> 'ObjectInterface': """Returns a new object at the offset and from the layer that the current object inhabits. .. note:: If new type name does not include a symbol table, the symbol table for the current object is used """ # TODO: Carefully consider the implications of casting and how it should work if constants.BANG not in new_type_name: symbol_table = self.vol['type_name'].split(constants.BANG)[0] new_type_name = symbol_table + constants.BANG + new_type_name object_template = self._context.symbol_space.get_type(new_type_name) object_template = object_template.clone() object_template.update_vol(**additional) object_info = ObjectInformation(layer_name = self.vol.layer_name, offset = self.vol.offset, member_name = self.vol.member_name, parent = self.vol.parent, native_layer_name = self.vol.native_layer_name, size = object_template.size) return object_template(context = self._context, object_info = object_info) def has_member(self, member_name: str) -> bool: """Returns whether the object would contain a member called member_name. Args: member_name: Name to test whether a member exists within the type structure """ return False def has_valid_member(self, member_name: str) -> bool: """Returns whether the dereferenced type has a valid member. Args: member_name: Name of the member to test access to determine if the member is valid or not """ if self.has_member(member_name): # noinspection PyBroadException try: _ = getattr(self, member_name) return True except Exception: pass return False def has_valid_members(self, member_names: List[str]) -> bool: """Returns whether the object has all of the members listed in member_names Args: member_names: List of names to test as to members with those names validity """ return all([self.has_valid_member(member_name) for member_name in member_names]) class VolTemplateProxy(metaclass = abc.ABCMeta): """A container for proxied methods that the ObjectTemplate of this object will call. This is primarily to keep methods together for easy organization/management, there is no significant need for it to be a separate class. The methods of this class *must* be class methods rather than standard methods, to allow for code reuse. Each method also takes a template since the templates may contain the necessary data about the yet-to-be-constructed object. It allows objects to control how their templates respond without needing to write new templates for each and every potental object type. """ _methods = [] # type: List[str] @classmethod @abc.abstractmethod def size(cls, template: 'Template') -> int: """Returns the size of the template object.""" @classmethod @abc.abstractmethod def children(cls, template: 'Template') -> List['Template']: """Returns the children of the template.""" return [] @classmethod @abc.abstractmethod def replace_child(cls, template: 'Template', old_child: 'Template', new_child: 'Template') -> None: """Substitutes the old_child for the new_child.""" raise KeyError("Template does not contain any children to replace: {}".format(template.vol.type_name)) @classmethod @abc.abstractmethod def relative_child_offset(cls, template: 'Template', child: str) -> int: """Returns the relative offset from the head of the parent data to the child member.""" raise KeyError("Template does not contain any children: {}".format(template.vol.type_name)) @classmethod @abc.abstractmethod def has_member(cls, template: 'Template', member_name: str) -> bool: """Returns whether the object would contain a member called member_name.""" return False class Template: """Class for all Factories that take offsets, and data layers and produce objects. This is effectively a class for currying object calls. It creates a callable that can be called with the following parameters: Args: context: The context containing the memory layers and symbols required to construct the object object_info: Basic information about the object, see the ObjectInformation class for more information Returns: The constructed object The keyword arguments handed to the constructor, along with the type_name are stored for later retrieval. These will be access as `object.vol.` or `template.vol.` for each object and should contain as least the basic information that each object will require before it is instantiated (so `offset` and `parent` are explicitly not recorded here). This dictionary can be updated after construction, but any changes made after that point will *not* be cloned. This is so that templates such as those for string objects may contain different length limits, without affecting all other strings using the same template from a SymbolTable, constructed at resolution time and then cached. """ def __init__(self, type_name: str, **arguments) -> None: """Stores the keyword arguments for later object creation.""" # Allow the updating of template arguments whilst still in template form super().__init__() empty_dict = {} # type: Dict[str, Any] self._vol = collections.ChainMap(empty_dict, arguments, {'type_name': type_name}) @property def vol(self) -> ReadOnlyMapping: """Returns a volatility information object, much like the :class:`~volatility3.framework.interfaces.objects.ObjectInformation` provides.""" return ReadOnlyMapping(self._vol) @property def children(self) -> List['Template']: """The children of this template (such as member types, sub-types and base-types where they are relevant). Used to traverse the template tree. """ return [] @property @abc.abstractmethod def size(self) -> int: """Returns the size of the template.""" @abc.abstractmethod def relative_child_offset(self, child: str) -> int: """Returns the relative offset of the `child` member from its parent offset.""" @abc.abstractmethod def replace_child(self, old_child: 'Template', new_child: 'Template') -> None: """Replaces `old_child` with `new_child` in the list of children.""" @abc.abstractmethod def has_member(self, member_name: str) -> bool: """Returns whether the object would contain a member called `member_name`""" def clone(self) -> 'Template': """Returns a copy of the original Template as constructed (without `update_vol` additions having been made)""" clone = self.__class__(**self._vol.parents.new_child()) return clone def update_vol(self, **new_arguments) -> None: """Updates the keyword arguments with values that will **not** be carried across to clones.""" self._vol.update(new_arguments) def __getattr__(self, attr: str) -> Any: """Exposes any other values stored in ._vol as attributes (for example, enumeration choices)""" if attr != '_vol': if attr in self._vol: return self._vol[attr] raise AttributeError("{} object has no attribute {}".format(self.__class__.__name__, attr)) def __call__(self, context: 'interfaces.context.ContextInterface', object_info: ObjectInformation) -> ObjectInterface: """Constructs the object.""" volatility3-1.0.1/volatility3/framework/interfaces/plugins.py000066400000000000000000000144541405267600400244460ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """Plugins are the `functions` of the volatility framework. They are called and carry out some algorithms on data stored in layers using objects constructed from symbols. """ # Configuration interfaces must be imported separately, since we're part of interfaces and can't import ourselves import io import logging import os from abc import ABCMeta, abstractmethod from typing import List, Tuple, Type from volatility3 import framework from volatility3.framework import exceptions, constants, interfaces vollog = logging.getLogger(__name__) class FileHandlerInterface(io.RawIOBase): """Class for storing Files in the plugin as a means to output a file when necessary. This can be used as ContextManager that will close/produce the file automatically when exiting the context block """ def __init__(self, filename: str) -> None: """Creates a FileHandler Args: filename: The requested name of the filename for the data """ self._preferred_filename = None self.preferred_filename = filename super().__init__() @property def preferred_filename(self): """The preferred filename to save the data to. Until this file has been written, this value may not be the final filename the data is written to. """ return self._preferred_filename @preferred_filename.setter def preferred_filename(self, filename): """Sets the preferred filename""" if self.closed: raise IOError("FileHandler name cannot be changed once closed") if not isinstance(filename, str): raise TypeError("FileHandler preferred filenames must be strings") if os.path.sep in filename: raise ValueError("FileHandler filenames cannot contain path separators") self._preferred_filename = filename @abstractmethod def close(self): """Method that commits the file and fixes the final filename for use""" def __enter__(self): return self def __exit__(self, exc_type, exc_value, traceback): if exc_type is None and exc_value is None and traceback is None: self.close() else: vollog.warning("File {} could not be written: {}".format(self._preferred_filename, str(exc_value))) self.close() # # Plugins # - Take in relevant number of TranslationLayers (of specified type) # - Outputs TreeGrid # # Should the plugin handle constructing the translation layers from the filenames or should the library have routines for it? # Outwardly, the user specifies an OS, version, architecture triple and images. # The UI checks the plugin against the OS/Version/Arch triple # The UI constructs the TranslationLayers and names them according to the plugin's input layer names # The UI constructs the appropriate default symbol spaces # The plugin accepts the context and modifies as necessary # The plugin runs and produces a TreeGrid output class PluginInterface(interfaces.configuration.ConfigurableInterface, interfaces.configuration.VersionableInterface, metaclass = ABCMeta): """Class that defines the basic interface that all Plugins must maintain. The constructor must only take a `context` and `config_path`, so that plugins can be launched automatically. As such all configuration information must be provided through the requirements and configuration information in the context it is passed. """ # Be careful with inheritance around this (We default to requiring a version which doesn't exist, so it must be set) _required_framework_version = (0, 0, 0) # type: Tuple[int, int, int] """The _version variable is a quick way for plugins to define their current interface, it should follow SemVer rules""" def __init__(self, context: interfaces.context.ContextInterface, config_path: str, progress_callback: constants.ProgressCallback = None) -> None: """ Args: context: The context that the plugin will operate within config_path: The path to configuration data within the context configuration data progress_callback: A callable that can provide feedback at progress points """ super().__init__(context, config_path) self._progress_callback = progress_callback or (lambda f, s: None) # Plugins self validate on construction, it makes it more difficult to work with them, but then # the validation doesn't need to be repeated over and over again by externals if self.unsatisfied(context, config_path): vollog.warning("Plugin failed validation") raise exceptions.PluginRequirementException("The plugin configuration failed to validate") # Populate any optional defaults for requirement in self.get_requirements(): if requirement.name not in self.config: self.config[requirement.name] = requirement.default self._file_handler = FileHandlerInterface # type: Type[FileHandlerInterface] framework.require_interface_version(*self._required_framework_version) @property def open(self): """Returns a context manager and thus can be called like open""" return self._file_handler def set_open_method(self, handler: Type[FileHandlerInterface]) -> None: """Sets the file handler to be used by this plugin.""" if not issubclass(handler, FileHandlerInterface): raise ValueError("FileHandler must be a subclass of FileHandlerInterface") self._file_handler = handler @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: """Returns a list of Requirement objects for this plugin.""" return super().get_requirements() @abstractmethod def run(self) -> interfaces.renderers.TreeGrid: """Executes the functionality of the code. .. note:: This method expects `self.validate` to have been called to ensure all necessary options have been provided Returns: A TreeGrid object that can then be passed to a Renderer. """ volatility3-1.0.1/volatility3/framework/interfaces/renderers.py000066400000000000000000000203331405267600400247470ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """All plugins output a TreeGrid object which must then be rendered (eithe by a GUI, or as text output, html output or in some other form. This module defines both the output format (:class:`TreeGrid`) and the renderer interface which can interact with a TreeGrid to produce suitable output. """ import datetime from abc import abstractmethod, ABCMeta from collections import abc from typing import Any, Callable, ClassVar, Generator, List, NamedTuple, Optional, TypeVar, Type, Tuple, Union Column = NamedTuple('Column', [('name', str), ('type', Any)]) RenderOption = Any class Renderer(metaclass = ABCMeta): """Class that defines the interface that all output renderers must support.""" def __init__(self, options: Optional[List[RenderOption]] = None) -> None: """Accepts an options object to configure the renderers.""" # FIXME: Once the config option objects are in place, put the _type_check in place @abstractmethod def get_render_options(self) -> List[RenderOption]: """Returns a list of rendering options.""" @abstractmethod def render(self, grid: 'TreeGrid') -> None: """Takes a grid object and renders it based on the object's preferences.""" class ColumnSortKey(metaclass = ABCMeta): ascending = True # type: bool @abstractmethod def __call__(self, values: List[Any]) -> Any: """The key function passed as a sort key to the TreeGrid's visit function.""" class TreeNode(abc.Sequence, metaclass = ABCMeta): def __init__(self, path, treegrid, parent, values): """Initializes the TreeNode.""" @property @abstractmethod def values(self) -> List['BaseTypes']: """Returns the list of values from the particular node, based on column index.""" @property @abstractmethod def path(self) -> str: """Returns a path identifying string. This should be seen as opaque by external classes, Parsing of path locations based on this string are not guaranteed to remain stable. """ @property @abstractmethod def parent(self) -> Optional['TreeNode']: """Returns the parent node of this node or None.""" @property @abstractmethod def path_depth(self) -> int: """Return the path depth of the current node.""" @abstractmethod def path_changed(self, path: str, added: bool = False) -> None: """Updates the path based on the addition or removal of a node higher up in the tree. This should only be called by the containing TreeGrid and expects to only be called for affected nodes. """ class BaseAbsentValue(object): """Class that represents values which are not present for some reason.""" class Disassembly(object): """A class to indicate that the bytes provided should be disassembled (based on the architecture)""" possible_architectures = ['intel', 'intel64', 'arm', 'arm64'] def __init__(self, data: bytes, offset: int = 0, architecture: str = 'intel64') -> None: self.data = data self.architecture = None if architecture in self.possible_architectures: self.architecture = architecture if not isinstance(offset, int): raise TypeError("Offset must be an integer type") self.offset = offset # We don't class these off a shared base, because the BaseTypes must only # contain the types that the validator will accept (which would not include the base) _Type = TypeVar("_Type") BaseTypes = Union[Type[int], Type[str], Type[float], Type[bytes], Type[datetime.datetime], Type[BaseAbsentValue], Type[Disassembly]] ColumnsType = List[Tuple[str, BaseTypes]] VisitorSignature = Callable[[TreeNode, _Type], _Type] class TreeGrid(object, metaclass = ABCMeta): """Class providing the interface for a TreeGrid (which contains TreeNodes) The structure of a TreeGrid is designed to maintain the structure of the tree in a single object. For this reason each TreeNode does not hold its children, they are managed by the top level object. This leaves the Nodes as simple data carries and prevents them being used to manipulate the tree as a whole. This is a data structure, and is not expected to be modified much once created. Carrying the children under the parent makes recursion easier, but then every node is its own little tree and must have all the supporting tree functions. It also allows for a node to be present in several different trees, and to create cycles. """ base_types = (int, str, float, bytes, datetime.datetime, Disassembly) # type: ClassVar[Tuple] def __init__(self, columns: ColumnsType, generator: Generator) -> None: """Constructs a TreeGrid object using a specific set of columns. The TreeGrid itself is a root element, that can have children but no values. The TreeGrid does *not* contain any information about formatting, these are up to the renderers and plugins. Args: columns: A list of column tuples made up of (name, type). generator: An iterable containing row for a tree grid, each row contains a indent level followed by the values for each column in order. """ @staticmethod @abstractmethod def sanitize_name(text: str) -> str: """Method used to sanitize column names for TreeNodes.""" @abstractmethod def populate(self, function: VisitorSignature = None, initial_accumulator: Any = None, fail_on_errors: bool = True) -> Optional[Exception]: """Populates the tree by consuming the TreeGrid's construction generator Func is called on every node, so can be used to create output on demand. This is equivalent to a one-time visit. """ @property @abstractmethod def populated(self) -> bool: """Indicates that population has completed and the tree may now be manipulated separately.""" @property @abstractmethod def columns(self) -> List[Column]: """Returns the available columns and their ordering and types.""" @abstractmethod def children(self, node: TreeNode) -> List[TreeNode]: """Returns the subnodes of a particular node in order.""" @abstractmethod def values(self, node: TreeNode) -> Tuple[BaseTypes, ...]: """Returns the values for a particular node. The values returned are mutable, """ @abstractmethod def is_ancestor(self, node: TreeNode, descendant: TreeNode) -> bool: """Returns true if descendent is a child, grandchild, etc of node.""" @abstractmethod def max_depth(self) -> int: """Returns the maximum depth of the tree.""" @staticmethod def path_depth(node: TreeNode) -> int: """Returns the path depth of a particular node.""" return node.path_depth @abstractmethod def visit(self, node: Optional[TreeNode], function: VisitorSignature, initial_accumulator: _Type, sort_key: ColumnSortKey = None) -> None: """Visits all the nodes in a tree, calling function on each one. function should have the signature function(node, accumulator) and return new_accumulator If accumulators are not needed, the function must still accept a second parameter. The order of that the nodes are visited is always depth first, however, the order children are traversed can be set based on a sort_key function which should accept a node's values and return something that can be sorted to receive the desired order (similar to the sort/sorted key). If node is None, then the root node is used. Args: node: The initial node to be visited function: The visitor to apply to the nodes under the initial node initial_accumulator: An accumulator that allows data to be transfered between one visitor call to the next sort_key: Information about the sort order of columns in order to determine the ordering of results """ volatility3-1.0.1/volatility3/framework/interfaces/symbols.py000066400000000000000000000332271405267600400244540ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """Symbols provide structural information about a set of bytes.""" import bisect import collections.abc from abc import abstractmethod, ABC from typing import Any, Dict, Iterable, List, Optional, Tuple, Type, Mapping from volatility3.framework import constants, exceptions, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import configuration, objects from volatility3.framework.interfaces.configuration import RequirementInterface class SymbolInterface: """Contains information about a named location in a program's memory.""" def __init__(self, name: str, address: int, type: Optional[objects.Template] = None, constant_data: Optional[bytes] = None) -> None: """ Args: name: Name of the symbol address: Numeric address value of the symbol type: Optional type structure information associated with the symbol constant_data: Potential constant data the symbol points at """ self._name = name if constants.BANG in self._name: raise ValueError("Symbol names cannot contain the symbol differentiator ({})".format(constants.BANG)) # Scope can be added at a later date self._location = None self._address = address self._type = type self._constant_data = constant_data @property def name(self) -> str: """Returns the name of the symbol.""" return self._name @property def type_name(self) -> Optional[str]: """Returns the name of the type that the symbol represents.""" # Objects and ObjectTemplates should *always* get a type_name when they're constructed, so allow the IndexError if self.type is None: return None return self.type.vol['type_name'] @property def type(self) -> Optional[objects.Template]: """Returns the type that the symbol represents.""" return self._type @property def address(self) -> int: """Returns the relative address of the symbol within the compilation unit.""" return self._address @property def constant_data(self) -> Optional[bytes]: """Returns any constant data associated with the symbol.""" return self._constant_data class BaseSymbolTableInterface: """The base interface, inherited by both NativeTables and SymbolTables. native_types is a NativeTableInterface used for native types for the particular loaded symbol table table_mapping allows tables referenced by symbols to be remapped to a different table name if necessary Note: table_mapping is a rarely used feature (since symbol tables are typically self-contained) """ def __init__(self, name: str, native_types: 'NativeTableInterface', table_mapping: Optional[Dict[str, str]] = None, class_types: Optional[Mapping[str, Type[objects.ObjectInterface]]] = None) -> None: """ Args: name: Name of the symbol table native_types: The native symbol table used to resolve any base/native types table_mapping: A dictionary mapping names of tables (which when present within the table will be changed to the mapped table) class_types: A dictionary of types and classes that should be instantiated instead of Struct to construct them """ self.name = name if table_mapping is None: table_mapping = {} self.table_mapping = table_mapping self._native_types = native_types self._sort_symbols = [] # type: List[Tuple[int, str]] # Set any provisioned class_types if class_types: for class_type in class_types: self.set_type_class(class_type, class_types[class_type]) # ## Required Symbol functions def get_symbol(self, name: str) -> SymbolInterface: """Resolves a symbol name into a symbol object. If the symbol isn't found, it raises a SymbolError exception """ raise NotImplementedError("Abstract property get_symbol not implemented by subclass.") @property def symbols(self) -> Iterable[str]: """Returns an iterator of the Symbol names.""" raise NotImplementedError("Abstract property symbols not implemented by subclass.") # ## Required Type functions @property def types(self) -> Iterable[str]: """Returns an iterator of the Symbol type names.""" raise NotImplementedError("Abstract property types not implemented by subclass.") def get_type(self, name: str) -> objects.Template: """Resolves a symbol name into an object template. If the symbol isn't found it raises a SymbolError exception """ raise NotImplementedError("Abstract method get_type not implemented by subclass.") # ## Required Symbol enumeration functions @property def enumerations(self) -> Iterable[Any]: """Returns an iterator of the Enumeration names.""" raise NotImplementedError("Abstract property enumerations not implemented by subclass.") # ## Native Type Handler @property def natives(self) -> 'NativeTableInterface': """Returns None or a NativeTable for handling space specific native types.""" return self._native_types @natives.setter def natives(self, value: 'NativeTableInterface') -> None: """Checks the natives value and then applies it internally. WARNING: This allows changing the underlying size of all the other types referenced in the SymbolTable """ self._native_types = value # ## Functions for overriding classes def set_type_class(self, name: str, clazz: Type[objects.ObjectInterface]) -> None: """Overrides the object class for a specific Symbol type. Name *must* be present in self.types Args: name: The name of the type to override the class for clazz: The actual class to override for the provided type name """ raise NotImplementedError("Abstract method set_type_class not implemented yet.") def get_type_class(self, name: str) -> Type[objects.ObjectInterface]: """Returns the class associated with a Symbol type.""" raise NotImplementedError("Abstract method get_type_class not implemented yet.") def del_type_class(self, name: str) -> None: """Removes the associated class override for a specific Symbol type.""" raise NotImplementedError("Abstract method del_type_class not implemented yet.") # ## Convenience functions for location symbols def get_symbol_type(self, name: str) -> Optional[objects.Template]: """Resolves a symbol name into a symbol and then resolves the symbol's type.""" type_name = self.get_symbol(name).type_name if type_name is None: return None return self.get_type(type_name) def get_symbols_by_type(self, type_name: str) -> Iterable[str]: """Returns the name of all symbols in this table that have type matching type_name.""" for symbol_name in self.symbols: # This allows for searching with and without the table name (in case multiple tables contain # the same symbol name and we've not specifically been told which one) symbol = self.get_symbol(symbol_name) if symbol.type_name is not None and (symbol.type_name == type_name or (symbol.type_name.endswith(constants.BANG + type_name))): yield symbol.name def get_symbols_by_location(self, offset: int, size: int = 0) -> Iterable[str]: """Returns the name of all symbols in this table that live at a particular offset.""" if size < 0: raise ValueError("Size must be strictly non-negative") if not self._sort_symbols: self._sort_symbols = sorted([(self.get_symbol(sn).address, sn) for sn in self.symbols]) sort_symbols = self._sort_symbols result = bisect.bisect_left(sort_symbols, (offset, "")) while result < len(sort_symbols) and \ (sort_symbols[result][0] >= offset and sort_symbols[result][0] <= offset + size): yield sort_symbols[result][1] result += 1 def clear_symbol_cache(self) -> None: """Clears the symbol cache of this symbol table.""" pass class SymbolSpaceInterface(collections.abc.Mapping): """An interface for the container that holds all the symbol-containing tables for use within a context.""" def free_table_name(self, prefix: str = "layer") -> str: """Returns an unused table name to ensure no collision occurs when inserting a symbol table.""" @abstractmethod def clear_symbol_cache(self, table_name: str) -> None: """Clears the symbol cache for the specified table name. If no table name is specified, the caches of all symbol tables are cleared.""" @abstractmethod def get_symbols_by_type(self, type_name: str) -> Iterable[str]: """Returns all symbols based on the type of the symbol.""" @abstractmethod def get_symbols_by_location(self, offset: int, size: int = 0, table_name: Optional[str] = None) -> Iterable[str]: """Returns all symbols that exist at a specific relative address.""" @abstractmethod def get_type(self, type_name: str) -> objects.Template: """Look-up a type name across all the contained symbol tables.""" @abstractmethod def get_symbol(self, symbol_name: str) -> SymbolInterface: """Look-up a symbol name across all the contained symbol tables.""" @abstractmethod def get_enumeration(self, enum_name: str) -> objects.Template: """Look-up an enumeration across all the contained symbol tables.""" @abstractmethod def has_type(self, name: str) -> bool: """Determines whether a type exists in the contained symbol tables.""" @abstractmethod def has_symbol(self, name: str) -> bool: """Determines whether a symbol exists in the contained symbol tables.""" @abstractmethod def has_enumeration(self, name: str) -> bool: """Determines whether an enumeration choice exists in the contained symbol tables.""" @abstractmethod def append(self, value: BaseSymbolTableInterface) -> None: """Adds a symbol_list to the end of the space.""" class SymbolTableInterface(BaseSymbolTableInterface, configuration.ConfigurableInterface, ABC): """Handles a table of symbols.""" # FIXME: native_types and table_mapping aren't recorded in the configuration def __init__(self, context: 'interfaces.context.ContextInterface', config_path: str, name: str, native_types: 'NativeTableInterface', table_mapping: Optional[Dict[str, str]] = None, class_types: Optional[Mapping[str, Type[objects.ObjectInterface]]] = None) -> None: """Instantiates an SymbolTable based on an IntermediateSymbolFormat JSON file. This is validated against the appropriate schema. Args: context: The volatility context for the symbol table config_path: The configuration path for the symbol table name: The name for the symbol table (this is used in symbols e.g. table!symbol ) isf_url: The URL pointing to the ISF file location native_types: The NativeSymbolTable that contains the native types for this symbol table table_mapping: A dictionary linking names referenced in the file with symbol tables in the context class_types: A dictionary of type names and classes that override StructType when they are instantiated """ configuration.ConfigurableInterface.__init__(self, context, config_path) BaseSymbolTableInterface.__init__(self, name, native_types, table_mapping, class_types = class_types) def build_configuration(self) -> 'configuration.HierarchicalDict': config = super().build_configuration() # Symbol Tables are constructable, and therefore require a class configuration variable config["class"] = self.__class__.__module__ + "." + self.__class__.__name__ return config @classmethod def get_requirements(cls) -> List[RequirementInterface]: return super().get_requirements() + [ requirements.IntRequirement(name = 'symbol_shift', description = 'Symbol Shift', optional = False), requirements.IntRequirement( name = 'symbol_mask', description = 'Address mask for symbols', optional = True, default = 0), ] class NativeTableInterface(BaseSymbolTableInterface): """Class to distinguish NativeSymbolLists from other symbol lists.""" def get_symbol(self, name: str) -> SymbolInterface: raise exceptions.SymbolError(name, self.name, "NativeTables never hold symbols") @property def symbols(self) -> Iterable[str]: return [] def get_enumeration(self, name: str) -> objects.Template: raise exceptions.SymbolError(name, self.name, "NativeTables never hold enumerations") @property def enumerations(self) -> Iterable[str]: return [] class MetadataInterface(object): """Interface for accessing metadata stored within a symbol table.""" def __init__(self, json_data: Dict) -> None: """Constructor that accepts json_data.""" self._json_data = json_data volatility3-1.0.1/volatility3/framework/layers/000077500000000000000000000000001405267600400215575ustar00rootroot00000000000000volatility3-1.0.1/volatility3/framework/layers/__init__.py000066400000000000000000000002731405267600400236720ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # volatility3-1.0.1/volatility3/framework/layers/codecs/000077500000000000000000000000001405267600400230175ustar00rootroot00000000000000volatility3-1.0.1/volatility3/framework/layers/codecs/__init__.py000066400000000000000000000001041405267600400251230ustar00rootroot00000000000000"""Codecs used for encoding or decoding data should live here """ volatility3-1.0.1/volatility3/framework/layers/crash.py000066400000000000000000000212001405267600400232240ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging import struct from typing import Tuple, Optional from volatility3.framework import constants, exceptions, interfaces from volatility3.framework.layers import segmented from volatility3.framework.symbols import intermed vollog = logging.getLogger(__name__) class WindowsCrashDumpFormatException(exceptions.LayerException): """Thrown when an error occurs with the underlying Crash file format.""" class WindowsCrashDump32Layer(segmented.SegmentedLayer): """A Windows crash format TranslationLayer. This TranslationLayer supports Microsoft complete memory dump files. It currently does not support kernel or small memory dump files. """ provides = {"type": "physical"} SIGNATURE = 0x45474150 VALIDDUMP = 0x504d5544 crashdump_json = 'crash' supported_dumptypes = [0x01] dump_header_name = '_DUMP_HEADER' _magic_struct = struct.Struct(' None: # Construct these so we can use self.config self._context = context self._config_path = config_path self._page_size = 0x1000 self._base_layer = self.config["base_layer"] # Create a custom SymbolSpace self._crash_table_name = intermed.IntermediateSymbolTable.create(context, self._config_path, 'windows', self.crashdump_json) # Check Header hdr_layer = self._context.layers[self._base_layer] hdr_offset = 0 self.check_header(hdr_layer, hdr_offset) # Need to create a header object header = self.context.object(self._crash_table_name + constants.BANG + self.dump_header_name, offset = hdr_offset, layer_name = self._base_layer) # Extract the DTB self.dtb = int(header.DirectoryTableBase) self.dump_type = int(header.DumpType) # Verify that it is a supported format if header.DumpType not in self.supported_dumptypes: vollog.log(constants.LOGLEVEL_VVVV, "unsupported dump format 0x{:x}".format(header.DumpType)) raise WindowsCrashDumpFormatException(name, "unsupported dump format 0x{:x}".format(header.DumpType)) super().__init__(context, config_path, name) def _load_segments(self) -> None: """Loads up the segments from the meta_layer.""" header = self.context.object(self._crash_table_name + constants.BANG + self.dump_header_name, offset = 0, layer_name = self._base_layer) segments = [] offset = self.headerpages header.PhysicalMemoryBlockBuffer.Run.count = header.PhysicalMemoryBlockBuffer.NumberOfRuns for x in header.PhysicalMemoryBlockBuffer.Run: segments.append((x.BasePage * 0x1000, offset * 0x1000, x.PageCount * 0x1000, x.PageCount * 0x1000)) # print("Segments {:x} {:x} {:x}".format(x.BasePage * 0x1000, # offset * 0x1000, # x.PageCount * 0x1000)) offset += x.PageCount if len(segments) == 0: raise WindowsCrashDumpFormatException(self.name, "No Crash segments defined in {}".format(self._base_layer)) self._segments = segments @classmethod def check_header(cls, base_layer: interfaces.layers.DataLayerInterface, offset: int = 0) -> Tuple[int, int]: # Verify the Window's crash dump file magic try: header_data = base_layer.read(offset, cls._magic_struct.size) except exceptions.InvalidAddressException: raise WindowsCrashDumpFormatException(base_layer.name, "Crashdump header not found at offset {}".format(offset)) (signature, validdump) = cls._magic_struct.unpack(header_data) if signature != cls.SIGNATURE: raise WindowsCrashDumpFormatException( base_layer.name, "Bad signature 0x{:x} at file offset 0x{:x}".format(signature, offset)) if validdump != cls.VALIDDUMP: raise WindowsCrashDumpFormatException(base_layer.name, "Invalid dump 0x{:x} at file offset 0x{:x}".format(validdump, offset)) return signature, validdump class WindowsCrashDump64Layer(WindowsCrashDump32Layer): """A Windows crash format TranslationLayer. This TranslationLayer supports Microsoft complete memory dump files. It currently does not support kernel or small memory dump files. """ VALIDDUMP = 0x34365544 crashdump_json = 'crash64' dump_header_name = '_DUMP_HEADER64' supported_dumptypes = [0x1, 0x05] headerpages = 2 def _load_segments(self) -> None: """Loads up the segments from the meta_layer.""" segments = [] summary_header = self.context.object(self._crash_table_name + constants.BANG + "_SUMMARY_DUMP64", offset = 0x2000, layer_name = self._base_layer) if self.dump_type == 0x1: header = self.context.object(self._crash_table_name + constants.BANG + self.dump_header_name, offset = 0, layer_name = self._base_layer) offset = self.headerpages header.PhysicalMemoryBlockBuffer.Run.count = header.PhysicalMemoryBlockBuffer.NumberOfRuns for x in header.PhysicalMemoryBlockBuffer.Run: segments.append((x.BasePage * 0x1000, offset * 0x1000, x.PageCount * 0x1000, x.PageCount * 0x1000)) offset += x.PageCount elif self.dump_type == 0x05: summary_header.BufferLong.count = (summary_header.BitmapSize + 31) // 32 previous_bit = 0 start_position = 0 # We cast as an int because we don't want to carry the context around with us for infinite loop reasons mapped_offset = int(summary_header.HeaderSize) current_word = None for bit_position in range(len(summary_header.BufferLong) * 32): if (bit_position % 32) == 0: current_word = summary_header.BufferLong[bit_position // 32] current_bit = (current_word >> (bit_position % 32)) & 1 if current_bit != previous_bit: if previous_bit == 0: # Start start_position = bit_position else: # Finish length = (bit_position - start_position) * 0x1000 segments.append((start_position * 0x1000, mapped_offset, length, length)) mapped_offset += length # Finish it off if bit_position == (len(summary_header.BufferLong) * 32) - 1 and current_bit == 1: length = (bit_position - start_position) * 0x1000 segments.append((start_position * 0x1000, mapped_offset, length, length)) mapped_offset += length previous_bit = current_bit else: vollog.log(constants.LOGLEVEL_VVVV, "unsupported dump format 0x{:x}".format(self.dump_type)) raise WindowsCrashDumpFormatException(self.name, "unsupported dump format 0x{:x}".format(self.dump_type)) if len(segments) == 0: raise WindowsCrashDumpFormatException(self.name, "No Crash segments defined in {}".format(self._base_layer)) self._segments = segments class WindowsCrashDumpStacker(interfaces.automagic.StackerLayerInterface): stack_order = 11 @classmethod def stack(cls, context: interfaces.context.ContextInterface, layer_name: str, progress_callback: constants.ProgressCallback = None) -> Optional[interfaces.layers.DataLayerInterface]: for layer in [WindowsCrashDump32Layer, WindowsCrashDump64Layer]: try: layer.check_header(context.layers[layer_name]) new_name = context.layers.free_layer_name(layer.__name__) context.config[interfaces.configuration.path_join(new_name, "base_layer")] = layer_name return layer(context, new_name, new_name) except WindowsCrashDumpFormatException: pass return None volatility3-1.0.1/volatility3/framework/layers/elf.py000066400000000000000000000077601405267600400227110ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging import struct from typing import Optional from volatility3.framework import exceptions, interfaces, constants from volatility3.framework.layers import segmented from volatility3.framework.symbols import intermed vollog = logging.getLogger(__name__) class ElfFormatException(exceptions.LayerException): """Thrown when an error occurs with the underlying ELF file format.""" class Elf64Layer(segmented.SegmentedLayer): """A layer that supports the Elf64 format as documented at: http://ftp.openwatcom.org/devel/docs/elf-64-gen.pdf""" _header_struct = struct.Struct(" None: # Create a custom SymbolSpace self._elf_table_name = intermed.IntermediateSymbolTable.create(context, config_path, 'linux', 'elf') super().__init__(context, config_path, name) def _load_segments(self) -> None: """Load the segments from based on the PT_LOAD segments of the Elf64 format""" ehdr = self.context.object(self._elf_table_name + constants.BANG + "Elf64_Ehdr", layer_name = self._base_layer, offset = 0) segments = [] for pindex in range(ehdr.e_phnum): phdr = self.context.object(self._elf_table_name + constants.BANG + "Elf64_Phdr", layer_name = self._base_layer, offset = ehdr.e_phoff + (pindex * ehdr.e_phentsize)) # We only want PT_TYPES with valid sizes if phdr.p_type.lookup() == "PT_LOAD" and phdr.p_filesz == phdr.p_memsz and phdr.p_filesz > 0: # Cast these to ints to ensure the offsets don't need reconstructing segments.append((int(phdr.p_paddr), int(phdr.p_offset), int(phdr.p_memsz), int(phdr.p_memsz))) if len(segments) == 0: raise ElfFormatException(self.name, "No ELF segments defined in {}".format(self._base_layer)) self._segments = segments @classmethod def _check_header(cls, base_layer: interfaces.layers.DataLayerInterface, offset: int = 0) -> bool: try: header_data = base_layer.read(offset, cls._header_struct.size) except exceptions.InvalidAddressException: raise ElfFormatException(base_layer.name, "Offset 0x{:0x} does not exist within the base layer".format(offset)) (magic, elf_class, elf_data_encoding, elf_version) = cls._header_struct.unpack(header_data) if magic != cls.MAGIC: raise ElfFormatException(base_layer.name, "Bad magic 0x{:x} at file offset 0x{:x}".format(magic, offset)) if elf_class != cls.ELF_CLASS: raise ElfFormatException(base_layer.name, "ELF class is not 64-bit (2): {:d}".format(elf_class)) # Virtualbox uses an ELF version of 0, which isn't to specification, but is ok to deal with return True class Elf64Stacker(interfaces.automagic.StackerLayerInterface): stack_order = 10 @classmethod def stack(cls, context: interfaces.context.ContextInterface, layer_name: str, progress_callback: constants.ProgressCallback = None) -> Optional[interfaces.layers.DataLayerInterface]: try: if not Elf64Layer._check_header(context.layers[layer_name]): return None except ElfFormatException as excp: vollog.log(constants.LOGLEVEL_VVVV, "Exception: {}".format(excp)) return None new_name = context.layers.free_layer_name("Elf64Layer") context.config[interfaces.configuration.path_join(new_name, "base_layer")] = layer_name return Elf64Layer(context, new_name, new_name) volatility3-1.0.1/volatility3/framework/layers/intel.py000066400000000000000000000333411405267600400232500ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import collections import functools import logging import math import struct from typing import Any, Dict, Iterable, List, Optional, Tuple from volatility3 import classproperty from volatility3.framework import exceptions, interfaces, constants from volatility3.framework.configuration import requirements from volatility3.framework.layers import linear vollog = logging.getLogger(__name__) INTEL_TRANSLATION_DEBUGGING = False class Intel(linear.LinearlyMappedLayer): """Translation Layer for the Intel IA32 memory mapping.""" _entry_format = " None: super().__init__(context = context, config_path = config_path, name = name, metadata = metadata) self._base_layer = self.config["memory_layer"] self._swap_layers = [] # type: List[str] self._page_map_offset = self.config["page_map_offset"] # Assign constants self._initial_position = min(self._maxvirtaddr, self._bits_per_register) - 1 self._initial_entry = self._mask(self._page_map_offset, self._initial_position, 0) | 0x1 self._entry_size = struct.calcsize(self._entry_format) self._entry_number = self.page_size // self._entry_size # These can vary depending on the type of space self._index_shift = int(math.ceil(math.log2(struct.calcsize(self._entry_format)))) @classproperty def page_size(cls) -> int: """Page size for the intel memory layers. All Intel layers work on 4096 byte pages """ return 1 << cls._page_size_in_bits @classproperty def bits_per_register(cls) -> int: """Returns the bits_per_register to determine the range of an IntelTranslationLayer.""" return cls._bits_per_register @classproperty def minimum_address(cls) -> int: return 0 @classproperty def maximum_address(cls) -> int: return (1 << cls._maxvirtaddr) - 1 @classproperty def structure(cls) -> List[Tuple[str, int, bool]]: return cls._structure @staticmethod def _mask(value: int, high_bit: int, low_bit: int) -> int: """Returns the bits of a value between highbit and lowbit inclusive.""" high_mask = (1 << (high_bit + 1)) - 1 low_mask = (1 << low_bit) - 1 mask = (high_mask ^ low_mask) # print(high_bit, low_bit, bin(mask), bin(value)) return value & mask @staticmethod def _page_is_valid(entry: int) -> bool: """Returns whether a particular page is valid based on its entry.""" return bool(entry & 1) def _translate(self, offset: int) -> Tuple[int, int, str]: """Translates a specific offset based on paging tables. Returns the translated offset, the contiguous pagesize that the translated address lives in and the layer_name that the address lives in """ entry, position = self._translate_entry(offset) # Now we're done if not self._page_is_valid(entry): raise exceptions.PagedInvalidAddressException(self.name, offset, position + 1, entry, "Page Fault at entry {} in page entry".format(hex(entry))) page = self._mask(entry, self._maxphyaddr - 1, position + 1) | self._mask(offset, position, 0) return page, 1 << (position + 1), self._base_layer def _translate_entry(self, offset: int) -> Tuple[int, int]: """Translates a specific offset based on paging tables. Returns the translated entry value """ # Setup the entry and how far we are through the offset # Position maintains the number of bits left to process # We or with 0x1 to ensure our page_map_offset is always valid position = self._initial_position entry = self._initial_entry # Run through the offset in various chunks for (name, size, large_page) in self._structure: # Check we're valid if not self._page_is_valid(entry): raise exceptions.PagedInvalidAddressException(self.name, offset, position + 1, entry, "Page Fault at entry " + hex(entry) + " in table " + name) # Check if we're a large page if large_page and (entry & (1 << 7)): # We're a large page, the rest is finished below # If we want to implement PSE-36, it would need to be done here break # Figure out how much of the offset we should be using start = position position -= size index = self._mask(offset, start, position + 1) >> (position + 1) # Grab the base address of the table we'll be getting the next entry from base_address = self._mask(entry, self._maxphyaddr - 1, size + self._index_shift) table = self._get_valid_table(base_address) if table is None: raise exceptions.PagedInvalidAddressException(self.name, offset, position + 1, entry, "Page Fault at entry " + hex(entry) + " in table " + name) # Read the data for the next entry entry_data = table[(index << self._index_shift):(index << self._index_shift) + self._entry_size] if INTEL_TRANSLATION_DEBUGGING: vollog.log( constants.LOGLEVEL_VVVV, "Entry {} at index {} gives data {} as {}".format( hex(entry), hex(index), hex(struct.unpack(self._entry_format, entry_data)[0]), name)) # Read out the new entry from memory entry, = struct.unpack(self._entry_format, entry_data) return entry, position @functools.lru_cache(1025) def _get_valid_table(self, base_address: int) -> Optional[bytes]: """Extracts the table, validates it and returns it if it's valid.""" table = self._context.layers.read(self._base_layer, base_address, self.page_size) # If the table is entirely duplicates, then mark the whole table as bad if (table == table[:self._entry_size] * self._entry_number): return None return table def is_valid(self, offset: int, length: int = 1) -> bool: """Returns whether the address offset can be translated to a valid address.""" try: # TODO: Consider reimplementing this, since calls to mapping can call is_valid return all([ self._context.layers[layer].is_valid(mapped_offset) for _, _, mapped_offset, _, layer in self.mapping(offset, length) ]) except exceptions.InvalidAddressException: return False def mapping(self, offset: int, length: int, ignore_errors: bool = False) -> Iterable[Tuple[int, int, int, int, str]]: """Returns a sorted iterable of (offset, sublength, mapped_offset, mapped_length, layer) mappings. This allows translation layers to provide maps of contiguous regions in one layer """ if length == 0: try: mapped_offset, _, layer_name = self._translate(offset) if not self._context.layers[layer_name].is_valid(mapped_offset): raise exceptions.InvalidAddressException(layer_name = layer_name, invalid_address = mapped_offset) except exceptions.InvalidAddressException: if not ignore_errors: raise return yield offset, length, mapped_offset, length, layer_name return while length > 0: try: chunk_offset, page_size, layer_name = self._translate(offset) chunk_size = min(page_size - (chunk_offset % page_size), length) if not self._context.layers[layer_name].is_valid(chunk_offset, chunk_size): raise exceptions.InvalidAddressException(layer_name = layer_name, invalid_address = chunk_offset) except (exceptions.PagedInvalidAddressException, exceptions.InvalidAddressException) as excp: if not ignore_errors: raise # We can jump more if we know where the page fault failed if isinstance(excp, exceptions.PagedInvalidAddressException): mask = (1 << excp.invalid_bits) - 1 else: mask = (1 << self._page_size_in_bits) - 1 length_diff = (mask + 1 - (offset & mask)) length -= length_diff offset += length_diff else: yield offset, chunk_size, chunk_offset, chunk_size, layer_name length -= chunk_size offset += chunk_size @property def dependencies(self) -> List[str]: """Returns a list of the lower layer names that this layer is dependent upon.""" return [self._base_layer] + self._swap_layers @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'memory_layer', optional = False), requirements.LayerListRequirement(name = 'swap_layers', optional = True), requirements.IntRequirement(name = 'page_map_offset', optional = False), requirements.IntRequirement(name = 'kernel_virtual_offset', optional = True), requirements.StringRequirement(name = 'kernel_banner', optional = True) ] class IntelPAE(Intel): """Class for handling Physical Address Extensions for Intel architectures.""" _entry_format = " bool: """Returns whether a particular page is valid based on its entry. Windows uses additional "available" bits to store flags These flags allow windows to determine whether a page is still valid Bit 11 is the transition flag, and Bit 10 is the prototype flag For more information, see Windows Internals (6th Ed, Part 2, pages 268-269) """ return bool((entry & 1) or ((entry & 1 << 11) and not entry & 1 << 10)) def _translate_swap(self, layer: Intel, offset: int, bit_offset: int) -> Tuple[int, int, str]: try: return super()._translate(offset) except exceptions.PagedInvalidAddressException as excp: entry = excp.entry tbit = bool(entry & (1 << 11)) pbit = bool(entry & (1 << 10)) unknown_bit = bool(entry & (1 << 7)) n = (entry >> 1) & 0xF vbit = bool(entry & 1) if (not tbit and not pbit and not vbit and unknown_bit) and ((entry >> bit_offset) != 0): swap_offset = entry >> bit_offset << excp.invalid_bits if layer.config.get('swap_layers', False): swap_layer_name = layer.config.get( interfaces.configuration.path_join('swap_layers', 'swap_layers' + str(n)), None) if swap_layer_name: return swap_offset, 1 << excp.invalid_bits, swap_layer_name raise exceptions.SwappedInvalidAddressException(layer_name = excp.layer_name, invalid_address = excp.invalid_address, invalid_bits = excp.invalid_bits, entry = excp.entry, swap_offset = swap_offset) raise ### These must be full separate classes so that JSON configs re-create them properly class WindowsIntel(WindowsMixin, Intel): def _translate(self, offset): return self._translate_swap(self, offset, self._page_size_in_bits) class WindowsIntelPAE(WindowsMixin, IntelPAE): def _translate(self, offset: int) -> Tuple[int, int, str]: return self._translate_swap(self, offset, self._bits_per_register) class WindowsIntel32e(WindowsMixin, Intel32e): def _translate(self, offset: int) -> Tuple[int, int, str]: return self._translate_swap(self, offset, self._bits_per_register // 2) volatility3-1.0.1/volatility3/framework/layers/lime.py000066400000000000000000000071741405267600400230700ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import struct from typing import Optional, Tuple from volatility3.framework import exceptions, interfaces, constants from volatility3.framework.layers import segmented class LimeFormatException(exceptions.LayerException): """Thrown when an error occurs with the underlying Lime file format.""" class LimeLayer(segmented.SegmentedLayer): """A Lime format TranslationLayer. Lime is generally used to store physical memory images where there are large holes in the physical layer """ MAGIC = 0x4c694d45 VERSION = 1 # Magic[4], Version[4], Start[8], End[8], Reserved[8] # XXX move this to a custom SymbolSpace? _header_struct = struct.Struct(' None: super().__init__(context, config_path, name) # The base class loads the segments on initialization, but otherwise this must to get the right min/max addresses def _load_segments(self) -> None: base_layer = self._context.layers[self._base_layer] base_maxaddr = base_layer.maximum_address maxaddr = 0 offset = 0 header_size = self._header_struct.size segments = [] while offset < base_maxaddr: start, end = self._check_header(base_layer, offset) if start < maxaddr or end < start: raise LimeFormatException( self.name, "Bad start/end 0x{:x}/0x{:x} at file offset 0x{:x}".format(start, end, offset)) segment_length = end - start + 1 segments.append((start, offset + header_size, segment_length, segment_length)) maxaddr = end offset = offset + header_size + segment_length if len(segments) == 0: raise LimeFormatException(self.name, "No LiME segments defined in {}".format(self._base_layer)) self._segments = segments @classmethod def _check_header(cls, base_layer: interfaces.layers.DataLayerInterface, offset: int = 0) -> Tuple[int, int]: try: header_data = base_layer.read(offset, cls._header_struct.size) except exceptions.InvalidAddressException: raise LimeFormatException(base_layer.name, "Offset 0x{:0x} does not exist within the base layer".format(offset)) (magic, version, start, end, reserved) = cls._header_struct.unpack(header_data) if magic != cls.MAGIC: raise LimeFormatException(base_layer.name, "Bad magic 0x{:x} at file offset 0x{:x}".format(magic, offset)) if version != cls.VERSION: raise LimeFormatException(base_layer.name, "Unexpected version {:d} at file offset 0x{:x}".format(version, offset)) return start, end class LimeStacker(interfaces.automagic.StackerLayerInterface): stack_order = 10 @classmethod def stack(cls, context: interfaces.context.ContextInterface, layer_name: str, progress_callback: constants.ProgressCallback = None) -> Optional[interfaces.layers.DataLayerInterface]: try: LimeLayer._check_header(context.layers[layer_name]) except LimeFormatException: return None new_name = context.layers.free_layer_name("LimeLayer") context.config[interfaces.configuration.path_join(new_name, "base_layer")] = layer_name return LimeLayer(context, new_name, new_name) volatility3-1.0.1/volatility3/framework/layers/linear.py000066400000000000000000000071441405267600400234110ustar00rootroot00000000000000import functools from typing import List, Optional, Tuple, Iterable from volatility3.framework import exceptions, interfaces class LinearlyMappedLayer(interfaces.layers.TranslationLayerInterface): """Class to differentiate Linearly Mapped layers (where a => b implies that a + c => b + c)""" ### Translation layer convenience function def translate(self, offset: int, ignore_errors: bool = False) -> Tuple[Optional[int], Optional[str]]: mapping = list(self.mapping(offset, 0, ignore_errors)) if len(mapping) == 1: original_offset, _, mapped_offset, _, layer = mapping[0] if original_offset != offset: raise exceptions.LayerException(self.name, "Layer {} claims to map linearly but does not".format(self.name)) else: if ignore_errors: # We should only hit this if we ignored errors, but check anyway return None, None raise exceptions.InvalidAddressException(self.name, offset, "Cannot translate {} in layer {}".format(offset, self.name)) return mapped_offset, layer # ## Read/Write functions for mapped pages # Redefine read here for speed reasons (so we don't call a processing method @functools.lru_cache(maxsize = 512) def read(self, offset: int, length: int, pad: bool = False) -> bytes: """Reads an offset for length bytes and returns 'bytes' (not 'str') of length size.""" current_offset = offset output = [] # type: List[bytes] for (offset, _, mapped_offset, mapped_length, layer) in self.mapping(offset, length, ignore_errors = pad): if not pad and offset > current_offset: raise exceptions.InvalidAddressException( self.name, current_offset, "Layer {} cannot map offset: {}".format(self.name, current_offset)) elif offset > current_offset: output += [b"\x00" * (offset - current_offset)] current_offset = offset elif offset < current_offset: raise exceptions.LayerException(self.name, "Mapping returned an overlapping element") if mapped_length > 0: output += [self._context.layers.read(layer, mapped_offset, mapped_length, pad)] current_offset += mapped_length recovered_data = b"".join(output) return recovered_data + b"\x00" * (length - len(recovered_data)) def write(self, offset: int, value: bytes) -> None: """Writes a value at offset, distributing the writing across any underlying mapping.""" current_offset = offset length = len(value) for (offset, _, mapped_offset, length, layer) in self.mapping(offset, length): if offset > current_offset: raise exceptions.InvalidAddressException( self.name, current_offset, "Layer {} cannot map offset: {}".format(self.name, current_offset)) elif offset < current_offset: raise exceptions.LayerException(self.name, "Mapping returned an overlapping element") self._context.layers.write(layer, mapped_offset, value[:length]) value = value[length:] current_offset += length def _scan_iterator(self, scanner: 'interfaces.layers.ScannerInterface', sections: Iterable[Tuple[int, int]], linear: bool = True) -> Iterable[interfaces.layers.IteratorValue]: return super()._scan_iterator(scanner, sections, linear) volatility3-1.0.1/volatility3/framework/layers/msf.py000066400000000000000000000246041405267600400227240ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import math from typing import Optional, Dict, Any, List, Iterable, Tuple from volatility3.framework import interfaces, constants, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.layers import linear from volatility3.framework.objects import utility from volatility3.framework.symbols import intermed class PDBFormatException(exceptions.LayerException): """Thrown when an error occurs with the underlying MSF file format.""" class PdbMultiStreamFormat(linear.LinearlyMappedLayer): _headers = { "MSF_HDR": "Microsoft C/C++ program database 2.00\r\n\x1a\x4a\x47", "BIG_MSF_HDR": "Microsoft C/C++ MSF 7.00\r\n\x1a\x44\x53", } def __init__(self, context: 'interfaces.context.ContextInterface', config_path: str, name: str, metadata: Optional[Dict[str, Any]] = None) -> None: super().__init__(context, config_path, name, metadata) self._base_layer = self.config["base_layer"] self._pdb_symbol_table = intermed.IntermediateSymbolTable.create(context, self._config_path, 'windows', 'pdb') response = self._check_header() if response is None: raise PDBFormatException(name, "Could not find a suitable header") self._version, self._header = response self._streams = {} # type: Dict[int, str] @property def pdb_symbol_table(self) -> str: return self._pdb_symbol_table def read_streams(self): # Shortcut in case they've already been read if self._streams: return # Recover the root table, by recovering the root table index table... module = self.context.module(self.pdb_symbol_table, self._base_layer, offset = 0) entry_size = module.get_type("unsigned long").size root_table_num_pages = math.ceil(self._header.StreamInfo.StreamInfoSize / self._header.PageSize) root_index_size = math.ceil((root_table_num_pages * entry_size) / self._header.PageSize) root_index = module.object(object_type = "array", offset = self._header.vol.size, count = root_index_size, subtype = module.get_type("unsigned long")) root_index_layer_name = self.create_stream_from_pages("root_index", self._header.StreamInfo.StreamInfoSize, [x for x in root_index]) module = self.context.module(self.pdb_symbol_table, root_index_layer_name, offset = 0) root_pages = module.object(object_type = "array", offset = 0, count = root_table_num_pages, subtype = module.get_type("unsigned long")) root_layer_name = self.create_stream_from_pages("root", self._header.StreamInfo.StreamInfoSize, [x for x in root_pages]) module = self.context.module(self.pdb_symbol_table, root_layer_name, offset = 0) num_streams = module.object(object_type = "unsigned long", offset = 0) stream_sizes = module.object(object_type = "array", offset = entry_size, count = num_streams, subtype = module.get_type("unsigned long")) current_offset = (num_streams + 1) * entry_size for stream in range(num_streams): list_size = math.ceil(stream_sizes[stream] / self.page_size) if list_size == 0 or stream_sizes[stream] == 0xffffffff: self._streams[stream] = None else: stream_page_list = module.object(object_type = "array", offset = current_offset, count = list_size, subtype = module.get_type("unsigned long")) current_offset += (list_size * entry_size) self._streams[stream] = self.create_stream_from_pages("stream" + str(stream), stream_sizes[stream], [x for x in stream_page_list]) def create_stream_from_pages(self, stream_name: str, maximum_size: int, pages: List[int]) -> str: # Construct a root layer based on a number of pages layer_name = self.name + "_" + stream_name path_join = interfaces.configuration.path_join config_path = path_join(self.config_path, stream_name) self.context.config[path_join(config_path, 'base_layer')] = self.name self.context.config[path_join(config_path, 'pages')] = pages self.context.config[path_join(config_path, 'maximum_size')] = maximum_size layer = PdbMSFStream(self.context, config_path, layer_name) self.context.layers.add_layer(layer) return layer_name def _check_header(self) -> Optional[Tuple[str, interfaces.objects.ObjectInterface]]: """Verifies the header of the PDB file and returns the version of the file.""" for header in self._headers: header_type = self.pdb_symbol_table + constants.BANG + header current_header = self.context.object(header_type, self._base_layer, 0) if utility.array_to_string(current_header.Magic) == self._headers[header]: if not (current_header.PageSize < 0x100 or current_header.PageSize > (128 * 0x10000)): return header, current_header return None @property def page_size(self): return self._header.PageSize @property def dependencies(self) -> List[str]: """Returns a list of the lower layers that this layer is dependent upon.""" return [self._base_layer] @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [requirements.TranslationLayerRequirement(name = 'base_layer', optional = False)] @property def maximum_address(self) -> int: return self.context.layers[self._base_layer].maximum_address @property def minimum_address(self) -> int: return self.context.layers[self._base_layer].minimum_address def is_valid(self, offset: int, length: int = 1) -> bool: return self.context.layers[self._base_layer].is_valid(offset, length) def mapping(self, offset: int, length: int, ignore_errors: bool = False) -> Iterable[Tuple[int, int, int, int, str]]: yield offset, length, offset, length, self._base_layer def get_stream(self, index) -> Optional['PdbMSFStream']: self.read_streams() if index not in self._streams: raise PDBFormatException(self.name, "Stream not present") if self._streams[index]: layer = self.context.layers[self._streams[index]] if isinstance(layer, PdbMSFStream): return layer return None class PdbMSFStream(linear.LinearlyMappedLayer): def __init__(self, context: 'interfaces.context.ContextInterface', config_path: str, name: str, metadata: Optional[Dict[str, Any]] = None) -> None: super().__init__(context, config_path, name, metadata) self._base_layer = self.config["base_layer"] self._pages = self.config.get("pages", None) self._pages_len = len(self._pages) if not self._pages: raise PDBFormatException(name, "Invalid/no pages specified") if not isinstance(self._pdb_layer, PdbMultiStreamFormat): raise TypeError("Base Layer must be a PdbMultiStreamFormat layer") @property def pdb_symbol_table(self) -> Optional[str]: layer = self._context.layers[self._base_layer] if isinstance(layer, PdbMultiStreamFormat): return layer.pdb_symbol_table else: return None @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.ListRequirement(name = 'pages', element_type = int, min_elements = 1), requirements.TranslationLayerRequirement(name = 'base_layer'), requirements.IntRequirement(name = 'maximum_size') ] def mapping(self, offset: int, length: int, ignore_errors: bool = False) -> Iterable[Tuple[int, int, int, int, str]]: returned = 0 page_size = self._pdb_layer.page_size while length > 0: page = math.floor((offset + returned) / page_size) page_position = ((offset + returned) % page_size) chunk_size = min(page_size - page_position, length) if page >= self._pages_len: if not ignore_errors: raise exceptions.InvalidAddressException(layer_name = self.name, invalid_address = offset + returned) else: yield offset + returned, chunk_size, (self._pages[page] * page_size) + page_position, chunk_size, self._base_layer returned += chunk_size length -= chunk_size @property def dependencies(self) -> List[str]: return [self._base_layer] def is_valid(self, offset: int, length: int = 1) -> bool: return self.context.layers[self._base_layer].is_valid(offset, length) @property def minimum_address(self) -> int: return 0 @property def maximum_address(self) -> int: return self.config.get('maximum_size', len(self._pages) * self._pdb_layer.page_size) @property def _pdb_layer(self) -> PdbMultiStreamFormat: if self._base_layer not in self._context.layers: raise PDBFormatException(self._base_layer, "No PdbMultiStreamFormat layer found: {}".format(self._base_layer)) result = self._context.layers[self._base_layer] if isinstance(result, PdbMultiStreamFormat): return result raise TypeError("Base layer is not PdbMultiStreamFormat") volatility3-1.0.1/volatility3/framework/layers/physical.py000066400000000000000000000167541405267600400237620ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import threading from typing import Any, Dict, IO, List, Optional, Union from volatility3.framework import exceptions, interfaces, constants from volatility3.framework.configuration import requirements from volatility3.framework.layers import resources class BufferDataLayer(interfaces.layers.DataLayerInterface): """A DataLayer class backed by a buffer in memory, designed for testing and swift data access.""" def __init__(self, context: interfaces.context.ContextInterface, config_path: str, name: str, buffer: bytes, metadata: Optional[Dict[str, Any]] = None) -> None: super().__init__(context = context, config_path = config_path, name = name, metadata = metadata) self._buffer = buffer @property def maximum_address(self) -> int: """Returns the largest available address in the space.""" return len(self._buffer) - 1 @property def minimum_address(self) -> int: """Returns the smallest available address in the space.""" return 0 def is_valid(self, offset: int, length: int = 1) -> bool: """Returns whether the offset is valid or not.""" return bool(self.minimum_address <= offset <= self.maximum_address and self.minimum_address <= offset + length - 1 <= self.maximum_address) def read(self, address: int, length: int, pad: bool = False) -> bytes: """Reads the data from the buffer.""" if not self.is_valid(address, length): invalid_address = address if self.minimum_address < address <= self.maximum_address: invalid_address = self.maximum_address + 1 raise exceptions.InvalidAddressException(self.name, invalid_address, "Offset outside of the buffer boundaries") return self._buffer[address:address + length] def write(self, address: int, data: bytes): """Writes the data from to the buffer.""" self._buffer = self._buffer[:address] + data + self._buffer[address + len(data):] @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # No real requirements (only the buffer). Need to figure out if there's a better way of representing this return [ requirements.BytesRequirement(name = 'buffer', description = "The direct bytes to interact with", optional = False) ] class DummyLock: def __enter__(self) -> None: pass def __exit__(self, type, value, traceback) -> None: pass class FileLayer(interfaces.layers.DataLayerInterface): """a DataLayer backed by a file on the filesystem.""" def __init__(self, context: interfaces.context.ContextInterface, config_path: str, name: str, metadata: Optional[Dict[str, Any]] = None) -> None: super().__init__(context = context, config_path = config_path, name = name, metadata = metadata) self._location = self.config["location"] self._accessor = resources.ResourceAccessor() self._file_ = None # type: Optional[IO[Any]] self._size = None # type: Optional[int] # Construct the lock now (shared if made before threading) in case we ever need it self._lock = DummyLock() # type: Union[DummyLock, threading.Lock] if constants.PARALLELISM == constants.Parallelism.Threading: self._lock = threading.Lock() # Instantiate the file to throw exceptions if the file doesn't open _ = self._file @property def location(self) -> str: """Returns the location on which this Layer abstracts.""" return self._location @property def _file(self) -> IO[Any]: """Property to prevent the initializer storing an unserializable open file (for context cloning)""" # FIXME: Add "+" to the mode once we've determined whether write mode is enabled mode = "rb" self._file_ = self._file_ or self._accessor.open(self._location, mode) return self._file_ @property def maximum_address(self) -> int: """Returns the largest available address in the space.""" # Zero based, so we return the size of the file minus 1 if self._size: return self._size with self._lock: orig = self._file.tell() self._file.seek(0, 2) self._size = self._file.tell() self._file.seek(orig) return self._size @property def minimum_address(self) -> int: """Returns the smallest available address in the space.""" return 0 def is_valid(self, offset: int, length: int = 1) -> bool: """Returns whether the offset is valid or not.""" if length <= 0: raise ValueError("Length must be positive") return bool(self.minimum_address <= offset <= self.maximum_address and self.minimum_address <= offset + length - 1 <= self.maximum_address) def read(self, offset: int, length: int, pad: bool = False) -> bytes: """Reads from the file at offset for length.""" if not self.is_valid(offset, length): invalid_address = offset if self.minimum_address < offset <= self.maximum_address: invalid_address = self.maximum_address + 1 raise exceptions.InvalidAddressException(self.name, invalid_address, "Offset outside of the buffer boundaries") # TODO: implement locking for multi-threading with self._lock: self._file.seek(offset) data = self._file.read(length) if len(data) < length: if pad: data += (b"\x00" * (length - len(data))) else: raise exceptions.InvalidAddressException( self.name, offset + len(data), "Could not read sufficient bytes from the " + self.name + " file") return data def write(self, offset: int, data: bytes) -> None: """Writes to the file. This will technically allow writes beyond the extent of the file """ if not self.is_valid(offset, len(data)): invalid_address = offset if self.minimum_address < offset <= self.maximum_address: invalid_address = self.maximum_address + 1 raise exceptions.InvalidAddressException(self.name, invalid_address, "Data segment outside of the " + self.name + " file boundaries") with self._lock: self._file.seek(offset) self._file.write(data) def __getstate__(self) -> Dict[str, Any]: """Do not store the open _file_ attribute, our property will ensure the file is open when needed. This is necessary for multi-processing """ self._file_ = None return self.__dict__ def destroy(self) -> None: """Closes the file handle.""" self._file.close() @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [requirements.StringRequirement(name = 'location', optional = False)] volatility3-1.0.1/volatility3/framework/layers/qemu.py000066400000000000000000000301341405267600400231010ustar00rootroot00000000000000# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import functools import json import math from typing import Optional, Dict, Any, Tuple, List, Set from volatility3.framework import interfaces, exceptions, constants from volatility3.framework.layers import segmented from volatility3.framework.symbols import intermed class QemuSuspendLayer(segmented.NonLinearlySegmentedLayer): """A Qemu suspend-to-disk translation layer.""" QEVM_EOF = 0x00 QEVM_SECTION_START = 0x01 QEVM_SECTION_PART = 0x02 QEVM_SECTION_END = 0x03 QEVM_SECTION_FULL = 0x04 QEVM_SUBSECTION = 0x05 QEVM_VMDESCRIPTION = 0x06 QEVM_CONFIGURATION = 0x07 QEVM_SECTION_FOOTER = 0x7e HASH_PTE_SIZE_64 = 16 SEGMENT_FLAG_COMPRESS = 0x02 SEGMENT_FLAG_MEM_SIZE = 0x04 SEGMENT_FLAG_PAGE = 0x08 SEGMENT_FLAG_EOS = 0x10 SEGMENT_FLAG_CONTINUE = 0x20 SEGMENT_FLAG_XBZRLE = 0x40 SEGMENT_FLAG_HOOK = 0x80 def __init__(self, context: interfaces.context.ContextInterface, config_path: str, name: str, metadata: Optional[Dict[str, Any]] = None) -> None: self._qemu_table_name = intermed.IntermediateSymbolTable.create(context, config_path, 'generic', 'qemu') self._configuration = None self._compressed = set() # type: Set[int] self._current_segment_name = b'' super().__init__(context = context, config_path = config_path, name = name, metadata = metadata) @classmethod def _check_header(cls, base_layer: interfaces.layers.DataLayerInterface, name: str = ''): header = base_layer.read(0, 8) if header[:4] != b'\x51\x45\x56\x4D': raise exceptions.LayerException(name, 'No QEMU magic bytes') if header[4:] != b'\x00\x00\x00\x03': raise exceptions.LayerException(name, 'Unsupported QEMU version found') def _read_configuration(self, base_layer: interfaces.layers.DataLayerInterface, name: str) -> Any: """Reads the JSON configuration from the end of the file""" chunk_size = 0x4096 data = b'' for i in range(base_layer.maximum_address, base_layer.minimum_address, -chunk_size): if i != base_layer.maximum_address: data = base_layer.read(i, chunk_size) + data if b'\x00' in data: start = data.rfind(b'\x00') data = data[data.find(b'{', start):] return json.loads(data) raise exceptions.LayerException(name, "Could not load JSON configuration from the end of the file") def _get_ram_segments(self, index: int, page_size: int) -> Tuple[List[Tuple[int, int, int, int]], int]: """Recovers the new index and any sections of memory from a ram section""" done = None segments = [] base_layer = self.context.layers[self._base_layer] while not done: addr = self.context.object(self._qemu_table_name + constants.BANG + 'unsigned long long', offset = index, layer_name = self._base_layer) flags = addr & (page_size - 1) page_size_bits = int(math.log(page_size, 2)) addr = (addr >> page_size_bits) << page_size_bits index += 8 if flags & self.SEGMENT_FLAG_MEM_SIZE: namelen = self._context.object(self._qemu_table_name + constants.BANG + 'unsigned char', offset = index, layer_name = self._base_layer) while namelen != 0: # if base_layer.read(index + 1, namelen) == b'pc.ram': # total_size = self._context.object(self._qemu_table_name + constants.BANG + 'unsigned long long', # offset = index + 1 + namelen, # layer_name = self._base_layer) index += 1 + namelen + 8 namelen = self._context.object(self._qemu_table_name + constants.BANG + 'unsigned char', offset = index, layer_name = self._base_layer) if flags & (self.SEGMENT_FLAG_COMPRESS | self.SEGMENT_FLAG_PAGE): if not (flags & self.SEGMENT_FLAG_CONTINUE): namelen = self._context.object(self._qemu_table_name + constants.BANG + 'unsigned char', offset = index, layer_name = self._base_layer) self._current_segment_name = base_layer.read(index + 1, namelen) index += 1 + namelen if flags & self.SEGMENT_FLAG_COMPRESS: if self._current_segment_name == b'pc.ram': segments.append((addr, index, page_size, 1)) self._compressed.add(addr) index += 1 else: if self._current_segment_name == b'pc.ram': segments.append((addr, index, page_size, page_size)) index += page_size if flags & self.SEGMENT_FLAG_XBZRLE: raise exceptions.LayerException(self.name, "XBZRLE compression not supported") if flags & self.SEGMENT_FLAG_EOS: done = True return segments, index def _load_segments(self): base_layer = self.context.layers[self._base_layer] self._check_header(base_layer, self.name) if not self._configuration: self._configuration = self._read_configuration(base_layer, self.name) section_byte = -1 index = 8 current_section_id = -1 version_id = -1 name = None while section_byte != self.QEVM_EOF and index <= base_layer.maximum_address: section_byte = self.context.object(self._qemu_table_name + constants.BANG + 'unsigned char', offset = index, layer_name = self._base_layer) index += 1 if section_byte == self.QEVM_CONFIGURATION: section_len = self.context.object(self._qemu_table_name + constants.BANG + 'unsigned long', offset = index, layer_name = self._base_layer) index += 4 + section_len elif section_byte == self.QEVM_SECTION_START or section_byte == self.QEVM_SECTION_FULL: section_id = self.context.object(self._qemu_table_name + constants.BANG + 'unsigned long', offset = index, layer_name = self._base_layer) current_section_id = section_id index += 4 name_len = self.context.object(self._qemu_table_name + constants.BANG + 'unsigned char', offset = index, layer_name = self._base_layer) index += 1 name = self.context.object(self._qemu_table_name + constants.BANG + 'string', offset = index, layer_name = self._base_layer, max_length = name_len) index += name_len # instance_id = self.context.object(self._qemu_table_name + constants.BANG + 'unsigned long', # offset = index, # layer_name = self._base_layer) index += 4 version_id = self.context.object(self._qemu_table_name + constants.BANG + 'unsigned long', offset = index, layer_name = self._base_layer) index += 4 # Read additional data index = self.extract_data(index, name, version_id) elif section_byte == self.QEVM_SECTION_PART or section_byte == self.QEVM_SECTION_END: section_id = self.context.object(self._qemu_table_name + constants.BANG + 'unsigned long', offset = index, layer_name = self._base_layer) current_section_id = section_id index += 4 # Read additional data index = self.extract_data(index, name, version_id) elif section_byte == self.QEVM_SECTION_FOOTER: section_id = self.context.object(self._qemu_table_name + constants.BANG + 'unsigned long', offset = index, layer_name = self._base_layer) index += 4 if section_id != current_section_id: raise exceptions.LayerException( self._name, 'QEMU section footer mismatch: {} and {}'.format(current_section_id, section_id)) elif section_byte == self.QEVM_EOF: pass else: raise exceptions.LayerException(self._name, 'QEMU unknown section encountered: {}'.format(section_byte)) def extract_data(self, index, name, version_id): if name == 'ram': if version_id != 4: raise exceptions.LayerException("QEMU unknown RAM version_id {}".format(version_id)) new_segments, index = self._get_ram_segments(index, self._configuration.get('page_size', None) or 4096) self._segments += new_segments elif name == 'spapr/htab': if version_id != 1: raise exceptions.LayerException("QEMU unknown HTAB version_id {}".format(version_id)) header = self.context.object(self._qemu_table_name + constants.BANG + 'unsigned long', offset = index, layer_name = self._base_layer) index += 4 if header == 0: htab_index = -1 htab_n_valid = 0 htab_n_invalid = 0 while htab_index != 0 and htab_n_valid != 0 and htab_n_invalid != 0: htab = self.context.object(self._qemu_table_name + constants.BANG + 'htab', offset = index, layer_name = self._base_layer) htab_index, htab_n_valid, htab_n_invalid = htab index += 8 + (htab_n_valid * self.HASH_PTE_SIZE_64) return index def _decode_data(self, data: bytes, mapped_offset: int, offset: int, output_length: int) -> bytes: if mapped_offset in self._compressed: return (data * 0x1000)[:output_length] return data @functools.lru_cache(maxsize = 512) def read(self, offset: int, length: int, pad: bool = False) -> bytes: return super().read(offset, length, pad) class QemuStacker(interfaces.automagic.StackerLayerInterface): stack_order = 10 @classmethod def stack(cls, context: interfaces.context.ContextInterface, layer_name: str, progress_callback: constants.ProgressCallback = None) -> Optional[interfaces.layers.DataLayerInterface]: try: QemuSuspendLayer._check_header(context.layers[layer_name]) except exceptions.LayerException: return None new_name = context.layers.free_layer_name("QemuSuspendLayer") context.config[interfaces.configuration.path_join(new_name, "base_layer")] = layer_name layer = QemuSuspendLayer(context, new_name, new_name) cls.stacker_slow_warning() return layer volatility3-1.0.1/volatility3/framework/layers/registry.py000066400000000000000000000267521405267600400240150ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import Any, Callable, Dict, Iterable, List, Optional, Tuple, Union from volatility3.framework import constants, exceptions, interfaces, objects from volatility3.framework.configuration import requirements from volatility3.framework.configuration.requirements import IntRequirement, TranslationLayerRequirement from volatility3.framework.exceptions import InvalidAddressException from volatility3.framework.layers import linear from volatility3.framework.symbols import intermed from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) class RegistryFormatException(exceptions.LayerException): """Thrown when an error occurs with the underlying Registry file format.""" class RegistryInvalidIndex(exceptions.LayerException): """Thrown when an index that doesn't exist or can't be found occurs.""" class RegistryHive(linear.LinearlyMappedLayer): def __init__(self, context: interfaces.context.ContextInterface, config_path: str, name: str, metadata: Optional[Dict[str, Any]] = None) -> None: super().__init__(context = context, config_path = config_path, name = name, metadata = metadata) self._base_layer = self.config["base_layer"] self._hive_offset = self.config["hive_offset"] self._table_name = self.config["nt_symbols"] self._page_size = 1 << 12 self._reg_table_name = intermed.IntermediateSymbolTable.create(context, self._config_path, 'windows', 'registry') cmhive = self.context.object(self._table_name + constants.BANG + "_CMHIVE", self._base_layer, self._hive_offset) self._cmhive_name = cmhive.get_name() self.hive = cmhive.Hive # TODO: Check the checksum if self.hive.Signature != 0xbee0bee0: raise RegistryFormatException( self.name, "Registry hive at {} does not have a valid signature".format(self._hive_offset)) # Win10 17063 introduced the Registry process to map most hives. Check # if it exists and update RegistryHive._base_layer for proc in pslist.PsList.list_processes(self.context, self.config['base_layer'], self.config['nt_symbols']): proc_name = proc.ImageFileName.cast("string", max_length = proc.ImageFileName.vol.count, errors = 'replace') if proc_name == "Registry" and proc.InheritedFromUniqueProcessId == 4: proc_layer_name = proc.add_process_layer() self._base_layer = proc_layer_name break self._base_block = self.hive.BaseBlock.dereference() self._minaddr = 0 try: self._hive_maxaddr_non_volatile = self.hive.Storage[0].Length self._hive_maxaddr_volatile = self.hive.Storage[1].Length self._maxaddr = 0x80000000 | self._hive_maxaddr_volatile vollog.log(constants.LOGLEVEL_VVV, "Setting hive max address to {}".format(hex(self._maxaddr))) except exceptions.InvalidAddressException: self._hive_maxaddr_non_volatile = 0x7fffffff self._hive_maxaddr_volatile = 0x7fffffff self._maxaddr = 0x80000000 | self._hive_maxaddr_volatile vollog.log(constants.LOGLEVEL_VVV, "Exception when setting hive max address, using {}".format(hex(self._maxaddr))) def _get_hive_maxaddr(self, volatile): return self._hive_maxaddr_volatile if volatile else self._hive_maxaddr_non_volatile def get_name(self) -> str: return self._cmhive_name or "[NONAME]" @property def hive_offset(self) -> int: return self._hive_offset @property def address_mask(self) -> int: """Return a mask that allows for the volatile bit to be set.""" return super().address_mask | 0x80000000 @property def root_cell_offset(self) -> int: """Returns the offset for the root cell in this hive.""" try: if self._base_block.Signature.cast("string", max_length = 4, encoding = "latin-1") == 'regf': return self._base_block.RootCell except InvalidAddressException: pass return 0x20 def get_cell(self, cell_offset: int) -> 'objects.StructType': """Returns the appropriate Cell value for a cell offset.""" # This would be an _HCELL containing CELL_DATA, but to save time we skip the size of the HCELL cell = self._context.object(object_type = self._table_name + constants.BANG + "_CELL_DATA", offset = cell_offset + 4, layer_name = self.name) return cell def get_node(self, cell_offset: int) -> 'objects.StructType': """Returns the appropriate Node, interpreted from the Cell based on its Signature.""" cell = self.get_cell(cell_offset) signature = cell.cast('string', max_length = 2, encoding = 'latin-1') if signature == 'nk': return cell.u.KeyNode elif signature == 'sk': return cell.u.KeySecurity elif signature == 'vk': return cell.u.KeyValue elif signature == 'db': # Big Data return cell.u.ValueData elif signature == 'lf' or signature == 'lh' or signature == 'ri': # Fast Leaf, Hash Leaf, Index Root return cell.u.KeyIndex else: # It doesn't matter that we use KeyNode, we're just after the first two bytes vollog.debug("Unknown Signature {} (0x{:x}) at offset {}".format(signature, cell.u.KeyNode.Signature, cell_offset)) return cell def get_key(self, key: str, return_list: bool = False) -> Union[List[objects.StructType], objects.StructType]: """Gets a specific registry key by key path. return_list specifies whether the return result will be a single node (default) or a list of nodes from root to the current node (if return_list is true). """ node_key = [self.get_node(self.root_cell_offset)] if key.endswith("\\"): key = key[:-1] key_array = key.split('\\') found_key = [] # type: List[str] while key_array and node_key: subkeys = node_key[-1].get_subkeys() for subkey in subkeys: # registry keys are not case sensitive so compare lowercase # https://msdn.microsoft.com/en-us/library/windows/desktop/ms724946(v=vs.85).aspx if subkey.get_name().lower() == key_array[0].lower(): node_key = node_key + [subkey] found_key, key_array = found_key + [key_array[0]], key_array[1:] break else: node_key = [] if not node_key: raise KeyError("Key {} not found under {}".format(key_array[0], '\\'.join(found_key))) if return_list: return node_key return node_key[-1] def visit_nodes(self, visitor: Callable[[objects.StructType], None], node: Optional[objects.StructType] = None) -> None: """Applies a callable (visitor) to all nodes within the registry tree from a given node.""" if not node: node = self.get_node(self.root_cell_offset) visitor(node) for node in node.get_subkeys(): self.visit_nodes(visitor, node) @staticmethod def _mask(value: int, high_bit: int, low_bit: int) -> int: """Returns the bits of a value between highbit and lowbit inclusive.""" high_mask = (2 ** (high_bit + 1)) - 1 low_mask = (2 ** low_bit) - 1 mask = (high_mask ^ low_mask) # print(high_bit, low_bit, bin(mask), bin(value)) return value & mask @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ IntRequirement(name = 'hive_offset', description = 'Offset within the base layer at which the hive lives', default = 0, optional = False), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), TranslationLayerRequirement(name = 'base_layer', description = 'Layer in which the registry hive lives', optional = False) ] def _translate(self, offset: int) -> int: """Translates a single cell index to a cell memory offset and the suboffset within it.""" # Ignore the volatile bit when determining maxaddr validity volatile = self._mask(offset, 31, 31) >> 31 if offset & 0x7fffffff > self._get_hive_maxaddr(volatile): raise RegistryInvalidIndex(self.name, "Mapping request for value greater than maxaddr") storage = self.hive.Storage[volatile] dir_index = self._mask(offset, 30, 21) >> 21 table_index = self._mask(offset, 20, 12) >> 12 suboffset = self._mask(offset, 11, 0) >> 0 table = storage.Map.Directory[dir_index] entry = table.Table[table_index] return entry.get_block_offset() + suboffset def mapping(self, offset: int, length: int, ignore_errors: bool = False) -> Iterable[Tuple[int, int, int, int, str]]: if length < 0: raise ValueError("Mapping length of RegistryHive must be positive or zero") # Return the translated offset without checking bounds within the HBIN. The check runs into # issues when pages are swapped on large HBINs, and did not seem to find any errors on single page # HBINs while dramatically slowing performance. response = [] current_offset = offset remaining_length = length chunk_size = self._page_size - (offset & (self._page_size - 1)) while remaining_length > 0: chunk_size = min(chunk_size, remaining_length, self._page_size) try: translated_offset = self._translate(current_offset) response.append((current_offset, chunk_size, translated_offset, chunk_size, self._base_layer)) except exceptions.LayerException: if not ignore_errors: raise current_offset += chunk_size remaining_length -= chunk_size chunk_size = self._page_size return response @property def dependencies(self) -> List[str]: """Returns a list of layer names that this layer translates onto.""" return [self.config['base_layer']] def is_valid(self, offset: int, length: int = 1) -> bool: """Returns a boolean based on whether the offset is valid or not.""" try: # Pass this to the lower layers for now return all([ self.context.layers[layer].is_valid(offset, length) for (_, _, offset, length, layer) in self.mapping(offset, length) ]) except exceptions.InvalidAddressException: return False @property def minimum_address(self) -> int: return self._minaddr @property def maximum_address(self) -> int: return self._maxaddr volatility3-1.0.1/volatility3/framework/layers/resources.py000066400000000000000000000224411405267600400241460ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import bz2 import contextlib import gzip import hashlib import logging import lzma import os import ssl import urllib.parse import urllib.request import zipfile from typing import Optional, Any, IO from urllib import error from volatility3 import framework from volatility3.framework import constants try: import magic HAS_MAGIC = True except ImportError: HAS_MAGIC = False try: # Import so that the handler is found by the framework.class_subclasses callc import smb.SMBHandler # lgtm [py/unused-import] except ImportError: pass vollog = logging.getLogger(__name__) # TODO: Type-annotating the ResourceAccessor.open method is difficult because HTTPResponse is not actually an IO[Any] type # fix this def cascadeCloseFile(new_fp: IO[bytes], original_fp: IO[bytes]) -> IO[bytes]: """Really horrible solution for ensuring files aren't left open Args: new_fp: The file pointer constructed based on the original file pointer original_fp: The original file pointer that should be closed when the new file pointer is closed, but isn't """ def close(): original_fp.close() return new_fp.__class__.close(new_fp) new_fp.close = close return new_fp class ResourceAccessor(object): """Object for openning URLs as files (downloading locally first if necessary)""" list_handlers = True def __init__(self, progress_callback: Optional[constants.ProgressCallback] = None, context: Optional[ssl.SSLContext] = None) -> None: """Creates a resource accessor. Note: context is an SSL context, not a volatility context """ self._progress_callback = progress_callback self._context = context self._handlers = list(framework.class_subclasses(urllib.request.BaseHandler)) if self.list_handlers: vollog.log(constants.LOGLEVEL_VVV, "Available URL handlers: {}".format(", ".join([x.__name__ for x in self._handlers]))) self.__class__.list_handlers = False def uses_cache(self, url: str) -> bool: """Determines whether a URLs contents should be cached""" parsed_url = urllib.parse.urlparse(url) return not parsed_url.scheme in ['file', 'jar'] # Current urllib.request.urlopen returns Any, so we do the same def open(self, url: str, mode: str = "rb") -> Any: """Returns a file-like object for a particular URL opened in mode. If the file is remote, it will be downloaded and locally cached """ urllib.request.install_opener(urllib.request.build_opener(*self._handlers)) try: fp = urllib.request.urlopen(url, context = self._context) except error.URLError as excp: if excp.args: # TODO: As of python3.7 this can be removed unverified_retrieval = (hasattr(ssl, "SSLCertVerificationError") and isinstance( excp.args[0], ssl.SSLCertVerificationError)) or (isinstance(excp.args[0], ssl.SSLError) and excp.args[0].reason == "CERTIFICATE_VERIFY_FAILED") if unverified_retrieval: vollog.warning("SSL certificate verification failed: attempting UNVERIFIED retrieval") non_verifying_ctx = ssl.SSLContext() non_verifying_ctx.check_hostname = False non_verifying_ctx.verify_mode = ssl.CERT_NONE fp = urllib.request.urlopen(url, context = non_verifying_ctx) else: raise excp else: raise excp with contextlib.closing(fp) as fp: # Cache the file locally if not self.uses_cache(url): # ZipExtFiles (files in zips) cannot seek, so must be cached in order to use and/or decompress curfile = urllib.request.urlopen(url, context = self._context) else: # TODO: find a way to check if we already have this file (look at http headers?) block_size = 1028 * 8 temp_filename = os.path.join( constants.CACHE_PATH, "data_" + hashlib.sha512(bytes(url, 'raw_unicode_escape')).hexdigest() + ".cache") if not os.path.exists(temp_filename): vollog.debug("Caching file at: {}".format(temp_filename)) try: content_length = fp.info().get('Content-Length', -1) except AttributeError: # If our fp doesn't have an info member, carry on gracefully content_length = -1 cache_file = open(temp_filename, "wb") count = 0 block = fp.read(block_size) while block: count += len(block) if self._progress_callback: self._progress_callback(count * 100 / max(count, int(content_length)), "Reading file {}".format(url)) cache_file.write(block) block = fp.read(block_size) cache_file.close() # Re-open the cache with a different mode curfile = open(temp_filename, mode = "rb") # Determine whether the file is a particular type of file, and if so, open it as such IMPORTED_MAGIC = False if HAS_MAGIC: stop = False while not stop: detected = None try: # Detect the content detected = magic.detect_from_fobj(curfile) IMPORTED_MAGIC = True # This is because python-magic and file provide a magic module # Only file's python has magic.detect_from_fobj except (AttributeError, IOError): pass if detected: if detected.mime_type == 'application/x-xz': curfile = cascadeCloseFile(lzma.LZMAFile(curfile, mode), curfile) elif detected.mime_type == 'application/x-bzip2': curfile = cascadeCloseFile(bz2.BZ2File(curfile, mode), curfile) elif detected.mime_type == 'application/x-gzip': curfile = cascadeCloseFile(gzip.GzipFile(fileobj = curfile, mode = mode), curfile) if detected.mime_type in ['application/x-xz', 'application/x-bzip2', 'application/x-gzip']: # Read and rewind to ensure we're inside any compressed file layers curfile.read(1) curfile.seek(0) else: stop = True else: stop = True if not IMPORTED_MAGIC: # Somewhat of a hack, but prevents a hard dependency on the magic module parsed_url = urllib.parse.urlparse(url) url_path = parsed_url.path stop = False while not stop: url_path_split = url_path.split(".") url_path_list, extension = url_path_split[:-1], url_path_split[-1] url_path = ".".join(url_path_list) if extension == "xz": curfile = cascadeCloseFile(lzma.LZMAFile(curfile, mode), curfile) elif extension == "bz2": curfile = cascadeCloseFile(bz2.BZ2File(curfile, mode), curfile) elif extension == "gz": curfile = cascadeCloseFile(gzip.GzipFile(fileobj = curfile, mode = mode), curfile) else: stop = True # Fallback in case the file doesn't exist if curfile is None: raise ValueError("URL does not reference an openable file") return curfile class JarHandler(urllib.request.BaseHandler): """Handles the jar scheme for URIs. Reference used for the schema syntax: http://docs.netkernel.org/book/view/book:mod:reference/doc:layer1:schemes:jar Actual reference (found from https://www.w3.org/wiki/UriSchemes/jar) seemed not to return: http://developer.java.sun.com/developer/onlineTraining/protocolhandlers/ """ @staticmethod def default_open(req: urllib.request.Request) -> Optional[Any]: """Handles the request if it's the jar scheme.""" if req.type == 'jar': subscheme, remainder = req.full_url.split(":")[1], ":".join(req.full_url.split(":")[2:]) if subscheme != 'file': vollog.log(constants.LOGLEVEL_VVV, "Unsupported jar subscheme {}".format(subscheme)) return None zipsplit = remainder.split("!") if len(zipsplit) != 2: vollog.log(constants.LOGLEVEL_VVV, "Path did not contain exactly one fragment indicator: {}".format(remainder)) return None zippath, filepath = zipsplit return zipfile.ZipFile(zippath).open(filepath) return None volatility3-1.0.1/volatility3/framework/layers/scanners/000077500000000000000000000000001405267600400233735ustar00rootroot00000000000000volatility3-1.0.1/volatility3/framework/layers/scanners/__init__.py000066400000000000000000000042321405267600400255050ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import re from typing import Generator, List, Tuple from volatility3.framework.interfaces import layers from volatility3.framework.layers.scanners import multiregexp class BytesScanner(layers.ScannerInterface): thread_safe = True def __init__(self, needle: bytes) -> None: super().__init__() self.needle = needle def __call__(self, data: bytes, data_offset: int) -> Generator[int, None, None]: """Runs through the data looking for the needle, and yields all offsets where the needle is found.""" find_pos = data.find(self.needle) while find_pos >= 0: if find_pos < self.chunk_size: yield find_pos + data_offset find_pos = data.find(self.needle, find_pos + 1) class RegExScanner(layers.ScannerInterface): thread_safe = True def __init__(self, pattern: bytes, flags: int = 0) -> None: super().__init__() self.regex = re.compile(pattern, flags) def __call__(self, data: bytes, data_offset: int) -> Generator[int, None, None]: """Runs through the data looking for the needle, and yields all offsets where the needle is found.""" find_pos = self.regex.finditer(data) for match in find_pos: offset = match.start() if offset < self.chunk_size: yield offset + data_offset class MultiStringScanner(layers.ScannerInterface): thread_safe = True def __init__(self, patterns: List[bytes]) -> None: super().__init__() self._patterns = multiregexp.MultiRegexp() for pattern in patterns: self._patterns.add_pattern(pattern) self._patterns.preprocess() def __call__(self, data: bytes, data_offset: int) -> Generator[Tuple[int, bytes], None, None]: """Runs through the data looking for the needles.""" for offset, pattern in self._patterns.search(data): if offset < self.chunk_size: yield offset + data_offset, pattern volatility3-1.0.1/volatility3/framework/layers/scanners/multiregexp.py000066400000000000000000000022741405267600400263170ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import re from typing import Generator, List, Tuple class MultiRegexp(object): """Algorithm for multi-string matching.""" def __init__(self) -> None: self._pattern_strings = [] # type: List[bytes] self._regex = re.compile(b'') def add_pattern(self, pattern: bytes) -> None: self._pattern_strings.append(pattern) def preprocess(self) -> None: if not self._pattern_strings: raise ValueError("No strings to compile into a regular expression") self._regex = re.compile(b'|'.join(map(re.escape, self._pattern_strings))) def search(self, haystack: bytes) -> Generator[Tuple[int, bytes], None, None]: if not isinstance(haystack, bytes): raise TypeError("Search haystack must be a byte string") if not self._regex.pattern: raise ValueError("MultiRegexp cannot be used with an empty set of search strings") for match in re.finditer(self._regex, haystack): yield (match.start(0), match.group()) volatility3-1.0.1/volatility3/framework/layers/segmented.py000066400000000000000000000140331405267600400241050ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from abc import ABCMeta, abstractmethod from bisect import bisect_right from typing import Any, Dict, Iterable, List, Optional, Tuple from volatility3.framework import exceptions, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.layers import linear class NonLinearlySegmentedLayer(interfaces.layers.TranslationLayerInterface, metaclass = ABCMeta): """A class to handle a single run-based layer-to-layer mapping. In the documentation "mapped address" or "mapped offset" refers to an offset once it has been mapped to the underlying layer """ def __init__(self, context: interfaces.context.ContextInterface, config_path: str, name: str, metadata: Optional[Dict[str, Any]] = None) -> None: super().__init__(context = context, config_path = config_path, name = name, metadata = metadata) self._base_layer = self.config["base_layer"] self._segments = [] # type: List[Tuple[int, int, int, int]] self._minaddr = None # type: Optional[int] self._maxaddr = None # type: Optional[int] self._load_segments() @abstractmethod def _load_segments(self) -> None: """Populates the _segments variable. Segments must be (address, mapped address, length) and must be sorted by address when this method exits """ def is_valid(self, offset: int, length: int = 1) -> bool: """Returns whether the address offset can be translated to a valid address.""" try: base_layer = self._context.layers[self._base_layer] return all( [base_layer.is_valid(mapped_offset) for _i, _i, mapped_offset, _i, _s in self.mapping(offset, length)]) except exceptions.InvalidAddressException: return False def _find_segment(self, offset: int, next: bool = False) -> Tuple[int, int, int, int]: """Finds the segment containing a given offset. Returns the segment tuple (offset, mapped_offset, length, mapped_length) """ if not self._segments: self._load_segments() # Find rightmost value less than or equal to x i = bisect_right(self._segments, (offset, self.context.layers[self._base_layer].maximum_address)) if i and not next: segment = self._segments[i - 1] if segment[0] <= offset < segment[0] + segment[2]: return segment if next: if i < len(self._segments): return self._segments[i] raise exceptions.InvalidAddressException(self.name, offset, "Invalid address at {:0x}".format(offset)) def mapping(self, offset: int, length: int, ignore_errors: bool = False) -> Iterable[Tuple[int, int, int, int, str]]: """Returns a sorted iterable of (offset, length, mapped_offset, mapped_length, layer) mappings.""" done = False current_offset = offset while not done: try: # Search for the appropriate segment that contains the current_offset logical_offset, mapped_offset, size, mapped_size = self._find_segment(current_offset) # If it starts before the current_offset, bring the lower edge up to the right place if current_offset > logical_offset: difference = current_offset - logical_offset logical_offset += difference mapped_offset += difference size -= difference except exceptions.InvalidAddressException: if not ignore_errors: # If we're not ignoring errors, raise the invalid address exception raise try: # Find the next valid segment after our current_offset logical_offset, mapped_offset, size, mapped_size = self._find_segment(current_offset, next = True) # We know that the logical_offset must be greater than current_offset so skip to that value current_offset = logical_offset # If it starts too late then we're done if logical_offset > offset + length: return except exceptions.InvalidAddressException: return # Crop it to the amount we need left chunk_size = min(size, length + offset - logical_offset) yield logical_offset, chunk_size, mapped_offset, chunk_size, self._base_layer current_offset += chunk_size # Terminate if we've gone (or reached) our required limit if current_offset >= offset + length: done = True @property def minimum_address(self) -> int: if not self._segments: raise ValueError("SegmentedLayer must contain some segments") if self._minaddr is None: mapped, _, _, _ = self._segments[0] self._minaddr = mapped return self._minaddr @property def maximum_address(self) -> int: if not self._segments: raise ValueError("SegmentedLayer must contain some segments") if self._maxaddr is None: mapped, _, length, _ = self._segments[-1] self._maxaddr = mapped + length return self._maxaddr @property def dependencies(self) -> List[str]: """Returns a list of the lower layers that this layer is dependent upon.""" return [self._base_layer] @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [requirements.TranslationLayerRequirement(name = 'base_layer', optional = False)] class SegmentedLayer(NonLinearlySegmentedLayer, linear.LinearlyMappedLayer, metaclass = ABCMeta): pass volatility3-1.0.1/volatility3/framework/layers/vmware.py000066400000000000000000000167471405267600400234510ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import struct from typing import Any, Dict, List, Optional from volatility3.framework import interfaces, constants, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.layers import physical, segmented, resources from volatility3.framework.symbols import native class VmwareFormatException(exceptions.LayerException): """Thrown when an error occurs with the underlying VMware vmem file format.""" class VmwareLayer(segmented.SegmentedLayer): header_structure = "<4sII" group_structure = "64sQQ" def __init__(self, context: interfaces.context.ContextInterface, config_path: str, name: str, metadata: Optional[Dict[str, Any]] = None) -> None: # Construct these so we can use self.config self._context = context self._config_path = config_path self._page_size = 0x1000 self._base_layer, self._meta_layer = self.config["base_layer"], self.config["meta_layer"] # Then call the super, which will call load_segments (which needs the base_layer before it'll work) super().__init__(context, config_path = config_path, name = name, metadata = metadata) def _load_segments(self) -> None: """Loads up the segments from the meta_layer.""" self._read_header() def _read_header(self) -> None: """Checks the vmware header to make sure it's valid.""" if "vmware" not in self._context.symbol_space: self._context.symbol_space.append(native.NativeTable("vmware", native.std_ctypes)) meta_layer = self.context.layers.get(self._meta_layer, None) header_size = struct.calcsize(self.header_structure) data = meta_layer.read(0, header_size) magic, unknown, groupCount = struct.unpack(self.header_structure, data) if magic not in [b"\xD2\xBE\xD2\xBE"]: raise VmwareFormatException(self.name, "Wrong magic bytes for Vmware layer: {}".format(repr(magic))) # TODO: Change certain structure sizes based on the version # version = magic[1] & 0xf group_size = struct.calcsize(self.group_structure) groups = {} for group in range(groupCount): name, tag_location, _unknown = struct.unpack( self.group_structure, meta_layer.read(header_size + (group * group_size), group_size)) name = name.rstrip(b"\x00") groups[name] = tag_location memory = groups[b"memory"] tags_read = False offset = memory tags = {} index_len = self._context.symbol_space.get_type("vmware!unsigned int").size while not tags_read: flags = ord(meta_layer.read(offset, 1)) name_len = ord(meta_layer.read(offset + 1, 1)) tags_read = (flags == 0) and (name_len == 0) if not tags_read: name = self._context.object("vmware!string", layer_name = self._meta_layer, offset = offset + 2, max_length = name_len) indicies_len = (flags >> 6) & 3 indicies = [] for index in range(indicies_len): indicies.append( self._context.object("vmware!unsigned int", offset = offset + name_len + 2 + (index * index_len), layer_name = self._meta_layer)) data = self._context.object("vmware!unsigned int", layer_name = self._meta_layer, offset = offset + 2 + name_len + (indicies_len * index_len)) tags[(name, tuple(indicies))] = (flags, data) offset += 2 + name_len + (indicies_len * index_len) + self._context.symbol_space.get_type("vmware!unsigned int").size if tags[("regionsCount", ())][1] == 0: raise VmwareFormatException(self.name, "VMware VMEM is not split into regions") for region in range(tags[("regionsCount", ())][1]): offset = tags[("regionPPN", (region, ))][1] * self._page_size mapped_offset = tags[("regionPageNum", (region, ))][1] * self._page_size length = tags[("regionSize", (region, ))][1] * self._page_size self._segments.append((offset, mapped_offset, length, length)) @property def dependencies(self) -> List[str]: return [self._base_layer, self._meta_layer] @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: """This vmware translation layer always requires a separate metadata layer.""" return [ requirements.TranslationLayerRequirement(name = 'base_layer', optional = False), requirements.TranslationLayerRequirement(name = 'meta_layer', optional = False) ] class VmwareStacker(interfaces.automagic.StackerLayerInterface): stack_order = 20 @classmethod def stack(cls, context: interfaces.context.ContextInterface, layer_name: str, progress_callback: constants.ProgressCallback = None) -> Optional[interfaces.layers.DataLayerInterface]: """Attempt to stack this based on the starting information.""" memlayer = context.layers[layer_name] if not isinstance(memlayer, physical.FileLayer): return None location = memlayer.location if location.endswith(".vmem"): vmss = location[:-5] + ".vmss" vmsn = location[:-5] + ".vmsn" current_layer_name = context.layers.free_layer_name("VmwareMetaLayer") current_config_path = interfaces.configuration.path_join("automagic", "layer_stacker", "stack", current_layer_name) try: _ = resources.ResourceAccessor().open(vmss).read(10) context.config[interfaces.configuration.path_join(current_config_path, "location")] = vmss context.layers.add_layer(physical.FileLayer(context, current_config_path, current_layer_name)) vmss_success = True except IOError: vmss_success = False if not vmss_success: try: _ = resources.ResourceAccessor().open(vmsn).read(10) context.config[interfaces.configuration.path_join(current_config_path, "location")] = vmsn context.layers.add_layer(physical.FileLayer(context, current_config_path, current_layer_name)) vmsn_success = True except IOError: vmsn_success = False if not vmss_success and not vmsn_success: return None new_layer_name = context.layers.free_layer_name("VmwareLayer") context.config[interfaces.configuration.path_join(current_config_path, "base_layer")] = layer_name context.config[interfaces.configuration.path_join(current_config_path, "meta_layer")] = current_layer_name new_layer = VmwareLayer(context, current_config_path, new_layer_name) return new_layer return None volatility3-1.0.1/volatility3/framework/objects/000077500000000000000000000000001405267600400217115ustar00rootroot00000000000000volatility3-1.0.1/volatility3/framework/objects/__init__.py000066400000000000000000001042201405267600400240210ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import collections import logging import struct from typing import Any, ClassVar, Dict, List, Iterable, Optional, Tuple, Type, Union as TUnion, overload from volatility3.framework import interfaces, constants from volatility3.framework.objects import templates, utility vollog = logging.getLogger(__name__) DataFormatInfo = collections.namedtuple('DataFormatInfo', ['length', 'byteorder', 'signed']) def convert_data_to_value(data: bytes, struct_type: Type[TUnion[int, float, bytes, str, bool]], data_format: DataFormatInfo) -> TUnion[int, float, bytes, str, bool]: """Converts a series of bytes to a particular type of value.""" if struct_type == int: return int.from_bytes(data, byteorder = data_format.byteorder, signed = data_format.signed) if struct_type == bool: struct_format = "?" elif struct_type == float: float_vals = "zzezfzzzd" if data_format.length > len(float_vals) or float_vals[data_format.length] not in "efd": raise ValueError("Invalid float size") struct_format = ("<" if data_format.byteorder == 'little' else ">") + float_vals[data_format.length] elif struct_type in [bytes, str]: struct_format = str(data_format.length) + "s" else: raise TypeError("Cannot construct struct format for type {}".format(type(struct_type))) return struct.unpack(struct_format, data)[0] def convert_value_to_data(value: TUnion[int, float, bytes, str, bool], struct_type: Type[TUnion[int, float, bytes, str, bool]], data_format: DataFormatInfo) -> bytes: """Converts a particular value to a series of bytes.""" if not isinstance(value, struct_type): raise TypeError("Written value is not of the correct type for {}".format(struct_type.__class__.__name__)) if struct_type == int and isinstance(value, int): # Doubling up on the isinstance is for mypy return int.to_bytes(value, length = data_format.length, byteorder = data_format.byteorder, signed = data_format.signed) if struct_type == bool: struct_format = "?" elif struct_type == float: float_vals = "zzezfzzzd" if data_format.length > len(float_vals) or float_vals[data_format.length] not in "efd": raise ValueError("Invalid float size") struct_format = ("<" if data_format.byteorder == 'little' else ">") + float_vals[data_format.length] elif struct_type in [bytes, str]: struct_format = str(data_format.length) + "s" else: raise TypeError("Cannot construct struct format for type {}".format(type(struct_type))) return struct.pack(struct_format, value) class Void(interfaces.objects.ObjectInterface): """Returns an object to represent void/unknown types.""" class VolTemplateProxy(interfaces.objects.ObjectInterface.VolTemplateProxy): @classmethod def size(cls, template: interfaces.objects.Template) -> int: """Dummy size for Void objects. According to http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1570.pdf, void is an incomplete type, and therefore sizeof(void) should fail. However, we need to be able to construct voids to be able to cast them, so we return a useless size. It shouldn't cause errors, but it also shouldn't be common, it is logged at the lowest level. """ vollog.log(constants.LOGLEVEL_VVVV, "Void size requested") return 0 def write(self, value: Any) -> None: """Dummy method that does nothing for Void objects.""" raise TypeError("Cannot write data to a void, recast as another object") class Function(interfaces.objects.ObjectInterface): """""" class PrimitiveObject(interfaces.objects.ObjectInterface): """PrimitiveObject is an interface for any objects that should simulate a Python primitive.""" _struct_type = int # type: ClassVar[Type] def __init__(self, context: interfaces.context.ContextInterface, type_name: str, object_info: interfaces.objects.ObjectInformation, data_format: DataFormatInfo) -> None: super().__init__(context = context, type_name = type_name, object_info = object_info, data_format = data_format) self._data_format = data_format def __new__(cls: Type, context: interfaces.context.ContextInterface, type_name: str, object_info: interfaces.objects.ObjectInformation, data_format: DataFormatInfo, new_value: TUnion[int, float, bool, bytes, str] = None, **kwargs) -> 'PrimitiveObject': """Creates the appropriate class and returns it so that the native type is inherited. The only reason the kwargs is added, is so that the inherriting types can override __init__ without needing to override __new__ We also sneak in new_value, so that we don't have to do expensive (read: impossible) context reads when unpickling. """ if new_value is None: value = cls._unmarshall(context, data_format, object_info) else: value = new_value result = cls._struct_type.__new__(cls, value) # This prevents us having to go read a context layer when recreating after unpickling # Mypy complains that result doesn't have a __new_value, but using setattr causes pycharm to complain further down result.__new_value = value # type: ignore return result def __getnewargs_ex__(self): """Make sure that when pickling, all appropiate parameters for new are provided.""" kwargs = {} for k, v in self._vol.maps[-1].items(): if k not in ["context", "data_format", "object_info", "type_name"]: kwargs[k] = v kwargs['new_value'] = self.__new_value return (self._context, self._vol.maps[-2]['type_name'], self._vol.maps[-3], self._data_format), kwargs @classmethod def _unmarshall(cls, context: interfaces.context.ContextInterface, data_format: DataFormatInfo, object_info: interfaces.objects.ObjectInformation) -> TUnion[int, float, bool, bytes, str]: data = context.layers.read(object_info.layer_name, object_info.offset, data_format.length) return convert_data_to_value(data, cls._struct_type, data_format) class VolTemplateProxy(interfaces.objects.ObjectInterface.VolTemplateProxy): @classmethod def size(cls, template: interfaces.objects.Template) -> int: """Returns the size of the templated object.""" return template.vol.data_format.length def write(self, value: TUnion[int, float, bool, bytes, str]) -> None: """Writes the object into the layer of the context at the current offset.""" data = convert_value_to_data(value, self._struct_type, self._data_format) return self._context.layers.write(self.vol.layer_name, self.vol.offset, data) # This must be int (and the _struct_type must be int) because bool cannot be inherited from: # https://mail.python.org/pipermail/python-dev/2002-March/020822.html # https://mail.python.org/pipermail/python-dev/2004-February/042537.html class Boolean(PrimitiveObject, int): """Primitive Object that handles boolean types.""" _struct_type = int # type: ClassVar[Type] class Integer(PrimitiveObject, int): """Primitive Object that handles standard numeric types.""" class Float(PrimitiveObject, float): """Primitive Object that handles double or floating point numbers.""" _struct_type = float # type: ClassVar[Type] class Char(PrimitiveObject, int): """Primitive Object that handles characters.""" _struct_type = int # type: ClassVar[Type] class Bytes(PrimitiveObject, bytes): """Primitive Object that handles specific series of bytes.""" _struct_type = bytes # type: ClassVar[Type] def __init__(self, context: interfaces.context.ContextInterface, type_name: str, object_info: interfaces.objects.ObjectInformation, length: int = 1) -> None: super().__init__(context = context, type_name = type_name, object_info = object_info, data_format = DataFormatInfo(length, "big", False)) self._vol['length'] = length def __new__(cls: Type, context: interfaces.context.ContextInterface, type_name: str, object_info: interfaces.objects.ObjectInformation, length: int = 1, **kwargs) -> 'Bytes': """Creates the appropriate class and returns it so that the native type is inherritted. The only reason the kwargs is added, is so that the inherriting types can override __init__ without needing to override __new__ """ return cls._struct_type.__new__( cls, cls._unmarshall(context, data_format = DataFormatInfo(length, "big", False), object_info = object_info)) class VolTemplateProxy(interfaces.objects.ObjectInterface.VolTemplateProxy): @classmethod def size(cls, template: interfaces.objects.Template) -> int: return template.vol.length class String(PrimitiveObject, str): """Primitive Object that handles string values. Args: max_length: specifies the maximum possible length that the string could hold within memory (for multibyte characters, this will not be the maximum length of the string) """ _struct_type = str # type: ClassVar[Type] def __init__(self, context: interfaces.context.ContextInterface, type_name: str, object_info: interfaces.objects.ObjectInformation, max_length: int = 1, encoding: str = "utf-8", errors: str = "strict") -> None: super().__init__(context = context, type_name = type_name, object_info = object_info, data_format = DataFormatInfo(max_length, "big", False)) self._vol["max_length"] = max_length self._vol['encoding'] = encoding self._vol['errors'] = errors def __new__(cls: Type, context: interfaces.context.ContextInterface, type_name: str, object_info: interfaces.objects.ObjectInformation, max_length: int = 1, encoding: str = "utf-8", errors: str = "strict", **kwargs) -> 'String': """Creates the appropriate class and returns it so that the native type is inherited. The only reason the kwargs is added, is so that the inherriting types can override __init__ without needing to override __new__ """ params = {} if encoding: params['encoding'] = encoding if errors: params['errors'] = errors # Pass the encoding and error parameters to the string constructor to appropriately encode the string value = cls._struct_type.__new__( cls, cls._unmarshall(context, data_format = DataFormatInfo(max_length, "big", False), object_info = object_info), **params) if value.find('\x00') >= 0: value = value[:value.find('\x00')] return value class VolTemplateProxy(interfaces.objects.ObjectInterface.VolTemplateProxy): @classmethod def size(cls, template: interfaces.objects.Template) -> int: """Returns the size of the templated object.""" return template.vol.max_length class Pointer(Integer): """Pointer which points to another object.""" def __init__(self, context: interfaces.context.ContextInterface, type_name: str, object_info: interfaces.objects.ObjectInformation, data_format: DataFormatInfo, subtype: Optional[templates.ObjectTemplate] = None) -> None: super().__init__(context = context, object_info = object_info, type_name = type_name, data_format = data_format) self._vol['subtype'] = subtype @classmethod def _unmarshall(cls, context: interfaces.context.ContextInterface, data_format: DataFormatInfo, object_info: interfaces.objects.ObjectInformation) -> Any: """Ensure that pointer values always fall within the domain of the layer they're constructed on. If there's a need for all the data within the address, the pointer should be recast. The "pointer" must always live within the space (even if the data provided is invalid). """ length, endian, signed = data_format if signed: raise ValueError("Pointers cannot have signed values") mask = context.layers[object_info.native_layer_name].address_mask data = context.layers.read(object_info.layer_name, object_info.offset, length) value = int.from_bytes(data, byteorder = endian, signed = signed) return value & mask def dereference(self, layer_name: Optional[str] = None) -> interfaces.objects.ObjectInterface: """Dereferences the pointer. Layer_name is identifies the appropriate layer within the context that the pointer points to. If layer_name is None, it defaults to the same layer that the pointer is currently instantiated in. """ layer_name = layer_name or self.vol.native_layer_name mask = self._context.layers[layer_name].address_mask offset = self & mask return self.vol.subtype(context = self._context, object_info = interfaces.objects.ObjectInformation(layer_name = layer_name, offset = offset, parent = self, size = self.vol.subtype.size)) def is_readable(self, layer_name: Optional[str] = None) -> bool: """Determines whether the address of this pointer can be read from memory.""" layer_name = layer_name or self.vol.layer_name return self._context.layers[layer_name].is_valid(self, self.vol.subtype.size) def __getattr__(self, attr: str) -> Any: """Convenience function to access unknown attributes by getting them from the subtype object.""" if attr in ['vol', '_vol']: raise AttributeError("Pointer not initialized before use") return getattr(self.dereference(), attr) def has_member(self, member_name: str) -> bool: """Returns whether the dereferenced type has this member.""" return self._vol['subtype'].has_member(member_name) class VolTemplateProxy(interfaces.objects.ObjectInterface.VolTemplateProxy): @classmethod def size(cls, template: interfaces.objects.Template) -> int: return Integer.VolTemplateProxy.size(template) @classmethod def children(cls, template: interfaces.objects.Template) -> List[interfaces.objects.Template]: """Returns the children of the template.""" if 'subtype' in template.vol: return [template.vol.subtype] return [] @classmethod def replace_child(cls, template: interfaces.objects.Template, old_child: interfaces.objects.Template, new_child: interfaces.objects.Template) -> None: """Substitutes the old_child for the new_child.""" if 'subtype' in template.vol: if template.vol.subtype == old_child: template.update_vol(subtype = new_child) @classmethod def has_member(cls, template: interfaces.objects.Template, member_name: str) -> bool: return template.vol['subtype'].has_member(member_name) class BitField(interfaces.objects.ObjectInterface, int): """Object containing a field which is made up of bits rather than whole bytes.""" def __init__(self, context: interfaces.context.ContextInterface, type_name: str, object_info: interfaces.objects.ObjectInformation, base_type: interfaces.objects.Template, start_bit: int = 0, end_bit: int = 0) -> None: super().__init__(context, type_name, object_info) self._vol['base_type'] = base_type self._vol['start_bit'] = start_bit self._vol['end_bit'] = end_bit def __new__(cls, context: interfaces.context.ContextInterface, type_name: str, object_info: interfaces.objects.ObjectInformation, base_type: interfaces.objects.Template, start_bit: int = 0, end_bit: int = 0, **kwargs) -> 'BitField': value = base_type(context = context, object_info = object_info) return int.__new__(cls, ((value & ((1 << end_bit) - 1)) >> start_bit)) # type: ignore def write(self, value): raise NotImplementedError("Writing to BitFields is not yet implemented") class VolTemplateProxy(interfaces.objects.ObjectInterface.VolTemplateProxy): @classmethod def size(cls, template: interfaces.objects.Template) -> int: return template.vol.base_type.size @classmethod def children(cls, template: interfaces.objects.Template) -> List[interfaces.objects.Template]: """Returns the children of the template.""" if 'base_type' in template.vol: return [template.vol.base_type] return [] @classmethod def replace_child(cls, template: interfaces.objects.Template, old_child: interfaces.objects.Template, new_child: interfaces.objects.Template) -> None: """Substitutes the old_child for the new_child.""" if 'base_type' in template.vol: if template.vol.base_type == old_child: template.update_vol(base_type = new_child) class Enumeration(interfaces.objects.ObjectInterface, int): """Returns an object made up of choices.""" def __new__(cls, context: interfaces.context.ContextInterface, type_name: str, object_info: interfaces.objects.ObjectInformation, base_type: interfaces.objects.Template, choices: Dict[str, int], **kwargs) -> 'Enumeration': value = base_type(context = context, object_info = object_info) return int.__new__(cls, value) # type: ignore def __init__(self, context: interfaces.context.ContextInterface, type_name: str, object_info: interfaces.objects.ObjectInformation, base_type: Integer, choices: Dict[str, int]) -> None: super().__init__(context, type_name, object_info) self._inverse_choices = self._generate_inverse_choices(choices) self._vol['choices'] = choices self._vol['base_type'] = base_type def __eq__(self, other): """An enumeration must be equivalent to its value, even if the other value is not an enumeration""" return int(self) == other def __hash__(self): """Enumerations must be hashed as equivalent to their integer counterparts""" return super().__hash__() @classmethod def _generate_inverse_choices(cls, choices: Dict[str, int]) -> Dict[int, str]: """Generates the inverse choices for the object.""" inverse_choices = {} # type: Dict[int, str] for k, v in choices.items(): if v in inverse_choices: # Technically this shouldn't be a problem, but since we inverse cache # and can't map one value to two possibilities we throw an exception during build # We can remove/work around this if it proves a common issue raise ValueError("Enumeration value {} duplicated as {} and {}".format(v, k, inverse_choices[v])) inverse_choices[v] = k return inverse_choices def lookup(self, value: int = None) -> str: """Looks up an individual value and returns the associated name.""" if value is None: return self.lookup(self) if value in self._inverse_choices: return self._inverse_choices[value] raise ValueError("The value of the enumeration is outside the possible choices") @property def description(self) -> str: """Returns the chosen name for the value this object contains.""" return self.lookup(self) @property def choices(self) -> Dict[str, int]: return self._vol['choices'] @property def is_valid_choice(self) -> bool: """Returns whether the value for the object is a valid choice""" return self in self.choices.values() def __getattr__(self, attr: str) -> str: """Returns the value for a specific name.""" if attr in self._vol['choices']: return self._vol['choices'][attr] raise AttributeError("Unknown attribute {} for Enumeration {}".format(attr, self._vol['type_name'])) def write(self, value: bytes): raise NotImplementedError("Writing to Enumerations is not yet implemented") class VolTemplateProxy(interfaces.objects.ObjectInterface.VolTemplateProxy): _methods = ['lookup'] @classmethod def lookup(cls, template: interfaces.objects.Template, value: int) -> str: """Looks up an individual value and returns the associated name.""" _inverse_choices = Enumeration._generate_inverse_choices(template.vol['choices']) if value in _inverse_choices: return _inverse_choices[value] raise ValueError("The value of the enumeration is outside the possible choices") @classmethod def size(cls, template: interfaces.objects.Template) -> int: return template.vol['base_type'].size @classmethod def children(cls, template: interfaces.objects.Template) -> List[interfaces.objects.Template]: """Returns the children of the template.""" if 'base_type' in template.vol: return [template.vol.base_type] return [] @classmethod def replace_child(cls, template: interfaces.objects.Template, old_child: interfaces.objects.Template, new_child: interfaces.objects.Template) -> None: """Substitutes the old_child for the new_child.""" if 'base_type' in template.vol: if template.vol.base_type == old_child: template.update_vol(base_type = new_child) class Array(interfaces.objects.ObjectInterface, collections.abc.Sequence): """Object which can contain a fixed number of an object type.""" def __init__(self, context: interfaces.context.ContextInterface, type_name: str, object_info: interfaces.objects.ObjectInformation, count: int = 0, subtype: templates.ObjectTemplate = None) -> None: super().__init__(context = context, type_name = type_name, object_info = object_info) self._vol['count'] = count self._vol['subtype'] = subtype self._vol['size'] = 0 if subtype is not None: self._vol['size'] = count * subtype.size # This overrides the little known Sequence.count(val) that returns the number of items in the list that match val # Changing the name would be confusing (since we use count of an array everywhere else), so this is more important @property def count(self) -> int: """Returns the count dynamically.""" return self.vol.count @count.setter def count(self, value: int) -> None: """Sets the count to a specific value.""" self._vol['count'] = value self._vol['size'] = value * self._vol['subtype'].size class VolTemplateProxy(interfaces.objects.ObjectInterface.VolTemplateProxy): @classmethod def size(cls, template: interfaces.objects.Template) -> int: """Returns the size of the array, based on the count and the subtype.""" if 'subtype' not in template.vol and 'count' not in template.vol: raise ValueError("Array ObjectTemplate must be provided a count and subtype") return template.vol.get('subtype', None).size * template.vol.get('count', 0) @classmethod def children(cls, template: interfaces.objects.Template) -> List[interfaces.objects.Template]: """Returns the children of the template.""" if 'subtype' in template.vol: return [template.vol.subtype] return [] @classmethod def replace_child(cls, template: interfaces.objects.Template, old_child: interfaces.objects.Template, new_child: interfaces.objects.Template) -> None: """Substitutes the old_child for the new_child.""" if 'subtype' in template.vol: if template.vol['subtype'] == old_child: template.update_vol(subtype = new_child) @classmethod def relative_child_offset(cls, template: interfaces.objects.Template, child: str) -> int: """Returns the relative offset from the head of the parent data to the child member.""" if 'subtype' in template.vol and child == 'subtype': return 0 raise IndexError("Member not present in array template: {}".format(child)) @overload def __getitem__(self, i: int) -> interfaces.objects.Template: ... @overload def __getitem__(self, s: slice) -> List[interfaces.objects.Template]: ... def __getitem__(self, i): """Returns the i-th item from the array.""" result = [] # type: List[interfaces.objects.Template] mask = self._context.layers[self.vol.layer_name].address_mask # We use the range function to deal with slices for us series = range(self.vol.count)[i] return_list = True if isinstance(series, int): return_list = False series = [series] for index in series: object_info = interfaces.objects.ObjectInformation( layer_name = self.vol.layer_name, offset = mask & (self.vol.offset + (self.vol.subtype.size * index)), parent = self, native_layer_name = self.vol.native_layer_name, size = self.vol.subtype.size) result += [self.vol.subtype(context = self._context, object_info = object_info)] if not return_list: return result[0] return result def __len__(self) -> int: """Returns the length of the array.""" return self.vol.count def write(self, value) -> None: raise NotImplementedError("Writing to Arrays is not yet implemented") class AggregateType(interfaces.objects.ObjectInterface): """Object which can contain members that are other objects. Keep the number of methods in this class low or very specific, since each one could overload a valid member. """ def __init__(self, context: interfaces.context.ContextInterface, type_name: str, object_info: interfaces.objects.ObjectInformation, size: int, members: Dict[str, Tuple[int, interfaces.objects.Template]]) -> None: super().__init__(context = context, type_name = type_name, object_info = object_info, size = size, members = members) # self._check_members(members) self._concrete_members = {} # type: Dict[str, Dict] def has_member(self, member_name: str) -> bool: """Returns whether the object would contain a member called member_name.""" return member_name in self.vol.members class VolTemplateProxy(interfaces.objects.ObjectInterface.VolTemplateProxy): @classmethod def size(cls, template: interfaces.objects.Template) -> int: """Method to return the size of this type.""" if template.vol.get('size', None) is None: raise ValueError("ObjectTemplate not provided with a size") return template.vol.size @classmethod def children(cls, template: interfaces.objects.Template) -> List[interfaces.objects.Template]: """Method to list children of a template.""" return [member for _, member in template.vol.members.values()] @classmethod def replace_child(cls, template: interfaces.objects.Template, old_child: interfaces.objects.Template, new_child: interfaces.objects.Template) -> None: """Replace a child elements within the arguments handed to the template.""" for member in template.vol.members.get('members', {}): relative_offset, member_template = template.vol.members[member] if member_template == old_child: # Members will give access to the mutable members list, # but in case that ever changes, do the update correctly tmp_list = template.vol.members tmp_list[member] = (relative_offset, new_child) # If there's trouble with mutability, consider making update_vol return a clone with the changes # (there will be a few other places that will be necessary) and/or making these part of the # permanent dictionaries rather than the non-clonable ones template.update_vol(members = tmp_list) @classmethod def relative_child_offset(cls, template: interfaces.objects.Template, child: str) -> int: """Returns the relative offset of a child to its parent.""" retlist = template.vol.members.get(child, None) if retlist is None: raise IndexError("Member not present in template: {}".format(child)) return retlist[0] @classmethod def has_member(cls, template: interfaces.objects.Template, member_name: str) -> bool: """Returns whether the object would contain a member called member_name.""" return member_name in template.vol.members @classmethod def _check_members(cls, members: Dict[str, Tuple[int, interfaces.objects.Template]]) -> None: # Members should be an iterable mapping of symbol names to tuples of (relative_offset, ObjectTemplate) # An object template is a callable that when called with a context, offset, layer_name and type_name # We duplicate this code to avoid polluting the methodspace agg_name = 'AggregateType' for agg_type in AggregateTypes: if isinstance(cls, agg_type): agg_name = agg_type.__name__ assert isinstance(members, collections.abc.Mapping) "{} members parameter must be a mapping: {}".format(agg_name, type(members)) assert all([(isinstance(member, tuple) and len(member) == 2) for member in members.values()]) "{} members must be a tuple of relative_offsets and templates".format(agg_name) def member(self, attr: str = 'member') -> object: """Specifically named method for retrieving members.""" return self.__getattr__(attr) def __getattr__(self, attr: str) -> Any: """Method for accessing members of the type.""" if attr in ['_concrete_members', 'vol']: raise AttributeError("Object has not been properly initialized") if attr in self._concrete_members: return self._concrete_members[attr] elif attr in self.vol.members: mask = self._context.layers[self.vol.layer_name].address_mask relative_offset, template = self.vol.members[attr] if isinstance(template, templates.ReferenceTemplate): template = self._context.symbol_space.get_type(template.vol.type_name) object_info = interfaces.objects.ObjectInformation(layer_name = self.vol.layer_name, offset = mask & (self.vol.offset + relative_offset), member_name = attr, parent = self, native_layer_name = self.vol.native_layer_name, size = template.size) member = template(context = self._context, object_info = object_info) self._concrete_members[attr] = member return member # We duplicate this code to avoid polluting the methodspace agg_name = 'AggregateType' for agg_type in AggregateTypes: if isinstance(self, agg_type): agg_name = agg_type.__name__ raise AttributeError("{} has no attribute: {}.{}".format(agg_name, self.vol.type_name, attr)) def __dir__(self) -> Iterable[str]: """Returns a complete list of members when dir is called.""" return list(super().__dir__()) + list(self.vol.members) def write(self, value): # We duplicate this code to avoid polluting the methodspace agg_name = 'AggregateType' for agg_type in AggregateTypes: if isinstance(self, agg_type): agg_name = agg_type.__name__ raise TypeError( "{}s cannot be written to directly, individual members must be written instead".format(agg_name)) class StructType(AggregateType): pass class UnionType(AggregateType): pass class ClassType(AggregateType): pass AggregateTypes = {StructType: 'struct', UnionType: 'union', ClassType: 'class'} volatility3-1.0.1/volatility3/framework/objects/templates.py000066400000000000000000000113261405267600400242640ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import functools import logging from typing import Any, ClassVar, Dict, List, Type from volatility3.framework import interfaces, exceptions, constants vollog = logging.getLogger(__name__) class ObjectTemplate(interfaces.objects.Template): """Factory class that produces objects that adhere to the Object interface on demand. This is effectively a method of currying, but adds more structure to avoid abuse. It also allows inspection of information that should already be known: * Type size * Members * etc """ def __init__(self, object_class: Type[interfaces.objects.ObjectInterface], type_name: str, **arguments) -> None: arguments['object_class'] = object_class super().__init__(type_name = type_name, **arguments) proxy_cls = self.vol.object_class.VolTemplateProxy for method_name in proxy_cls._methods: setattr(self, method_name, functools.partial(getattr(proxy_cls, method_name), self)) @property def size(self) -> int: """Returns the children of the templated object (see :class:`~volatilit y.framework.interfaces.objects.ObjectInterface.VolTemplateProxy`)""" return self.vol.object_class.VolTemplateProxy.size(self) @property def children(self) -> List[interfaces.objects.Template]: """Returns the children of the templated object (see :class:`~volatilit y.framework.interfaces.objects.ObjectInterface.VolTemplateProxy`)""" return self.vol.object_class.VolTemplateProxy.children(self) def relative_child_offset(self, child: str) -> int: """Returns the relative offset of a child of the templated object (see :class:`~volatility3.framework.interfaces.objects.ObjectInterface.VolTem plateProxy`)""" return self.vol.object_class.VolTemplateProxy.relative_child_offset(self, child) def replace_child(self, old_child: interfaces.objects.Template, new_child: interfaces.objects.Template) -> None: """Replaces `old_child` for `new_child` in the templated object's child list (see :class:`~volatility3.framework.interfaces.objects.ObjectInterf ace.VolTemplateProxy`)""" return self.vol.object_class.VolTemplateProxy.replace_child(self, old_child, new_child) def has_member(self, member_name: str) -> bool: """Returns whether the object would contain a member called member_name.""" return self.vol.object_class.VolTemplateProxy.has_member(self, member_name) def __call__(self, context: interfaces.context.ContextInterface, object_info: interfaces.objects.ObjectInformation) -> interfaces.objects.ObjectInterface: """Constructs the object. Returns: an object adhereing to the :class:`~volatility3.framework.interfaces.objects.ObjectInterface` """ arguments = {} # type: Dict[str, Any] for arg in self.vol: if arg != 'object_class': arguments[arg] = self.vol[arg] return self.vol.object_class(context = context, object_info = object_info, **arguments) class ReferenceTemplate(interfaces.objects.Template): """Factory class that produces objects based on a delayed reference type. Attempts to access any standard attributes of a resolved template will result in a :class:`~volatility3.framework.exceptions.SymbolError`. """ @property def children(self) -> List[interfaces.objects.Template]: return [] def _unresolved(self, *args, **kwargs) -> Any: """Referenced symbols must be appropriately resolved before they can provide information such as size This is because the size request has no context within which to determine the actual symbol structure.""" type_name = self.vol.type_name.split(constants.BANG) table_name = None if len(type_name) == 2: table_name = type_name[0] symbol_name = type_name[-1] raise exceptions.SymbolError( symbol_name, table_name, "Template contains no information about its structure: {}".format(self.vol.type_name)) size = property(_unresolved) # type: ClassVar[Any] replace_child = _unresolved # type: ClassVar[Any] relative_child_offset = _unresolved # type: ClassVar[Any] has_member = _unresolved # type: ClassVar[Any] def __call__(self, context: interfaces.context.ContextInterface, object_info: interfaces.objects.ObjectInformation): template = context.symbol_space.get_type(self.vol.type_name) return template(context = context, object_info = object_info) volatility3-1.0.1/volatility3/framework/objects/utility.py000066400000000000000000000042471405267600400237750ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from typing import Optional, Union from volatility3.framework import interfaces, objects, constants def array_to_string(array: 'objects.Array', count: Optional[int] = None, errors: str = 'replace') -> interfaces.objects.ObjectInterface: """Takes a volatility Array of characters and returns a string.""" # TODO: Consider checking the Array's target is a native char if count is None: count = array.vol.count if not isinstance(array, objects.Array): raise TypeError("Array_to_string takes an Array of char") return array.cast("string", max_length = count, errors = errors) def pointer_to_string(pointer: 'objects.Pointer', count: int, errors: str = 'replace'): """Takes a volatility Pointer to characters and returns a string.""" if not isinstance(pointer, objects.Pointer): raise TypeError("pointer_to_string takes a Pointer") if count < 1: raise ValueError("pointer_to_string requires a positive count") char = pointer.dereference() return char.cast("string", max_length = count, errors = errors) def array_of_pointers(array: interfaces.objects.ObjectInterface, count: int, subtype: Union[str, interfaces.objects.Template], context: interfaces.context.ContextInterface) -> interfaces.objects.ObjectInterface: """Takes an object, and recasts it as an array of pointers to subtype.""" symbol_table = array.vol.type_name.split(constants.BANG)[0] if isinstance(subtype, str) and context is not None: subtype = context.symbol_space.get_type(subtype) if not isinstance(subtype, interfaces.objects.Template) or subtype is None: raise TypeError("Subtype must be a valid template (or string name of an object template)") subtype_pointer = context.symbol_space.get_type(symbol_table + constants.BANG + "pointer") subtype_pointer.update_vol(subtype = subtype) return array.cast("array", count = count, subtype = subtype_pointer) volatility3-1.0.1/volatility3/framework/plugins/000077500000000000000000000000001405267600400217415ustar00rootroot00000000000000volatility3-1.0.1/volatility3/framework/plugins/__init__.py000066400000000000000000000047321405267600400240600ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """All core generic plugins. These modules should only be imported from volatility3.plugins NOT volatility3.framework.plugins """ import logging from typing import List, Type from volatility3.framework import interfaces, automagic, exceptions, constants vollog = logging.getLogger(__name__) def construct_plugin(context: interfaces.context.ContextInterface, automagics: List[interfaces.automagic.AutomagicInterface], plugin: Type[interfaces.plugins.PluginInterface], base_config_path: str, progress_callback: constants.ProgressCallback, open_method: Type[interfaces.plugins.FileHandlerInterface]) -> interfaces.plugins.PluginInterface: """Constructs a plugin object based on the parameters. Clever magic figures out how to fulfill each requirement that might not be fulfilled Args: context: The volatility context to operate on automagics: A list of automagic modules to run to augment the context plugin: The plugin to run base_config_path: The path within the context's config containing the plugin's configuration progress_callback: Callback function to provide feedback for ongoing processes open_method: class to provide context manager for opening the file Returns: The constructed plugin object """ errors = automagic.run(automagics, context, plugin, base_config_path, progress_callback = progress_callback) # Plugins always get their configuration stored under their plugin name plugin_config_path = interfaces.configuration.path_join(base_config_path, plugin.__name__) # Check all the requirements and/or go back to the automagic step unsatisfied = plugin.unsatisfied(context, plugin_config_path) if unsatisfied: for error in errors: error_string = [x for x in error.format_exception_only()][-1] vollog.warning("Automagic exception occurred: {}".format(error_string[:-1])) vollog.log(constants.LOGLEVEL_V, "".join(error.format(chain = True))) raise exceptions.UnsatisfiedException(unsatisfied) constructed = plugin(context, plugin_config_path, progress_callback = progress_callback) if open_method: constructed.set_open_method(open_method) return constructed volatility3-1.0.1/volatility3/framework/plugins/banners.py000066400000000000000000000042471405267600400237520ustar00rootroot00000000000000# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import List from volatility3.framework import interfaces, renderers, layers from volatility3.framework.configuration import requirements from volatility3.framework.layers import scanners from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) class Banners(interfaces.plugins.PluginInterface): """Attempts to identify potential linux banners in an image""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer to scan')] def _generator(self): layer = self.context.layers[self.config['primary']] if isinstance(layer, layers.intel.Intel): layer = self.context.layers[layer.config['memory_layer']] for offset, banner in self.locate_banners(self.context, layer.name): yield 0, (offset, banner) @classmethod def locate_banners(cls, context: interfaces.context.ContextInterface, layer_name: str): """Identifies banners from a memory image""" layer = context.layers[layer_name] for offset in layer.scan( context = context, scanner = scanners.RegExScanner(rb"(Linux version|Darwin Kernel Version) [0-9]+\.[0-9]+\.[0-9]+")): data = layer.read(offset, 0xfff) data_index = data.find(b'\x00') if data_index > 0: data = data[:data_index].strip() failed = [ char for char in data if char not in b' #()+,;/-.0123456789:@ABCDEFGHIJKLMNOPQRSTUVWXYZ_abcdefghijklmnopqrstuvwxyz~' ] if not failed: yield format_hints.Hex(offset), str(data, encoding = 'latin-1', errors = '?') def run(self): return renderers.TreeGrid([("Offset", format_hints.Hex), ("Banner", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/configwriter.py000066400000000000000000000041171405267600400250200ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import json import logging from typing import List from volatility3.framework import renderers, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins vollog = logging.getLogger(__name__) class ConfigWriter(plugins.PluginInterface): """Runs the automagics and both prints and outputs configuration in the output directory.""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.BooleanRequirement(name = 'extra', description = 'Outputs whole configuration tree', default = False, optional = True) ] def _generator(self): filename = "config.json" config = dict(self.build_configuration()) if self.config.get('extra', False): vollog.debug("Outputting additional information, this will NOT work with the -c option") config = dict(self.context.config) filename = "config.extra" try: with self.open(filename) as file_data: file_data.write(bytes(json.dumps(config, sort_keys = True, indent = 2), 'raw_unicode_escape')) except Exception as excp: vollog.warning("Unable to JSON encode configuration: {}".format(excp)) for k, v in config.items(): yield (0, (k, json.dumps(v))) def run(self): return renderers.TreeGrid([("Key", str), ("Value", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/frameworkinfo.py000066400000000000000000000023541405267600400251700ustar00rootroot00000000000000from typing import List from volatility3 import framework from volatility3.framework import interfaces, renderers from volatility3.framework.interfaces import plugins class FrameworkInfo(plugins.PluginInterface): """Plugin to list the various modular components of Volatility""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [] def _generator(self): categories = { 'Automagic': interfaces.automagic.AutomagicInterface, 'Requirement': interfaces.configuration.RequirementInterface, 'Layer': interfaces.layers.DataLayerInterface, 'LayerStacker': interfaces.automagic.StackerLayerInterface, 'Object': interfaces.objects.ObjectInterface, 'Plugin': interfaces.plugins.PluginInterface, 'Renderer': interfaces.renderers.Renderer } for category, module_interface in categories.items(): yield (0, (category, )) for clazz in framework.class_subclasses(module_interface): yield (1, (clazz.__name__, )) def run(self): return renderers.TreeGrid([("Data", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/isfinfo.py000066400000000000000000000140641405267600400237550ustar00rootroot00000000000000# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import base64 import json import logging import os import pathlib import zipfile from typing import List, Type, Any, Generator from volatility3 import schemas, symbols from volatility3.framework import interfaces, renderers, constants from volatility3.framework.automagic import mac, linux, symbol_cache from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.layers import resources vollog = logging.getLogger(__name__) class IsfInfo(plugins.PluginInterface): """Determines information about the currently available ISF files, or a specific one""" _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.ListRequirement(name = 'filter', description = 'String that must be present in the file URI to display the ISF', optional = True, default = []), requirements.URIRequirement(name = 'isf', description = "Specific ISF file to process", default = None, optional = True), requirements.BooleanRequirement(name = 'validate', description = 'Validate against schema if possible', default = False, optional = True) ] @classmethod def list_all_isf_files(cls) -> Generator[str, None, None]: """Lists all the ISF files that can be found""" for symbol_path in symbols.__path__: for root, dirs, files in os.walk(symbol_path, followlinks = True): for filename in files: base_name = os.path.join(root, filename) if filename.endswith('zip'): with zipfile.ZipFile(base_name, 'r') as zfile: for name in zfile.namelist(): for extension in constants.ISF_EXTENSIONS: # By ending with an extension (and therefore, not /), we should not return any directories if name.endswith(extension): yield "jar:file:" + str(pathlib.Path(base_name)) + "!" + name else: for extension in constants.ISF_EXTENSIONS: if filename.endswith(extension): yield pathlib.Path(base_name).as_uri() def _get_banner(self, clazz: Type[symbol_cache.SymbolBannerCache], data: Any) -> str: """Gets a banner from an ISF file""" banner_symbol = data.get('symbols', {}).get(clazz.symbol_name, {}).get('constant_data', renderers.NotAvailableValue()) if not isinstance(banner_symbol, interfaces.renderers.BaseAbsentValue): banner_symbol = str(base64.b64decode(banner_symbol), encoding = 'latin-1') return banner_symbol def _generator(self): if self.config.get('isf', None) is not None: file_list = [self.config['isf']] else: file_list = list(self.list_all_isf_files()) # Filter the files filtered_list = [] if not len(self.config['filter']): filtered_list = file_list else: for isf_file in file_list: for filter_item in self.config['filter']: if filter_item in isf_file: filtered_list.append(isf_file) try: import jsonschema if not self.config['validate']: raise ImportError # Act as if we couldn't import if validation is turned off def check_valid(data): return "True" if schemas.validate(data, True) else "False" except ImportError: def check_valid(data): return "Unknown" # Process the filtered list for entry in filtered_list: num_types = num_enums = num_bases = num_symbols = 0 windows_info = linux_banner = mac_banner = renderers.NotAvailableValue() valid = "Unknown" with resources.ResourceAccessor().open(url = entry) as fp: try: data = json.load(fp) num_symbols = len(data.get('symbols', [])) num_types = len(data.get('user_types', [])) num_enums = len(data.get('enums', [])) num_bases = len(data.get('base_types', [])) linux_banner = self._get_banner(linux.LinuxBannerCache, data) mac_banner = self._get_banner(mac.MacBannerCache, data) if not linux_banner and not mac_banner: windows_info = os.path.splitext(os.path.basename(entry))[0] valid = check_valid(data) except (UnicodeDecodeError, json.decoder.JSONDecodeError): vollog.warning("Invalid ISF: {}".format(entry)) yield (0, (entry, valid, num_bases, num_types, num_symbols, num_enums, windows_info, linux_banner, mac_banner)) # Try to open the file, load it as JSON, read the data from it def run(self): return renderers.TreeGrid([("URI", str), ("Valid", str), ("Number of base_types", int), ("Number of types", int), ("Number of symbols", int), ("Number of enums", int), ("Windows info", str), ("Linux banner", str), ("Mac banner", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/layerwriter.py000066400000000000000000000130021405267600400246600ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import List, Optional, Type from volatility3.framework import renderers, interfaces, constants, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins vollog = logging.getLogger(__name__) class LayerWriter(plugins.PluginInterface): """Runs the automagics and writes out the primary layer produced by the stacker.""" default_block_size = 0x500000 _required_framework_version = (1, 0, 0) _version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.IntRequirement(name = 'block_size', description = "Size of blocks to copy over", default = cls.default_block_size, optional = True), requirements.BooleanRequirement(name = 'list', description = 'List available layers', default = False, optional = True), requirements.ListRequirement( name = 'layers', element_type = str, description = 'Names of layers to write (defaults to the highest non-mapped layer)', default = None, optional = True) ] @classmethod def write_layer( cls, context: interfaces.context.ContextInterface, layer_name: str, preferred_name: str, open_method: Type[plugins.FileHandlerInterface], chunk_size: Optional[int] = None, progress_callback: Optional[constants.ProgressCallback] = None) -> Optional[plugins.FileHandlerInterface]: """Produces a FileHandler from the named layer in the provided context or None on failure Args: context: the context from which to read the memory layer layer_name: the name of the layer to write out preferred_name: a string with the preferred filename for hte file chunk_size: an optional size for the chunks that should be written (defaults to 0x500000) open_method: class for creating FileHandler context managers progress_callback: an optional function that takes a percentage and a string that displays output """ if layer_name not in context.layers: raise exceptions.LayerException("Layer not found") layer = context.layers[layer_name] if chunk_size is None: chunk_size = cls.default_block_size file_handle = open_method(preferred_name) for i in range(0, layer.maximum_address, chunk_size): current_chunk_size = min(chunk_size, layer.maximum_address - i) data = layer.read(i, current_chunk_size, pad = True) file_handle.write(data) if progress_callback: progress_callback((i / layer.maximum_address) * 100, 'Writing layer {}'.format(layer_name)) return file_handle def _generator(self): if self.config['list']: for name in self.context.layers: yield 0, (name, ) else: # Choose the most recently added layer that isn't virtual if not self.config['layers']: self.config['layers'] = [] for name in self.context.layers: if not self.context.layers[name].metadata.get('mapped', False): self.config['layers'] = [name] for name in self.config['layers']: # Check the layer exists and validate the output file if name not in self.context.layers: yield 0, ('Layer Name {} does not exist'.format(name), ) else: output_name = self.config.get('output', ".".join([name, "raw"])) try: file_handle = self.write_layer(self.context, name, output_name, self.open, self.config.get('block_size', self.default_block_size), progress_callback = self._progress_callback) file_handle.close() except IOError as excp: yield 0, ('Layer cannot be written to {}: {}'.format(self.config['output_name'], excp), ) yield 0, ('Layer has been written to {}'.format(output_name), ) def _generate_layers(self): """List layer names from this run""" for name in self.context.layers: yield (0, (name, )) def run(self): if self.config['list']: return renderers.TreeGrid([("Layer name", str)], self._generate_layers()) return renderers.TreeGrid([("Status", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/linux/000077500000000000000000000000001405267600400231005ustar00rootroot00000000000000volatility3-1.0.1/volatility3/framework/plugins/linux/__init__.py000066400000000000000000000004741405267600400252160ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """All core linux plugins. These modules should only be imported from volatility3.plugins NOT volatility3.framework.plugins """ volatility3-1.0.1/volatility3/framework/plugins/linux/bash.py000066400000000000000000000122211405267600400243650ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """A module containing a collection of plugins that produce data typically found in Linux's /proc file system.""" import datetime import struct from typing import List from volatility3.framework import constants, renderers, symbols, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.layers import scanners from volatility3.framework.objects import utility from volatility3.framework.symbols.linux.bash import BashIntermedSymbols from volatility3.plugins import timeliner from volatility3.plugins.linux import pslist class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): """Recovers bash command history from memory.""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), requirements.ListRequirement(name = 'pid', element_type = int, description = "Process IDs to include (all other processes are excluded)", optional = True) ] def _generator(self, tasks): is_32bit = not symbols.symbol_table_is_64bit(self.context, self.config["vmlinux"]) if is_32bit: pack_format = "I" bash_json_file = "bash32" else: pack_format = "Q" bash_json_file = "bash64" bash_table_name = BashIntermedSymbols.create(self.context, self.config_path, "linux", bash_json_file) ts_offset = self.context.symbol_space.get_type(bash_table_name + constants.BANG + "hist_entry").relative_child_offset("timestamp") for task in tasks: task_name = utility.array_to_string(task.comm) if task_name not in ["bash", "sh", "dash"]: continue proc_layer_name = task.add_process_layer() if not proc_layer_name: continue proc_layer = self.context.layers[proc_layer_name] bang_addrs = [] # find '#' values on the heap for address in proc_layer.scan(self.context, scanners.BytesScanner(b"#"), sections = task.get_process_memory_sections(heap_only = True)): bang_addrs.append(struct.pack(pack_format, address)) history_entries = [] for address, _ in proc_layer.scan(self.context, scanners.MultiStringScanner(bang_addrs), sections = task.get_process_memory_sections(heap_only = True)): hist = self.context.object(bash_table_name + constants.BANG + "hist_entry", offset = address - ts_offset, layer_name = proc_layer_name) if hist.is_valid(): history_entries.append(hist) for hist in sorted(history_entries, key = lambda x: x.get_time_as_integer()): yield (0, (task.pid, task_name, hist.get_time_object(), hist.get_command())) def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), ("CommandTime", datetime.datetime), ("Command", str)], self._generator( pslist.PsList.list_tasks(self.context, self.config['primary'], self.config['vmlinux'], filter_func = filter_func))) def generate_timeline(self): filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) for row in self._generator( pslist.PsList.list_tasks(self.context, self.config['primary'], self.config['vmlinux'], filter_func = filter_func)): _depth, row_data = row description = "{} ({}): \"{}\"".format(row_data[0], row_data[1], row_data[3]) yield (description, timeliner.TimeLinerType.CREATED, row_data[2]) volatility3-1.0.1/volatility3/framework/plugins/linux/check_afinfo.py000066400000000000000000000076601405267600400260620ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """A module containing a collection of plugins that produce data typically found in Linux's /proc file system.""" import logging from typing import List from volatility3.framework import exceptions, interfaces, contexts from volatility3.framework import renderers from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) class Check_afinfo(plugins.PluginInterface): """Verifies the operation function pointers of network protocols.""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols") ] # returns whether the symbol is found within the kernel (system.map) or not def _is_known_address(self, handler_addr): symbols = list(self.context.symbol_space.get_symbols_by_location(handler_addr)) return len(symbols) > 0 def _check_members(self, var_ops, var_name, members): for check in members: # redhat-specific garbage if check.startswith("__UNIQUE_ID_rh_kabi_hide"): continue if check == "write": addr = var_ops.member(attr = 'write') else: addr = getattr(var_ops, check) if addr and addr != 0 and not self._is_known_address(addr): yield check, addr def _check_afinfo(self, var_name, var, op_members, seq_members): for hooked_member, hook_address in self._check_members(var.seq_fops, var_name, op_members): yield var_name, hooked_member, hook_address # newer kernels if var.has_member("seq_ops"): for hooked_member, hook_address in self._check_members(var.seq_ops, var_name, seq_members): yield var_name, hooked_member, hook_address # this is the most commonly hooked member by rootkits, so a force a check on it elif not self._is_known_address(var.seq_show): yield var_name, "show", var.seq_show def _generator(self): vmlinux = contexts.Module(self.context, self.config['vmlinux'], self.config['primary'], 0) op_members = vmlinux.get_type('file_operations').members seq_members = vmlinux.get_type('seq_operations').members tcp = ("tcp_seq_afinfo", ["tcp6_seq_afinfo", "tcp4_seq_afinfo"]) udp = ("udp_seq_afinfo", ["udplite6_seq_afinfo", "udp6_seq_afinfo", "udplite4_seq_afinfo", "udp4_seq_afinfo"]) protocols = [tcp, udp] for (struct_type, global_vars) in protocols: for global_var_name in global_vars: # this will lookup fail for the IPv6 protocols on kernels without IPv6 support try: global_var = vmlinux.get_symbol(global_var_name) except exceptions.SymbolError: continue global_var = vmlinux.object(object_type = struct_type, offset = global_var.address) for name, member, address in self._check_afinfo(global_var_name, global_var, op_members, seq_members): yield 0, (name, member, format_hints.Hex(address)) def run(self): return renderers.TreeGrid([("Symbol Name", str), ("Member", str), ("Handler Address", format_hints.Hex)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/linux/check_creds.py000066400000000000000000000046261405267600400257170ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from volatility3.framework import interfaces, renderers, constants from volatility3.framework.configuration import requirements from volatility3.plugins.linux import pslist vollog = logging.getLogger(__name__) class Check_creds(interfaces.plugins.PluginInterface): """Checks if any processes are sharing credential structures""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)) ] def _generator(self): # vmlinux = contexts.Module(self.context, self.config['vmlinux'], self.config['primary'], 0) type_task = self.context.symbol_space.get_type(self.config['vmlinux'] + constants.BANG + "task_struct") if not type_task.has_member("cred"): raise TypeError( "This plugin requires the task_struct structure to have a cred member. " "This member is not present in the supplied symbol table. " "This means you are either analyzing an unsupported kernel version or that your symbol table is corrupt." ) creds = {} tasks = pslist.PsList.list_tasks(self.context, self.config['primary'], self.config['vmlinux']) for task in tasks: cred_addr = task.cred.dereference().vol.offset if not cred_addr in creds: creds[cred_addr] = [] creds[cred_addr].append(task.pid) for (_, pids) in creds.items(): if len(pids) > 1: pid_str = "" for pid in pids: pid_str = pid_str + "{0:d}, ".format(pid) pid_str = pid_str[:-2] yield (0, [str(pid_str)]) def run(self): return renderers.TreeGrid([("PIDs", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/linux/check_idt.py000066400000000000000000000073711405267600400253770ustar00rootroot00000000000000# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import List from volatility3.framework import interfaces, renderers, contexts, symbols from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import linux from volatility3.plugins.linux import lsmod vollog = logging.getLogger(__name__) class Check_idt(interfaces.plugins.PluginInterface): """ Checks if the IDT has been altered """ _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), requirements.VersionRequirement(name = 'linuxutils', component = linux.LinuxUtilities, version = (1, 0, 0)), requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)) ] def _generator(self): vmlinux = contexts.Module(self.context, self.config['vmlinux'], self.config['primary'], 0) modules = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['vmlinux']) handlers = linux.LinuxUtilities.generate_kernel_handler_info(self.context, self.config['primary'], self.config['vmlinux'], modules) is_32bit = not symbols.symbol_table_is_64bit(self.context, self.config["vmlinux"]) idt_table_size = 256 address_mask = self.context.layers[self.config['primary']].address_mask # hw handlers + system call check_idxs = list(range(0, 20)) + [128] if is_32bit: if vmlinux.has_type("gate_struct"): idt_type = "gate_struct" else: idt_type = "desc_struct" else: if vmlinux.has_type("gate_struct64"): idt_type = "gate_struct64" elif vmlinux.has_type("gate_struct"): idt_type = "gate_struct" else: idt_type = "idt_desc" addrs = vmlinux.object_from_symbol("idt_table") table = vmlinux.object(object_type = 'array', offset = addrs.vol.offset, subtype = vmlinux.get_type(idt_type), count = idt_table_size) for i in check_idxs: ent = table[i] if not ent: continue if hasattr(ent, "Address"): idt_addr = ent.Address else: low = ent.offset_low middle = ent.offset_middle if hasattr(ent, "offset_high"): high = ent.offset_high else: high = 0 idt_addr = (high << 32) | (middle << 16) | low idt_addr = idt_addr & address_mask module_name, symbol_name = linux.LinuxUtilities.lookup_module_address(self.context, handlers, idt_addr) yield (0, [format_hints.Hex(i), format_hints.Hex(idt_addr), module_name, symbol_name]) def run(self): return renderers.TreeGrid([("Index", format_hints.Hex), ("Address", format_hints.Hex), ("Module", str), ("Symbol", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/linux/check_modules.py000066400000000000000000000061411405267600400262610ustar00rootroot00000000000000# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import List from volatility3.framework import interfaces, renderers, exceptions, constants, contexts from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility from volatility3.framework.renderers import format_hints from volatility3.plugins.linux import lsmod vollog = logging.getLogger(__name__) class Check_modules(plugins.PluginInterface): """Compares module list to sysfs info, if available""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)) ] def get_kset_modules(self, vmlinux): try: module_kset = vmlinux.object_from_symbol("module_kset") except exceptions.SymbolError: module_kset = None if not module_kset: raise TypeError( "This plugin requires the module_kset structure. This structure is not present in the supplied symbol table. This means you are either analyzing an unsupported kernel version or that your symbol table is corrupt." ) ret = {} kobj_off = self.context.symbol_space.get_type(self.config['vmlinux'] + constants.BANG + 'module_kobject').relative_child_offset('kobj') for kobj in module_kset.list.to_list(vmlinux.name + constants.BANG + "kobject", "entry"): mod_kobj = vmlinux.object(object_type = "module_kobject", offset = kobj.vol.offset - kobj_off) mod = mod_kobj.mod name = utility.pointer_to_string(kobj.name, 32) if kobj.name and kobj.reference_count() > 2: ret[name] = mod return ret def _generator(self): vmlinux = contexts.Module(self.context, self.config['vmlinux'], self.config['primary'], 0) kset_modules = self.get_kset_modules(vmlinux) lsmod_modules = set( str(utility.array_to_string(modules.name)) for modules in lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['vmlinux'])) for mod_name in set(kset_modules.keys()).difference(lsmod_modules): yield (0, (format_hints.Hex(kset_modules[mod_name]), str(mod_name))) def run(self): return renderers.TreeGrid([("Module Address", format_hints.Hex), ("Module Name", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/linux/check_syscall.py000066400000000000000000000153301405267600400262630ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """A module containing a collection of plugins that produce data typically found in Linux's /proc file system.""" import logging from typing import List from volatility3.framework import exceptions, interfaces, contexts from volatility3.framework import renderers, constants from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) try: import capstone has_capstone = True except ImportError: has_capstone = False class Check_syscall(plugins.PluginInterface): """Check system call table for hooks.""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols") ] def _get_table_size_next_symbol(self, table_addr, ptr_sz, vmlinux): """Returns the size of the table based on the next symbol.""" ret = 0 sym_table = self.context.symbol_space[vmlinux.name] sorted_symbols = sorted([(sym_table.get_symbol(sn).address, sn) for sn in sym_table.symbols]) sym_address = 0 for tmp_sym_address, sym_name in sorted_symbols: if tmp_sym_address > table_addr: sym_address = tmp_sym_address break if sym_address > 0: ret = int((sym_address - table_addr) / ptr_sz) return ret def _get_table_size_meta(self, vmlinux): """returns the number of symbols that start with __syscall_meta__ this is a fast way to determine the number of system calls, but not the most accurate.""" return len( [sym for sym in self.context.symbol_space[vmlinux.name].symbols if sym.startswith("__syscall_meta__")]) def _get_table_info_other(self, table_addr, ptr_sz, vmlinux): table_size_meta = self._get_table_size_meta(vmlinux) table_size_syms = self._get_table_size_next_symbol(table_addr, ptr_sz, vmlinux) sizes = [size for size in [table_size_meta, table_size_syms] if size > 0] table_size = min(sizes) return table_size def _get_table_info_disassembly(self, ptr_sz, vmlinux): """Find the size of the system call table by disassembling functions that immediately reference it in their first isntruction This is in the form 'cmp reg,NR_syscalls'.""" table_size = 0 if not has_capstone: return table_size if ptr_sz == 4: syscall_entry_func = "sysenter_do_call" mode = capstone.CS_MODE_32 else: syscall_entry_func = "system_call_fastpath" mode = capstone.CS_MODE_64 md = capstone.Cs(capstone.CS_ARCH_X86, mode) try: func_addr = self.context.symbol_space.get_symbol(vmlinux.name + constants.BANG + syscall_entry_func).address except exceptions.SymbolError as e: # if we can't find the disassemble function then bail and rely on a different method return 0 data = self.context.layers.read(self.config['primary'], func_addr, 6) for (address, size, mnemonic, op_str) in md.disasm_lite(data, func_addr): if mnemonic == 'CMP': table_size = int(op_str.split(",")[1].strip()) & 0xffff break return table_size def _get_table_info(self, vmlinux, table_name, ptr_sz): table_sym = self.context.symbol_space.get_symbol(vmlinux.name + constants.BANG + table_name) table_size = self._get_table_info_disassembly(ptr_sz, vmlinux) if table_size == 0: table_size = self._get_table_info_other(table_sym.address, ptr_sz, vmlinux) if table_size == 0: vollog.error("Unable to get system call table size") return 0, 0 return table_sym.address, table_size # TODO - add finding and parsing unistd.h once cached file enumeration is added def _generator(self): vmlinux = contexts.Module(self.context, self.config['vmlinux'], self.config['primary'], 0) ptr_sz = vmlinux.get_type("pointer").size if ptr_sz == 4: table_name = "32bit" else: table_name = "64bit" try: table_info = self._get_table_info(vmlinux, "sys_call_table", ptr_sz) except exceptions.SymbolError: vollog.error("Unable to find the system call table. Exiting.") return tables = [(table_name, table_info)] # this table is only present on 64 bit systems with 32 bit emulation # enabled in order to support 32 bit programs and libraries # if the symbol isn't there then the support isn't in the kernel and so we skip it try: ia32_symbol = self.context.symbol_space.get_symbol(vmlinux.name + constants.BANG + "ia32_sys_call_table") except exceptions.SymbolError: ia32_symbol = None if ia32_symbol != None: ia32_info = self._get_table_info(vmlinux, "ia32_sys_call_table", ptr_sz) tables.append(("32bit", ia32_info)) for (table_name, (tableaddr, tblsz)) in tables: table = vmlinux.object(object_type = "array", subtype = vmlinux.get_type("pointer"), offset = tableaddr, count = tblsz) for (i, call_addr) in enumerate(table): if not call_addr: continue symbols = list(self.context.symbol_space.get_symbols_by_location(call_addr)) if len(symbols) > 0: sym_name = str(symbols[0].split(constants.BANG)[1]) if constants.BANG in symbols[0] else \ str(symbols[0]) else: sym_name = "UNKNOWN" yield (0, (format_hints.Hex(tableaddr), table_name, i, format_hints.Hex(call_addr), sym_name)) def run(self): return renderers.TreeGrid([("Table Address", format_hints.Hex), ("Table Name", str), ("Index", int), ("Handler Address", format_hints.Hex), ("Handler Symbol", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/linux/elfs.py000066400000000000000000000057521405267600400244140ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """A module containing a collection of plugins that produce data typically found in Linux's /proc file system.""" from typing import List from volatility3.framework import renderers, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility from volatility3.framework.renderers import format_hints from volatility3.plugins.linux import pslist class Elfs(plugins.PluginInterface): """Lists all memory mapped ELF files for all processes.""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, optional = True) ] def _generator(self, tasks): for task in tasks: proc_layer_name = task.add_process_layer() if not proc_layer_name: continue proc_layer = self.context.layers[proc_layer_name] name = utility.array_to_string(task.comm) for vma in task.mm.get_mmap_iter(): hdr = proc_layer.read(vma.vm_start, 4, pad = True) if not (hdr[0] == 0x7f and hdr[1] == 0x45 and hdr[2] == 0x4c and hdr[3] == 0x46): continue path = vma.get_name(self.context, task) yield (0, (task.pid, name, format_hints.Hex(vma.vm_start), format_hints.Hex(vma.vm_end), path)) def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), ("Start", format_hints.Hex), ("End", format_hints.Hex), ("File Path", str)], self._generator( pslist.PsList.list_tasks(self.context, self.config['primary'], self.config['vmlinux'], filter_func = filter_func))) volatility3-1.0.1/volatility3/framework/plugins/linux/keyboard_notifiers.py000066400000000000000000000055231405267600400273410ustar00rootroot00000000000000# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from volatility3.framework import interfaces, renderers, contexts, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import linux from volatility3.plugins.linux import lsmod vollog = logging.getLogger(__name__) class Keyboard_notifiers(interfaces.plugins.PluginInterface): """Parses the keyboard notifier call chain""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)), requirements.VersionRequirement(name = 'linuxutils', component = linux.LinuxUtilities, version = (1, 0, 0)) ] def _generator(self): vmlinux = contexts.Module(self.context, self.config['vmlinux'], self.config['primary'], 0) modules = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['vmlinux']) handlers = linux.LinuxUtilities.generate_kernel_handler_info(self.context, self.config['primary'], self.config['vmlinux'], modules) try: knl_addr = vmlinux.object_from_symbol("keyboard_notifier_list") except exceptions.SymbolError: knl_addr = None if not knl_addr: raise TypeError( "This plugin requires the keyboard_notifier_list structure. " "This structure is not present in the supplied symbol table. " "This means you are either analyzing an unsupported kernel version or that your symbol table is corrupt." ) knl = vmlinux.object(object_type = "atomic_notifier_head", offset = knl_addr.vol.offset) for call_back in linux.LinuxUtilities.walk_internal_list(vmlinux, "notifier_block", "next", knl.head): call_addr = call_back.notifier_call module_name, symbol_name = linux.LinuxUtilities.lookup_module_address(self.context, handlers, call_addr) yield (0, [format_hints.Hex(call_addr), module_name, symbol_name]) def run(self): return renderers.TreeGrid([("Address", format_hints.Hex), ("Module", str), ("Symbol", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/linux/lsmod.py000066400000000000000000000061511405267600400245730ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """A module containing a collection of plugins that produce data typically found in Linux's /proc file system.""" import logging from typing import List, Iterable from volatility3.framework import contexts from volatility3.framework import exceptions, renderers, constants, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) class Lsmod(plugins.PluginInterface): """Lists loaded kernel modules.""" _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols") ] @classmethod def list_modules(cls, context: interfaces.context.ContextInterface, layer_name: str, vmlinux_symbols: str) -> Iterable[interfaces.objects.ObjectInterface]: """Lists all the modules in the primary layer. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate vmlinux_symbols: The name of the table containing the kernel symbols Yields: The modules present in the `layer_name` layer's modules list This function will throw a SymbolError exception if kernel module support is not enabled. """ vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0) modules = vmlinux.object_from_symbol(symbol_name = "modules").cast("list_head") table_name = modules.vol.type_name.split(constants.BANG)[0] for module in modules.to_list(table_name + constants.BANG + "module", "list"): yield module def _generator(self): try: for module in self.list_modules(self.context, self.config['primary'], self.config['vmlinux']): mod_size = module.get_init_size() + module.get_core_size() mod_name = utility.array_to_string(module.name) yield 0, (format_hints.Hex(module.vol.offset), mod_name, mod_size) except exceptions.SymbolError: vollog.debug( "The required symbol 'module' is not present in symbol table. Please check that kernel modules are enabled for the system under analysis." ) def run(self): return renderers.TreeGrid([("Offset", format_hints.Hex), ("Name", str), ("Size", int)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/linux/lsof.py000066400000000000000000000057541405267600400244300ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """A module containing a collection of plugins that produce data typically found in Linux's /proc file system.""" import logging from typing import List from volatility3.framework import renderers, interfaces, constants from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility from volatility3.framework.symbols import linux from volatility3.plugins.linux import pslist vollog = logging.getLogger(__name__) class Lsof(plugins.PluginInterface): """Lists all memory maps for all processes.""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), requirements.VersionRequirement(name = 'linuxutils', component = linux.LinuxUtilities, version = (1, 0, 0)), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, optional = True) ] def _generator(self, tasks): symbol_table = None for task in tasks: if symbol_table is None: if constants.BANG not in task.vol.type_name: raise ValueError("Task is not part of a symbol table") symbol_table = task.vol.type_name.split(constants.BANG)[0] name = utility.array_to_string(task.comm) pid = int(task.pid) for fd_num, _, full_path in linux.LinuxUtilities.files_descriptors_for_process( self.context, symbol_table, task): yield (0, (pid, name, fd_num, full_path)) def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), ("FD", int), ("Path", str)], self._generator( pslist.PsList.list_tasks(self.context, self.config['primary'], self.config['vmlinux'], filter_func = filter_func))) volatility3-1.0.1/volatility3/framework/plugins/linux/malfind.py000066400000000000000000000072541405267600400250740ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from typing import List from volatility3.framework import constants, interfaces from volatility3.framework import renderers from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility from volatility3.framework.renderers import format_hints from volatility3.plugins.linux import pslist class Malfind(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, optional = True) ] def _list_injections(self, task): """Generate memory regions for a process that may contain injected code.""" proc_layer_name = task.add_process_layer() if not proc_layer_name: return proc_layer = self.context.layers[proc_layer_name] for vma in task.mm.get_mmap_iter(): if vma.is_suspicious() and vma.get_name(self.context, task) != "[vdso]": data = proc_layer.read(vma.vm_start, 64, pad = True) yield vma, data def _generator(self, tasks): # determine if we're on a 32 or 64 bit kernel if self.context.symbol_space.get_type(self.config["vmlinux"] + constants.BANG + "pointer").size == 4: is_32bit_arch = True else: is_32bit_arch = False for task in tasks: process_name = utility.array_to_string(task.comm) for vma, data in self._list_injections(task): if is_32bit_arch: architecture = "intel" else: architecture = "intel64" disasm = interfaces.renderers.Disassembly(data, vma.vm_start, architecture) yield (0, (task.pid, process_name, format_hints.Hex(vma.vm_start), format_hints.Hex(vma.vm_end), vma.get_protection(), format_hints.HexBytes(data), disasm)) def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), ("Start", format_hints.Hex), ("End", format_hints.Hex), ("Protection", str), ("Hexdump", format_hints.HexBytes), ("Disasm", interfaces.renderers.Disassembly)], self._generator( pslist.PsList.list_tasks(self.context, self.config['primary'], self.config['vmlinux'], filter_func = filter_func))) volatility3-1.0.1/volatility3/framework/plugins/linux/proc.py000066400000000000000000000066311405267600400244230ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """A module containing a collection of plugins that produce data typically found in Linux's /proc file system.""" from volatility3.framework import renderers from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility from volatility3.framework.renderers import format_hints from volatility3.plugins.linux import pslist class Maps(plugins.PluginInterface): """Lists all memory maps for all processes.""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, optional = True) ] def _generator(self, tasks): for task in tasks: if not task.mm: continue name = utility.array_to_string(task.comm) for vma in task.mm.get_mmap_iter(): flags = vma.get_protection() page_offset = vma.get_page_offset() major = 0 minor = 0 inode = 0 if vma.vm_file != 0: dentry = vma.vm_file.get_dentry() if dentry != 0: inode_object = dentry.d_inode major = inode_object.i_sb.major minor = inode_object.i_sb.minor inode = inode_object.i_ino path = vma.get_name(self.context, task) yield (0, (task.pid, name, format_hints.Hex(vma.vm_start), format_hints.Hex(vma.vm_end), flags, format_hints.Hex(page_offset), major, minor, inode, path)) def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), ("Start", format_hints.Hex), ("End", format_hints.Hex), ("Flags", str), ("PgOff", format_hints.Hex), ("Major", int), ("Minor", int), ("Inode", int), ("File Path", str)], self._generator( pslist.PsList.list_tasks(self.context, self.config['primary'], self.config['vmlinux'], filter_func = filter_func))) volatility3-1.0.1/volatility3/framework/plugins/linux/pslist.py000066400000000000000000000071041405267600400247720ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from typing import Callable, Iterable, List, Any from volatility3.framework import renderers, interfaces, contexts from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility class PsList(interfaces.plugins.PluginInterface): """Lists the processes present in a particular linux memory image.""" _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, optional = True) ] @classmethod def create_pid_filter(cls, pid_list: List[int] = None) -> Callable[[Any], bool]: """Constructs a filter function for process IDs. Args: pid_list: List of process IDs that are acceptable (or None if all are acceptable) Returns: Function which, when provided a process object, returns True if the process is to be filtered out of the list """ # FIXME: mypy #4973 or #2608 pid_list = pid_list or [] filter_list = [x for x in pid_list if x is not None] if filter_list: def filter_func(x): return x.pid not in filter_list return filter_func else: return lambda _: False def _generator(self): for task in self.list_tasks(self.context, self.config['primary'], self.config['vmlinux'], filter_func = self.create_pid_filter(self.config.get('pid', None))): pid = task.pid ppid = 0 if task.parent: ppid = task.parent.pid name = utility.array_to_string(task.comm) yield (0, (pid, ppid, name)) @classmethod def list_tasks( cls, context: interfaces.context.ContextInterface, layer_name: str, vmlinux_symbols: str, filter_func: Callable[[int], bool] = lambda _: False) -> Iterable[interfaces.objects.ObjectInterface]: """Lists all the tasks in the primary layer. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate vmlinux_symbols: The name of the table containing the kernel symbols Yields: Process objects """ vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0) init_task = vmlinux.object_from_symbol(symbol_name = "init_task") for task in init_task.tasks: if not filter_func(task): yield task def run(self): return renderers.TreeGrid([("PID", int), ("PPID", int), ("COMM", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/linux/pstree.py000066400000000000000000000036221405267600400247570ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from volatility3.framework.objects import utility from volatility3.plugins.linux import pslist class PsTree(pslist.PsList): """Plugin for listing processes in a tree based on their parent process ID.""" _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self._processes = {} self._levels = {} self._children = {} def find_level(self, pid): """Finds how deep the pid is in the processes list.""" seen = set([]) seen.add(pid) level = 0 proc = self._processes.get(pid, None) while proc is not None and proc.parent != 0 and proc.parent.pid not in seen: ppid = int(proc.parent.pid) child_list = self._children.get(ppid, set([])) child_list.add(proc.pid) self._children[ppid] = child_list proc = self._processes.get(ppid, None) level += 1 self._levels[pid] = level def _generator(self): """Generates the.""" for proc in self.list_tasks(self.context, self.config['primary'], self.config['vmlinux']): self._processes[proc.pid] = proc # Build the child/level maps for pid in self._processes: self.find_level(pid) def yield_processes(pid): proc = self._processes[pid] row = (proc.pid, proc.parent.pid, utility.array_to_string(proc.comm)) yield (self._levels[pid] - 1, row) for child_pid in self._children.get(pid, []): yield from yield_processes(child_pid) for pid in self._levels: if self._levels[pid] == 1: yield from yield_processes(pid) volatility3-1.0.1/volatility3/framework/plugins/linux/tty_check.py000066400000000000000000000070041405267600400254300ustar00rootroot00000000000000# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import List from volatility3.framework import interfaces, renderers, exceptions, constants, contexts from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import linux from volatility3.plugins.linux import lsmod vollog = logging.getLogger(__name__) class tty_check(plugins.PluginInterface): """Checks tty devices for hooks""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)), requirements.VersionRequirement(name = 'linuxutils', component = linux.LinuxUtilities, version = (1, 0, 0)) ] def _generator(self): vmlinux = contexts.Module(self.context, self.config['vmlinux'], self.config['primary'], 0) modules = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['vmlinux']) handlers = linux.LinuxUtilities.generate_kernel_handler_info(self.context, self.config['primary'], self.config['vmlinux'], modules) try: tty_drivers = vmlinux.object_from_symbol("tty_drivers") except exceptions.SymbolError: tty_drivers = None if not tty_drivers: raise TypeError( "This plugin requires the tty_drivers structure." "This structure is not present in the supplied symbol table." "This means you are either analyzing an unsupported kernel version or that your symbol table is corrupt." ) for tty in tty_drivers.to_list(vmlinux.name + constants.BANG + "tty_driver", "tty_drivers"): try: ttys = utility.array_of_pointers(tty.ttys.dereference(), count = tty.num, subtype = vmlinux.name + constants.BANG + "tty_struct", context = self.context) except exceptions.PagedInvalidAddressException: continue for tty_dev in ttys: if tty_dev == 0: continue name = utility.array_to_string(tty_dev.name) recv_buf = tty_dev.ldisc.ops.receive_buf module_name, symbol_name = linux.LinuxUtilities.lookup_module_address(self.context, handlers, recv_buf) yield (0, (name, format_hints.Hex(recv_buf), module_name, symbol_name)) def run(self): return renderers.TreeGrid([("Name", str), ("Address", format_hints.Hex), ("Module", str), ("Symbol", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/mac/000077500000000000000000000000001405267600400225015ustar00rootroot00000000000000volatility3-1.0.1/volatility3/framework/plugins/mac/__init__.py000066400000000000000000000000001405267600400246000ustar00rootroot00000000000000volatility3-1.0.1/volatility3/framework/plugins/mac/bash.py000066400000000000000000000127651405267600400240030ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """A module containing a collection of plugins that produce data typically found in mac's /proc file system.""" import datetime import struct from volatility3.framework import constants, renderers, symbols from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.layers import scanners from volatility3.framework.objects import utility from volatility3.framework.symbols.linux.bash import BashIntermedSymbols from volatility3.plugins import timeliner from volatility3.plugins.mac import pslist class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): """Recovers bash command history from memory.""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, optional = True) ] def _generator(self, tasks): is_32bit = not symbols.symbol_table_is_64bit(self.context, self.config["darwin"]) if is_32bit: pack_format = "I" bash_json_file = "bash32" else: pack_format = "Q" bash_json_file = "bash64" bash_table_name = BashIntermedSymbols.create(self.context, self.config_path, "linux", bash_json_file) ts_offset = self.context.symbol_space.get_type(bash_table_name + constants.BANG + "hist_entry").relative_child_offset("timestamp") for task in tasks: task_name = utility.array_to_string(task.p_comm) if task_name not in ["bash", "sh", "dash"]: continue proc_layer_name = task.add_process_layer() if proc_layer_name is None: continue proc_layer = self.context.layers[proc_layer_name] bang_addrs = [] # find '#' values on the heap for address in proc_layer.scan(self.context, scanners.BytesScanner(b"#"), sections = task.get_process_memory_sections(self.context, self.config['darwin'], rw_no_file = True)): bang_addrs.append(struct.pack(pack_format, address)) history_entries = [] for address, _ in proc_layer.scan(self.context, scanners.MultiStringScanner(bang_addrs), sections = task.get_process_memory_sections(self.context, self.config['darwin'], rw_no_file = True)): hist = self.context.object(bash_table_name + constants.BANG + "hist_entry", offset = address - ts_offset, layer_name = proc_layer_name) if hist.is_valid(): history_entries.append(hist) for hist in sorted(history_entries, key = lambda x: x.get_time_as_integer()): yield (0, (int(task.p_pid), task_name, hist.get_time_object(), hist.get_command())) def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) list_tasks = pslist.PsList.get_list_tasks(self.config.get('pslist_method', pslist.PsList.pslist_methods[0])) return renderers.TreeGrid([("PID", int), ("Process", str), ("CommandTime", datetime.datetime), ("Command", str)], self._generator( list_tasks(self.context, self.config['primary'], self.config['darwin'], filter_func = filter_func))) def generate_timeline(self): filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) list_tasks = pslist.PsList.get_list_tasks(self.config.get('pslist_method', pslist.PsList.pslist_methods[0])) for row in self._generator( list_tasks(self.context, self.config['primary'], self.config['darwin'], filter_func = filter_func)): _depth, row_data = row description = "{} ({}): \"{}\"".format(row_data[0], row_data[1], row_data[3]) yield (description, timeliner.TimeLinerType.CREATED, row_data[2]) volatility3-1.0.1/volatility3/framework/plugins/mac/check_syscall.py000066400000000000000000000056001405267600400256630ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import List from volatility3.framework import exceptions, interfaces from volatility3.framework import renderers, contexts from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import mac from volatility3.plugins.mac import lsmod vollog = logging.getLogger(__name__) class Check_syscall(plugins.PluginInterface): """Check system call table for hooks.""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"), requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)), requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)) ] def _generator(self): kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0) mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin']) handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods) nsysent = kernel.object_from_symbol(symbol_name = "nsysent") table = kernel.object_from_symbol(symbol_name = "sysent") # smear help num_ents = min(nsysent, table.count) if num_ents > 1024: num_ents = 1024 for (i, ent) in enumerate(table): try: call_addr = ent.sy_call.dereference().vol.offset except exceptions.InvalidAddressException: continue if not call_addr or call_addr == 0: continue module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, call_addr) yield (0, (format_hints.Hex(table.vol.offset), "SysCall", i, format_hints.Hex(call_addr), module_name, symbol_name)) def run(self): return renderers.TreeGrid([("Table Address", format_hints.Hex), ("Table Name", str), ("Index", int), ("Handler Address", format_hints.Hex), ("Handler Module", str), ("Handler Symbol", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/mac/check_sysctl.py000066400000000000000000000123731405267600400255370ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import List import volatility3 from volatility3.framework import exceptions, interfaces from volatility3.framework import renderers, contexts from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import mac from volatility3.plugins.mac import lsmod vollog = logging.getLogger(__name__) class Check_sysctl(plugins.PluginInterface): """Check sysctl handlers for hooks.""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"), requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)), requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)) ] def _parse_global_variable_sysctls(self, kernel, name): known_sysctls = { "hostname": "hostname", "nisdomainname": "domainname", } var_str = "" if name in known_sysctls: var_name = known_sysctls[name] try: var_array = kernel.object_from_symbol(symbol_name = var_name) except exceptions.SymbolError: var_array = None if var_array is not None: var_str = utility.array_to_string(var_array) return var_str def _process_sysctl_list(self, kernel, sysctl_list, recursive = 0): if type(sysctl_list) == volatility3.framework.objects.Pointer: sysctl_list = sysctl_list.dereference().cast("sysctl_oid_list") sysctl = sysctl_list.slh_first if recursive != 0: try: sysctl = sysctl.oid_link.sle_next.dereference() except exceptions.InvalidAddressException: return while sysctl: try: name = utility.pointer_to_string(sysctl.oid_name, 128) except exceptions.InvalidAddressException: name = "" if len(name) == 0: break ctltype = sysctl.get_ctltype() try: arg1_ptr = sysctl.oid_arg1.dereference().vol.offset except exceptions.InvalidAddressException: arg1_ptr = 0 arg1 = sysctl.oid_arg1 if arg1 == 0 or arg1_ptr == 0: val = self._parse_global_variable_sysctls(kernel, name) elif ctltype == 'CTLTYPE_NODE': if sysctl.oid_handler == 0: for info in self._process_sysctl_list(kernel, sysctl.oid_arg1, recursive = 1): yield info val = "Node" elif ctltype in ['CTLTYPE_INT', 'CTLTYPE_QUAD', 'CTLTYPE_OPAQUE']: try: val = str(arg1.dereference().cast("int")) except exceptions.InvalidAddressException: val = "-1" elif ctltype == 'CTLTYPE_STRING': try: val = utility.pointer_to_string(sysctl.oid_arg1, 64) except exceptions.InvalidAddressException: val = "" else: val = ctltype yield (sysctl, name, val) try: sysctl = sysctl.oid_link.sle_next except exceptions.InvalidAddressException: break def _generator(self): kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0) mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin']) handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods) sysctl_list = kernel.object_from_symbol(symbol_name = "sysctl__children") for sysctl, name, val in self._process_sysctl_list(kernel, sysctl_list): try: check_addr = sysctl.oid_handler except exceptions.InvalidAddressException: continue module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, check_addr) yield (0, (name, sysctl.oid_number, sysctl.get_perms(), format_hints.Hex(check_addr), val, module_name, symbol_name)) def run(self): return renderers.TreeGrid([("Name", str), ("Number", int), ("Perms", str), ("Handler Address", format_hints.Hex), ("Value", str), ("Handler Module", str), ("Handler Symbol", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/mac/check_trap_table.py000066400000000000000000000053271405267600400263340ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import List from volatility3.framework import exceptions, interfaces from volatility3.framework import renderers, contexts from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import mac from volatility3.plugins.mac import lsmod vollog = logging.getLogger(__name__) class Check_trap_table(plugins.PluginInterface): """Check mach trap table for hooks.""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"), requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)), requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)), ] def _generator(self): kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0) mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin']) handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods) table = kernel.object_from_symbol(symbol_name = "mach_trap_table") for i, ent in enumerate(table): try: call_addr = ent.mach_trap_function.dereference().vol.offset except exceptions.InvalidAddressException: continue if not call_addr or call_addr == 0: continue module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, call_addr) yield (0, (format_hints.Hex(table.vol.offset), "TrapTable", i, format_hints.Hex(call_addr), module_name, symbol_name)) def run(self): return renderers.TreeGrid([("Table Address", format_hints.Hex), ("Table Name", str), ("Index", int), ("Handler Address", format_hints.Hex), ("Handler Module", str), ("Handler Symbol", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/mac/ifconfig.py000066400000000000000000000044361405267600400246460ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from volatility3.framework import exceptions, renderers, contexts from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility from volatility3.framework.symbols import mac class Ifconfig(plugins.PluginInterface): """Lists loaded kernel modules""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"), requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)) ] def _generator(self): kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0) try: list_head = kernel.object_from_symbol(symbol_name = "ifnet_head") except exceptions.SymbolError: list_head = kernel.object_from_symbol(symbol_name = "dlil_ifnet_head") for ifnet in mac.MacUtilities.walk_tailq(list_head, "if_link"): name = utility.pointer_to_string(ifnet.if_name, 32) unit = ifnet.if_unit prom = ifnet.if_flags & 0x100 == 0x100 # IFF_PROMISC sock_addr_dl = ifnet.sockaddr_dl() if sock_addr_dl is None: mac_addr = renderers.UnreadableValue() else: mac_addr = str(sock_addr_dl) for ifaddr in mac.MacUtilities.walk_tailq(ifnet.if_addrhead, "ifa_link"): ip = ifaddr.ifa_addr.get_address() yield (0, ("{0}{1}".format(name, unit), ip, mac_addr, prom)) def run(self): return renderers.TreeGrid([("Interface", str), ("IP Address", str), ("Mac Address", str), ("Promiscuous", bool)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/mac/kauth_listeners.py000066400000000000000000000055261405267600400262670ustar00rootroot00000000000000# This file is opyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from volatility3.framework import renderers, interfaces, contexts from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import mac from volatility3.plugins.mac import lsmod, kauth_scopes class Kauth_listeners(interfaces.plugins.PluginInterface): """ Lists kauth listeners and their status """ _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel"), requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 1, 0)), requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)), requirements.PluginRequirement(name = 'kauth_scopes', plugin = kauth_scopes.Kauth_scopes, version = (1, 0, 0)) ] def _generator(self): """ Enumerates the listeners for each kauth scope """ kernel = contexts.Module(self.context, self.config['darwin'], self.config['primary'], 0) mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin']) handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods) for scope in kauth_scopes.Kauth_scopes.list_kauth_scopes(self.context, self.config['primary'], self.config['darwin']): scope_name = utility.pointer_to_string(scope.ks_identifier, 128) for listener in scope.get_listeners(): callback = listener.kll_callback if callback == 0: continue module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, callback) yield (0, (scope_name, format_hints.Hex(listener.kll_idata), format_hints.Hex(callback), module_name, symbol_name)) def run(self): return renderers.TreeGrid([("Name", str), ("IData", format_hints.Hex), ("Callback Address", format_hints.Hex), ("Module", str), ("Symbol", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/mac/kauth_scopes.py000066400000000000000000000065601405267600400255520ustar00rootroot00000000000000# This file is opyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from typing import Iterable, Callable, Tuple from volatility3.framework import renderers, interfaces, contexts from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import mac from volatility3.plugins.mac import lsmod class Kauth_scopes(interfaces.plugins.PluginInterface): """ Lists kauth scopes and their status """ _version = (1, 0, 0) _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel"), requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 1, 0)), requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)) ] @classmethod def list_kauth_scopes(cls, context: interfaces.context.ContextInterface, layer_name: str, darwin_symbols: str, filter_func: Callable[[int], bool] = lambda _: False) -> \ Iterable[Tuple[interfaces.objects.ObjectInterface, interfaces.objects.ObjectInterface, interfaces.objects.ObjectInterface]]: """ Enumerates the registered kauth scopes and yields each object Uses smear-safe enumeration API """ kernel = contexts.Module(context, darwin_symbols, layer_name, 0) scopes = kernel.object_from_symbol("kauth_scopes") for scope in mac.MacUtilities.walk_tailq(scopes, "ks_link"): yield scope def _generator(self): kernel = contexts.Module(self.context, self.config['darwin'], self.config['primary'], 0) mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin']) handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods) for scope in self.list_kauth_scopes(self.context, self.config['primary'], self.config['darwin']): callback = scope.ks_callback if callback == 0: continue module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, callback) identifier = utility.pointer_to_string(scope.ks_identifier, 128) yield (0, (identifier, format_hints.Hex(scope.ks_idata), len([l for l in scope.get_listeners()]), format_hints.Hex(callback), module_name, symbol_name)) def run(self): return renderers.TreeGrid([("Name", str), ("IData", format_hints.Hex), ("Listeners", int), ("Callback Address", format_hints.Hex), ("Module", str), ("Symbol", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/mac/kevents.py000066400000000000000000000153101405267600400245320ustar00rootroot00000000000000# This file is opyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from typing import Iterable, Callable, Tuple from volatility3.framework import renderers, interfaces, exceptions, contexts from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility from volatility3.framework.symbols import mac from volatility3.plugins.mac import pslist class Kevents(interfaces.plugins.PluginInterface): """ Lists event handlers registered by processes """ _required_framework_version = (1, 0, 0) event_types = { 1: "EVFILT_READ", 2: "EVFILT_WRITE", 3: "EVFILT_AIO", 4: "EVFILT_VNODE", 5: "EVFILT_PROC", 6: "EVFILT_SIGNAL", 7: "EVFILT_TIMER", 8: "EVFILT_MACHPORT", 9: "EVFILT_FS", 10: "EVFILT_USER", 12: "EVFILT_VM" } vnode_filters = [("NOTE_DELETE", 1), ("NOTE_WRITE", 2), ("NOTE_EXTEND", 4), ("NOTE_ATTRIB", 8), ("NOTE_LINK", 0x10), ("NOTE_RENAME", 0x20), ("NOTE_REVOKE", 0x40)] proc_filters = [("NOTE_EXIT", 0x80000000), ("NOTE_EXITSTATUS", 0x04000000), ("NOTE_FORK", 0x40000000), ("NOTE_EXEC", 0x20000000), ("NOTE_SIGNAL", 0x08000000), ("NOTE_REAP", 0x10000000)] timer_filters = [("NOTE_SECONDS", 1), ("NOTE_USECONDS", 2), ("NOTE_NSECONDS", 4), ("NOTE_ABSOLUTE", 8)] all_filters = { 4: vnode_filters, # EVFILT_VNODE 5: proc_filters, # EVFILT_PROC 7: timer_filters # EVFILT_TIMER } @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 2, 0)), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, optional = True) ] def _parse_flags(self, filter_index, filter_flags): if filter_flags == 0 or filter_index not in self.all_filters: return "" context = [] filters = self.all_filters[filter_index] for flag, index in filters: if filter_flags & index == index: context.append(flag) return ",".join(context) @classmethod def _walk_klist_array(cls, kernel, fdp, array_pointer_member, array_size_member): """ Convience wrapper for walking an array of lists of kernel events Handles invalid address references """ try: klist_array_pointer = getattr(fdp, array_pointer_member) array_size = getattr(fdp, array_size_member) klist_array = kernel.object(object_type = "array", offset = klist_array_pointer, count = array_size + 1, subtype = kernel.get_type("klist")) except exceptions.InvalidAddressException: return for klist in klist_array: for kn in mac.MacUtilities.walk_slist(klist, "kn_link"): yield kn @classmethod def _get_task_kevents(cls, kernel, task): """ Enumerates event filters per task. Uses smear-safe APIs throughout as these data structures see a signifcant amount of smear """ fdp = task.p_fd for kn in cls._walk_klist_array(kernel, fdp, "fd_knlist", "fd_knlistsize"): yield kn for kn in cls._walk_klist_array(kernel, fdp, "fd_knhash", "fd_knhashmask"): yield kn try: p_klist = task.p_klist except exceptions.InvalidAddressException: return for kn in mac.MacUtilities.walk_slist(p_klist, "kn_link"): yield kn @classmethod def list_kernel_events(cls, context: interfaces.context.ContextInterface, layer_name: str, darwin_symbols: str, filter_func: Callable[[int], bool] = lambda _: False) -> \ Iterable[Tuple[interfaces.objects.ObjectInterface, interfaces.objects.ObjectInterface, interfaces.objects.ObjectInterface]]: """ Returns the kernel event filters registered Return values: A tuple of 3 elements: 1) The name of the process that registered the filter 2) The process ID of the process that registered the filter 3) The object of the associated kernel event filter """ kernel = contexts.Module(context, darwin_symbols, layer_name, 0) list_tasks = pslist.PsList.get_list_tasks(pslist.PsList.pslist_methods[0]) for task in list_tasks(context, layer_name, darwin_symbols, filter_func): task_name = utility.array_to_string(task.p_comm) pid = task.p_pid for kn in cls._get_task_kevents(kernel, task): yield task_name, pid, kn def _generator(self): filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) for task_name, pid, kn in self.list_kernel_events(self.context, self.config['primary'], self.config['darwin'], filter_func = filter_func): filter_index = kn.kn_kevent.filter * -1 if filter_index in self.event_types: filter_name = self.event_types[filter_index] else: continue try: ident = kn.kn_kevent.ident except exceptions.InvalidAddressException: continue context = self._parse_flags(filter_index, kn.kn_sfflags) yield (0, (pid, task_name, ident, filter_name, context)) def run(self): return renderers.TreeGrid([("PID", int), ("Process", str), ("Ident", int), ("Filter", str), ("Context", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/mac/list_files.py000066400000000000000000000133621405267600400252150ustar00rootroot00000000000000# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import Iterable, Optional from volatility3.framework import renderers, interfaces, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import mac from volatility3.plugins.mac import mount vollog = logging.getLogger(__name__) class List_Files(plugins.PluginInterface): """Lists all open file descriptors for all processes.""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac Kernel"), requirements.PluginRequirement(name = 'mount', plugin = mount.Mount, version = (1, 0, 0)), ] @classmethod def _vnode_name(cls, vnode: interfaces.objects.ObjectInterface) -> Optional[str]: # roots of mount points have special name handling if vnode.v_flag & 1 == 1: v_name = vnode.full_path() else: try: v_name = utility.pointer_to_string(vnode.v_name, 255) except exceptions.InvalidAddressException: v_name = None return v_name @classmethod def _get_parent(cls, vnode): parent = None # root entries do not have parents # and parents of normal files can be smeared try: parent = vnode.v_parent except exceptions.InvalidAddressException: pass return parent @classmethod def _add_vnode(cls, vnode, loop_vnodes): """ Adds the given vnode to loop_vnodes. loop_vnodes is key off the address of a vnode and holds its name, parent address, and object """ key = vnode added = False if not key in loop_vnodes: # We can't do anything with a no-name vnode v_name = cls._vnode_name(vnode) if v_name is None: return added parent = cls._get_parent(vnode) if parent: parent_val = parent else: parent_val = None loop_vnodes[key] = (v_name, parent_val, vnode) added = True return added @classmethod def _walk_vnode(cls, vnode, loop_vnodes): """ Iterates over the list of vnodes associated with the given one. Also traverses the parent chain for the vnode and adds each one. """ while vnode: if not cls._add_vnode(vnode, loop_vnodes): break parent = cls._get_parent(vnode) while parent: cls._walk_vnode(parent, loop_vnodes) parent = cls._get_parent(parent) try: vnode = vnode.v_mntvnodes.tqe_next except exceptions.InvalidAddressException: break @classmethod def _walk_vnodelist(cls, list_head, loop_vnodes): for vnode in mac.MacUtilities.walk_tailq(list_head, "v_mntvnodes"): cls._walk_vnode(vnode, loop_vnodes) @classmethod def _walk_mounts(cls, context: interfaces.context.ContextInterface, layer_name: str, darwin_symbols: str) -> \ Iterable[interfaces.objects.ObjectInterface]: loop_vnodes = {} # iterate each vnode source from each mount list_mounts = mount.Mount.list_mounts(context, layer_name, darwin_symbols) for mnt in list_mounts: cls._walk_vnodelist(mnt.mnt_vnodelist, loop_vnodes) cls._walk_vnodelist(mnt.mnt_workerqueue, loop_vnodes) cls._walk_vnodelist(mnt.mnt_newvnodes, loop_vnodes) cls._walk_vnode(mnt.mnt_vnodecovered, loop_vnodes) cls._walk_vnode(mnt.mnt_realrootvp, loop_vnodes) cls._walk_vnode(mnt.mnt_devvp, loop_vnodes) return loop_vnodes @classmethod def _build_path(cls, vnodes, vnode_name, parent_offset): path = [vnode_name] while parent_offset in vnodes: parent_name, parent_offset, _ = vnodes[parent_offset] if parent_offset is None: parent_offset = 0 path.insert(0, parent_name) if len(path) > 1: path = "/".join(path) else: path = vnode_name if path.startswith("//"): path = path[1:] return path @classmethod def list_files(cls, context: interfaces.context.ContextInterface, layer_name: str, darwin_symbols: str) -> \ Iterable[interfaces.objects.ObjectInterface]: vnodes = cls._walk_mounts(context, layer_name, darwin_symbols) for voff, (vnode_name, parent_offset, vnode) in vnodes.items(): full_path = cls._build_path(vnodes, vnode_name, parent_offset) yield vnode, full_path def _generator(self): for vnode, full_path in self.list_files(self.context, self.config['primary'], self.config['darwin']): yield (0, (format_hints.Hex(vnode), full_path)) def run(self): return renderers.TreeGrid([("Address", format_hints.Hex), ("File Path", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/mac/lsmod.py000066400000000000000000000046501405267600400241760ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """A module containing a collection of plugins that produce data typically found in Mac's lsmod command.""" from volatility3.framework import renderers, interfaces, contexts from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility from volatility3.framework.renderers import format_hints class Lsmod(plugins.PluginInterface): """Lists loaded kernel modules.""" _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel") ] @classmethod def list_modules(cls, context: interfaces.context.ContextInterface, layer_name: str, darwin_symbols: str): """Lists all the modules in the primary layer. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate darwin_symbols: The name of the table containing the kernel symbols Returns: A list of modules from the `layer_name` layer """ kernel = contexts.Module(context, darwin_symbols, layer_name, 0) kmod_ptr = kernel.object_from_symbol(symbol_name = "kmod") # TODO - use smear-proof list walking API after dev release kmod = kmod_ptr.dereference().cast("kmod_info") while kmod != 0: yield kmod kmod = kmod.next def _generator(self): for module in self.list_modules(self.context, self.config['primary'], self.config['darwin']): mod_name = utility.array_to_string(module.name) mod_size = module.size yield 0, (format_hints.Hex(module.vol.offset), mod_name, mod_size) def run(self): return renderers.TreeGrid([("Offset", format_hints.Hex), ("Name", str), ("Size", int)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/mac/lsof.py000066400000000000000000000050501405267600400240160ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from volatility3.framework import renderers from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.symbols import mac from volatility3.plugins.mac import pslist vollog = logging.getLogger(__name__) class Lsof(plugins.PluginInterface): """Lists all open file descriptors for all processes.""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac Kernel"), requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, optional = True) ] def _generator(self, tasks): for task in tasks: pid = task.p_pid for _, filepath, fd in mac.MacUtilities.files_descriptors_for_process(self.context, self.config['darwin'], task): if filepath and len(filepath) > 0: yield (0, (pid, fd, filepath)) def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) list_tasks = pslist.PsList.get_list_tasks(self.config.get('pslist_method', pslist.PsList.pslist_methods[0])) return renderers.TreeGrid([("PID", int), ("File Descriptor", int), ("File Path", str)], self._generator( list_tasks(self.context, self.config['primary'], self.config['darwin'], filter_func = filter_func))) volatility3-1.0.1/volatility3/framework/plugins/mac/malfind.py000066400000000000000000000072541405267600400244750ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from volatility3.framework import constants from volatility3.framework import interfaces from volatility3.framework import renderers from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility from volatility3.framework.renderers import format_hints from volatility3.plugins.mac import pslist class Malfind(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, optional = True) ] def _list_injections(self, task): """Generate memory regions for a process that may contain injected code.""" proc_layer_name = task.add_process_layer() if proc_layer_name is None: return proc_layer = self.context.layers[proc_layer_name] for vma in task.get_map_iter(): if not vma.is_suspicious(self.context, self.config['darwin']): data = proc_layer.read(vma.links.start, 64, pad = True) yield vma, data def _generator(self, tasks): # determine if we're on a 32 or 64 bit kernel if self.context.symbol_space.get_type(self.config["darwin"] + constants.BANG + "pointer").size == 4: is_32bit_arch = True else: is_32bit_arch = False for task in tasks: process_name = utility.array_to_string(task.p_comm) for vma, data in self._list_injections(task): if is_32bit_arch: architecture = "intel" else: architecture = "intel64" disasm = interfaces.renderers.Disassembly(data, vma.links.start, architecture) yield (0, (task.p_pid, process_name, format_hints.Hex(vma.links.start), format_hints.Hex(vma.links.end), vma.get_perms(), format_hints.HexBytes(data), disasm)) def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) list_tasks = pslist.PsList.get_list_tasks(self.config.get('pslist_method', pslist.PsList.pslist_methods[0])) return renderers.TreeGrid([("PID", int), ("Process", str), ("Start", format_hints.Hex), ("End", format_hints.Hex), ("Protection", str), ("Hexdump", format_hints.HexBytes), ("Disasm", interfaces.renderers.Disassembly)], self._generator( list_tasks(self.context, self.config['primary'], self.config['darwin'], filter_func = filter_func))) volatility3-1.0.1/volatility3/framework/plugins/mac/mount.py000066400000000000000000000052061405267600400242200ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """A module containing a collection of plugins that produce data typically found in Mac's mount command.""" from volatility3.framework import renderers, interfaces, contexts from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility from volatility3.framework.symbols import mac class Mount(plugins.PluginInterface): """A module containing a collection of plugins that produce data typically foundin Mac's mount command""" _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)), requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols") ] @classmethod def list_mounts(cls, context: interfaces.context.ContextInterface, layer_name: str, darwin_symbols: str): """Lists all the mount structures in the primary layer. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate darwin_symbols: The name of the table containing the kernel symbols Returns: A list of mount structures from the `layer_name` layer """ kernel = contexts.Module(context, darwin_symbols, layer_name, 0) list_head = kernel.object_from_symbol(symbol_name = "mountlist") for mount in mac.MacUtilities.walk_tailq(list_head, "mnt_list"): yield mount def _generator(self): for mount in self.list_mounts(self.context, self.config['primary'], self.config['darwin']): vfs = mount.mnt_vfsstat device_name = utility.array_to_string(vfs.f_mntonname) mount_point = utility.array_to_string(vfs.f_mntfromname) mount_type = utility.array_to_string(vfs.f_fstypename) yield 0, (device_name, mount_point, mount_type) def run(self): return renderers.TreeGrid([("Device", str), ("Mount Point", str), ("Type", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/mac/netstat.py000066400000000000000000000120021405267600400245300ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import Iterable, Callable, Tuple from volatility3.framework import exceptions, renderers, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import mac from volatility3.plugins.mac import pslist vollog = logging.getLogger(__name__) class Netstat(plugins.PluginInterface): """Lists all network connections for all processes.""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac Kernel"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, optional = True) ] @classmethod def list_sockets(cls, context: interfaces.context.ContextInterface, layer_name: str, darwin_symbols: str, filter_func: Callable[[int], bool] = lambda _: False) -> \ Iterable[Tuple[interfaces.objects.ObjectInterface, interfaces.objects.ObjectInterface, interfaces.objects.ObjectInterface]]: """ Returns the open socket descriptors of a process Return values: A tuple of 3 elements: 1) The name of the process that opened the socket 2) The process ID of the processed that opened the socket 3) The address of the associated socket structure """ # This is hardcoded, since a change in the default method would change the expected results list_tasks = pslist.PsList.get_list_tasks(pslist.PsList.pslist_methods[0]) for task in list_tasks(context, layer_name, darwin_symbols, filter_func): task_name = utility.array_to_string(task.p_comm) pid = task.p_pid for filp, _, _ in mac.MacUtilities.files_descriptors_for_process(context, darwin_symbols, task): try: ftype = filp.f_fglob.get_fg_type() except exceptions.InvalidAddressException: continue if ftype != 'SOCKET': continue try: socket = filp.f_fglob.fg_data.dereference().cast("socket") except exceptions.InvalidAddressException: continue yield task_name, pid, socket def _generator(self): filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) for task_name, pid, socket in self.list_sockets(self.context, self.config['primary'], self.config['darwin'], filter_func = filter_func): family = socket.get_family() if family == 1: try: upcb = socket.so_pcb.dereference().cast("unpcb") path = utility.array_to_string(upcb.unp_addr.sun_path) except exceptions.InvalidAddressException: continue yield (0, (format_hints.Hex(socket.vol.offset), "UNIX", path, 0, "", 0, "", "{}/{:d}".format(task_name, pid))) elif family in [2, 30]: state = socket.get_state() proto = socket.get_protocol_as_string() vals = socket.get_converted_connection_info() if vals: (lip, lport, rip, rport) = vals yield (0, (format_hints.Hex(socket.vol.offset), proto, lip, lport, rip, rport, state, "{}/{:d}".format(task_name, pid))) def run(self): return renderers.TreeGrid([("Offset", format_hints.Hex), ("Proto", str), ("Local IP", str), ("Local Port", int), ("Remote IP", str), ("Remote Port", int), ("State", str), ("Process", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/mac/proc_maps.py000066400000000000000000000052431405267600400250420ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from volatility3.framework import renderers, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility from volatility3.framework.renderers import format_hints from volatility3.plugins.mac import pslist class Maps(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, optional = True) ] def _generator(self, tasks): for task in tasks: process_name = utility.array_to_string(task.p_comm) process_pid = task.p_pid for vma in task.get_map_iter(): path = vma.get_path(self.context, self.config['darwin']) if path == "": path = vma.get_special_path() yield (0, (process_pid, process_name, format_hints.Hex(vma.links.start), format_hints.Hex(vma.links.end), vma.get_perms(), path)) def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) list_tasks = pslist.PsList.get_list_tasks(self.config.get('pslist_method', pslist.PsList.pslist_methods[0])) return renderers.TreeGrid([("PID", int), ("Process", str), ("Start", format_hints.Hex), ("End", format_hints.Hex), ("Protection", str), ("Map Name", str)], self._generator( list_tasks(self.context, self.config['primary'], self.config['darwin'], filter_func = filter_func))) volatility3-1.0.1/volatility3/framework/plugins/mac/psaux.py000066400000000000000000000102621405267600400242140ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """In-memory artifacts from OSX systems.""" from typing import Iterator, Tuple, Any, Generator, List from volatility3.framework import exceptions, renderers, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility from volatility3.plugins.mac import pslist class Psaux(plugins.PluginInterface): """Recovers program command line arguments.""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, optional = True) ] def _generator(self, tasks: Iterator[Any]) -> Generator[Tuple[int, Tuple[int, str, int, str]], None, None]: for task in tasks: proc_layer_name = task.add_process_layer() if proc_layer_name is None: continue proc_layer = self.context.layers[proc_layer_name] argsstart = task.user_stack - task.p_argslen if not proc_layer.is_valid(argsstart) or task.p_argslen == 0 or task.p_argc == 0: continue # Add one because the first two are usually duplicates argc = task.p_argc + 1 # smear protection if argc > 1024: continue task_name = utility.array_to_string(task.p_comm) args = [] # type: List[bytes] while argc > 0: try: arg = proc_layer.read(argsstart, 256) except exceptions.InvalidAddressException: break idx = arg.find(b'\x00') if idx != -1: arg = arg[:idx] argsstart += len(str(arg)) + 1 # deal with the stupid alignment (leading nulls) and arg duplication if len(args) == 0: while argsstart < task.user_stack: try: check = proc_layer.read(argsstart, 1) except exceptions.InvalidAddressException: break if check != b"\x00": break argsstart = argsstart + 1 args.append(arg) # also check for initial duplicates since OS X is painful elif arg != args[0]: args.append(arg) argc = argc - 1 args_str = " ".join([s.decode("utf-8", errors = 'replace') for s in args]) yield (0, (task.p_pid, task_name, task.p_argc, args_str)) def run(self) -> renderers.TreeGrid: filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) list_tasks = pslist.PsList.get_list_tasks(self.config.get('pslist_method', pslist.PsList.pslist_methods[0])) return renderers.TreeGrid([("PID", int), ("Process", str), ("Argc", int), ("Arguments", str)], self._generator( list_tasks(self.context, self.config['primary'], self.config['darwin'], filter_func = filter_func))) volatility3-1.0.1/volatility3/framework/plugins/mac/pslist.py000066400000000000000000000310111405267600400243650ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import Callable, Iterable, List, Dict from volatility3.framework import renderers, interfaces, contexts, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility from volatility3.framework.symbols import mac vollog = logging.getLogger(__name__) class PsList(interfaces.plugins.PluginInterface): """Lists the processes present in a particular mac memory image.""" _required_framework_version = (1, 0, 0) _version = (2, 0, 0) pslist_methods = ['tasks', 'allproc', 'process_group', 'sessions', 'pid_hash_table'] @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"), requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 1, 0)), requirements.ChoiceRequirement(name = 'pslist_method', description = 'Method to determine for processes', choices = cls.pslist_methods, default = cls.pslist_methods[0], optional = True), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, optional = True) ] @classmethod def get_list_tasks( cls, method: str ) -> Callable[[interfaces.context.ContextInterface, str, str, Callable[[int], bool]], Iterable[interfaces.objects.ObjectInterface]]: """Returns the list_tasks method based on the selector Args: method: Must be one fo the available methods in get_task_choices Returns: list_tasks method for listing tasks """ # Ensure method is one of the suitable choices if method not in cls.pslist_methods: method = cls.pslist_methods[0] if method == 'allproc': list_tasks = cls.list_tasks_allproc elif method == 'tasks': list_tasks = cls.list_tasks_tasks elif method == 'process_group': list_tasks = cls.list_tasks_process_group elif method == 'sessions': list_tasks = cls.list_tasks_sessions elif method == 'pid_hash_table': list_tasks = cls.list_tasks_pid_hash_table else: raise ValueError("Impossible method choice chosen") vollog.debug("Using method {}".format(method)) return list_tasks @classmethod def create_pid_filter(cls, pid_list: List[int] = None) -> Callable[[int], bool]: filter_func = lambda _: False # FIXME: mypy #4973 or #2608 pid_list = pid_list or [] filter_list = [x for x in pid_list if x is not None] if filter_list: def list_filter(x): return x.p_pid not in filter_list filter_func = list_filter return filter_func def _generator(self): list_tasks = self.get_list_tasks(self.config.get('pslist_method', self.pslist_methods[0])) for task in list_tasks(self.context, self.config['primary'], self.config['darwin'], filter_func = self.create_pid_filter(self.config.get('pid', None))): pid = task.p_pid ppid = task.p_ppid name = utility.array_to_string(task.p_comm) yield (0, (pid, ppid, name)) @classmethod def list_tasks_allproc(cls, context: interfaces.context.ContextInterface, layer_name: str, darwin_symbols: str, filter_func: Callable[[int], bool] = lambda _: False) -> \ Iterable[interfaces.objects.ObjectInterface]: """Lists all the processes in the primary layer based on the allproc method Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate darwin_symbols: The name of the table containing the kernel symbols filter_func: A function which takes a process object and returns True if the process should be ignored/filtered Returns: The list of process objects from the processes linked list after filtering """ kernel = contexts.Module(context, darwin_symbols, layer_name, 0) kernel_layer = context.layers[layer_name] proc = kernel.object_from_symbol(symbol_name = "allproc").lh_first seen = {} # type: Dict[int, int] while proc is not None and proc.vol.offset != 0: if proc.vol.offset in seen: vollog.log(logging.INFO, "Recursive process list detected (a result of non-atomic acquisition).") break else: seen[proc.vol.offset] = 1 if kernel_layer.is_valid(proc.vol.offset, proc.vol.size) and not filter_func(proc): yield proc try: proc = proc.p_list.le_next.dereference() except exceptions.InvalidAddressException: break @classmethod def list_tasks_tasks(cls, context: interfaces.context.ContextInterface, layer_name: str, darwin_symbols: str, filter_func: Callable[[int], bool] = lambda _: False) -> \ Iterable[interfaces.objects.ObjectInterface]: """Lists all the tasks in the primary layer based on the tasks queue Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate darwin_symbols: The name of the table containing the kernel symbols filter_func: A function which takes a task object and returns True if the task should be ignored/filtered Returns: The list of task objects from the `layer_name` layer's `tasks` list after filtering """ kernel = contexts.Module(context, darwin_symbols, layer_name, 0) kernel_layer = context.layers[layer_name] queue_entry = kernel.object_from_symbol(symbol_name = "tasks") seen = {} # type: Dict[int, int] for task in queue_entry.walk_list(queue_entry, "tasks", "task"): if task.vol.offset in seen: vollog.log(logging.INFO, "Recursive process list detected (a result of non-atomic acquisition).") break else: seen[task.vol.offset] = 1 try: proc = task.bsd_info.dereference().cast("proc") except exceptions.InvalidAddressException: continue if kernel_layer.is_valid(proc.vol.offset, proc.vol.size) and not filter_func(proc): yield proc @classmethod def list_tasks_sessions(cls, context: interfaces.context.ContextInterface, layer_name: str, darwin_symbols: str, filter_func: Callable[[int], bool] = lambda _: False) -> \ Iterable[interfaces.objects.ObjectInterface]: """Lists all the tasks in the primary layer using sessions Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate darwin_symbols: The name of the table containing the kernel symbols filter_func: A function which takes a task object and returns True if the task should be ignored/filtered Returns: The list of task objects from the `layer_name` layer's `tasks` list after filtering """ kernel = contexts.Module(context, darwin_symbols, layer_name, 0) table_size = kernel.object_from_symbol(symbol_name = "sesshash") sesshashtbl = kernel.object_from_symbol(symbol_name = "sesshashtbl") proc_array = kernel.object(object_type = "array", offset = sesshashtbl, count = table_size + 1, subtype = kernel.get_type("sesshashhead")) for proc_list in proc_array: for proc in mac.MacUtilities.walk_list_head(proc_list, "s_hash"): if proc.s_leader.is_readable() and not filter_func(proc.s_leader): yield proc.s_leader @classmethod def list_tasks_process_group(cls, context: interfaces.context.ContextInterface, layer_name: str, darwin_symbols: str, filter_func: Callable[[int], bool] = lambda _: False) -> \ Iterable[interfaces.objects.ObjectInterface]: """Lists all the tasks in the primary layer using process groups Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate darwin_symbols: The name of the table containing the kernel symbols filter_func: A function which takes a task object and returns True if the task should be ignored/filtered Returns: The list of task objects from the `layer_name` layer's `tasks` list after filtering """ kernel = contexts.Module(context, darwin_symbols, layer_name, 0) table_size = kernel.object_from_symbol(symbol_name = "pgrphash") pgrphashtbl = kernel.object_from_symbol(symbol_name = "pgrphashtbl") proc_array = kernel.object(object_type = "array", offset = pgrphashtbl, count = table_size + 1, subtype = kernel.get_type("pgrphashhead")) for proc_list in proc_array: for pgrp in mac.MacUtilities.walk_list_head(proc_list, "pg_hash"): for proc in mac.MacUtilities.walk_list_head(pgrp.pg_members, "p_pglist"): if not filter_func(proc): yield proc @classmethod def list_tasks_pid_hash_table(cls, context: interfaces.context.ContextInterface, layer_name: str, darwin_symbols: str, filter_func: Callable[[int], bool] = lambda _: False) -> \ Iterable[interfaces.objects.ObjectInterface]: """Lists all the tasks in the primary layer using the pid hash table Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate darwin_symbols: The name of the table containing the kernel symbols filter_func: A function which takes a task object and returns True if the task should be ignored/filtered Returns: The list of task objects from the `layer_name` layer's `tasks` list after filtering """ kernel = contexts.Module(context, darwin_symbols, layer_name, 0) table_size = kernel.object_from_symbol(symbol_name = "pidhash") pidhashtbl = kernel.object_from_symbol(symbol_name = "pidhashtbl") proc_array = kernel.object(object_type = "array", offset = pidhashtbl, count = table_size + 1, subtype = kernel.get_type("pidhashhead")) for proc_list in proc_array: for proc in mac.MacUtilities.walk_list_head(proc_list, "p_hash"): if not filter_func(proc): yield proc def run(self): return renderers.TreeGrid([("PID", int), ("PPID", int), ("COMM", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/mac/pstree.py000066400000000000000000000055551405267600400243670ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from volatility3.framework import renderers from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility from volatility3.plugins.mac import pslist class PsTree(plugins.PluginInterface): """Plugin for listing processes in a tree based on their parent process ID.""" _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self._processes = {} self._levels = {} self._children = {} @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)) ] def _find_level(self, pid): """Finds how deep the pid is in the processes list.""" seen = set([]) seen.add(pid) level = 0 proc = self._processes.get(pid, None) while proc is not None and proc.vol.offset != 0 and proc.p_ppid != 0 and proc.p_ppid not in seen: ppid = int(proc.p_ppid) child_list = self._children.get(ppid, set([])) child_list.add(proc.p_pid) self._children[ppid] = child_list proc = self._processes.get(ppid, None) level += 1 self._levels[pid] = level def _generator(self): """Generates the tree list of processes""" list_tasks = pslist.PsList.get_list_tasks(self.config.get('pslist_method', pslist.PsList.pslist_methods[0])) for proc in list_tasks(self.context, self.config['primary'], self.config['darwin']): self._processes[proc.p_pid] = proc # Build the child/level maps for pid in self._processes: self._find_level(pid) def yield_processes(pid): proc = self._processes[pid] row = (proc.p_pid, proc.p_ppid, utility.array_to_string(proc.p_comm)) yield (self._levels[pid] - 1, row) for child_pid in self._children.get(pid, []): yield from yield_processes(child_pid) for pid in self._levels: if self._levels[pid] == 1: yield from yield_processes(pid) def run(self): return renderers.TreeGrid([("PID", int), ("PPID", int), ("COMM", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/mac/socket_filters.py000066400000000000000000000066621405267600400261050ustar00rootroot00000000000000# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import List from volatility3.framework import exceptions, interfaces from volatility3.framework import renderers, contexts from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import mac from volatility3.plugins.mac import lsmod vollog = logging.getLogger(__name__) class Socket_filters(plugins.PluginInterface): """Enumerates kernel socket filters.""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"), requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)), requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)) ] def _generator(self): kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0) mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin']) handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods) members_to_check = [ "sf_unregistered", "sf_attach", "sf_detach", "sf_notify", "sf_getpeername", "sf_getsockname", "sf_data_in", "sf_data_out", "sf_connect_in", "sf_connect_out", "sf_bind", "sf_setoption", "sf_getoption", "sf_listen", "sf_ioctl" ] filter_list = kernel.object_from_symbol(symbol_name = "sock_filter_head") for filter_container in mac.MacUtilities.walk_tailq(filter_list, "sf_global_next"): current_filter = filter_container.sf_filter filter_name = utility.pointer_to_string(current_filter.sf_name, count = 128) try: filter_socket = filter_container.sf_entry_head.sfe_socket.vol.offset except exceptions.InvalidAddressException: filter_socket = 0 for member in members_to_check: check_addr = current_filter.member(attr = member) if check_addr == 0: continue module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, check_addr) yield (0, (format_hints.Hex(current_filter.vol.offset), filter_name, member, \ format_hints.Hex(filter_socket), format_hints.Hex(check_addr), module_name, symbol_name)) def run(self): return renderers.TreeGrid([("Filter", format_hints.Hex), ("Name", str), ("Member", str), ("Socket", format_hints.Hex), ("Handler", format_hints.Hex), ("Module", str), ("Symbol", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/mac/timers.py000066400000000000000000000071721405267600400243650ustar00rootroot00000000000000# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import List from volatility3.framework import exceptions, interfaces from volatility3.framework import renderers, contexts from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import mac from volatility3.plugins.mac import lsmod vollog = logging.getLogger(__name__) class Timers(plugins.PluginInterface): """Check for malicious kernel timers.""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"), requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)), requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)) ] def _generator(self): kernel = contexts.Module(self.context, self.config['darwin'], self.config['primary'], 0) mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin']) handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods) real_ncpus = kernel.object_from_symbol(symbol_name = "real_ncpus") cpu_data_ptrs_ptr = kernel.get_symbol("cpu_data_ptr").address cpu_data_ptrs_addr = kernel.object(object_type = "pointer", offset = cpu_data_ptrs_ptr, subtype = kernel.get_type('long unsigned int')) cpu_data_ptrs = kernel.object(object_type = "array", offset = cpu_data_ptrs_addr, subtype = kernel.get_type('cpu_data'), count = real_ncpus) for cpu_data_ptr in cpu_data_ptrs: try: queue = cpu_data_ptr.rtclock_timer.queue.head except exceptions.InvalidAddressException: break for timer in queue.walk_list(queue, "q_link", "call_entry"): try: handler = timer.func.dereference().vol.offset except exceptions.InvalidAddressException: continue if timer.has_member("entry_time"): entry_time = timer.entry_time else: entry_time = -1 module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, handler) yield (0, (format_hints.Hex(handler), format_hints.Hex(timer.param0), format_hints.Hex(timer.param1), \ timer.deadline, entry_time, module_name, symbol_name)) def run(self): return renderers.TreeGrid([("Function", format_hints.Hex), ("Param 0", format_hints.Hex), ("Param 1", format_hints.Hex), ("Deadline", int), ("Entry Time", int), ("Module", str), ("Symbol", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/mac/trustedbsd.py000066400000000000000000000071241405267600400252420ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import List, Iterator, Any from volatility3.framework import exceptions, interfaces from volatility3.framework import renderers, contexts from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import mac from volatility3.plugins.mac import lsmod vollog = logging.getLogger(__name__) class Trustedbsd(plugins.PluginInterface): """Checks for malicious trustedbsd modules""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"), requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)), requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)) ] def _generator(self, mods: Iterator[Any]): kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0) handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods) policy_list = kernel.object_from_symbol(symbol_name = "mac_policy_list").cast("mac_policy_list") entries = kernel.object(object_type = "array", offset = policy_list.entries.dereference().vol.offset, subtype = kernel.get_type('mac_policy_list_element'), count = policy_list.staticmax + 1) for i, ent in enumerate(entries): # I don't know how this can happen, but the kernel makes this check all over the place # the policy isn't useful without any ops so a rootkit can't abuse this try: mpc = ent.mpc.dereference() ops = mpc.mpc_ops.dereference() except exceptions.InvalidAddressException: continue try: ent_name = utility.pointer_to_string(mpc.mpc_name, 255) except exceptions.InvalidAddressException: ent_name = "N/A" for check in ops.vol.members: call_addr = getattr(ops, check) if call_addr is None or call_addr == 0: continue module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, call_addr) yield (0, (check, ent_name, format_hints.Hex(call_addr), module_name, symbol_name)) def run(self): return renderers.TreeGrid([("Member", str), ("Policy Name", str), ("Handler Address", format_hints.Hex), ("Handler Module", str), ("Handler Symbol", str)], self._generator( lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin']))) volatility3-1.0.1/volatility3/framework/plugins/mac/vfsevents.py000066400000000000000000000047211405267600400251020ustar00rootroot00000000000000# This file is opyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from volatility3.framework import renderers, interfaces, exceptions, contexts from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility class VFSevents(interfaces.plugins.PluginInterface): """ Lists processes that are filtering file system events """ _required_framework_version = (1, 0, 0) event_types = [ "CREATE_FILE", "DELETE", "STAT_CHANGED", "RENAME", "CONTENT_MODIFIED", "EXCHANGE", "FINDER_INFO_CHANGED", "CREATE_DIR", "CHOWN", "XATTR_MODIFIED", "XATTR_REMOVED", "DOCID_CREATED", "DOCID_CHANGED" ] @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel"), ] def _generator(self): """ Lists the registered VFS event watching processes Also lists which event(s) a process is registered for """ kernel = contexts.Module(self.context, self.config['darwin'], self.config['primary'], 0) watcher_table = kernel.object_from_symbol("watcher_table") for watcher in watcher_table: if watcher == 0: continue task_name = utility.array_to_string(watcher.proc_name) task_pid = watcher.pid events = [] try: event_array = kernel.object(object_type = "array", offset = watcher.event_list, count = 13, subtype = kernel.get_type("unsigned char")) except exceptions.InvalidAddressException: continue for i, event in enumerate(event_array): if event == 1: events.append(self.event_types[i]) if events != []: yield (0, (task_name, task_pid, ",".join(events))) def run(self): return renderers.TreeGrid([("Name", str), ("PID", int), ("Events", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/timeliner.py000066400000000000000000000235161405267600400243120ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import abc import datetime import enum import io import json import logging import traceback from typing import Generator, Iterable, List, Optional, Tuple, Type from volatility3 import framework from volatility3.framework import renderers, automagic, interfaces, plugins, exceptions from volatility3.framework.configuration import requirements vollog = logging.getLogger(__name__) class TimeLinerType(enum.IntEnum): CREATED = 1 MODIFIED = 2 ACCESSED = 3 CHANGED = 4 class TimeLinerInterface(metaclass = abc.ABCMeta): """Interface defining methods that timeliner will use to generate a body file.""" @abc.abstractmethod def generate_timeline(self) -> Generator[Tuple[str, TimeLinerType, datetime.datetime], None, None]: """Method generates Tuples of (description, timestamp_type, timestamp) These need not be generated in any particular order, sorting will be done later """ class Timeliner(interfaces.plugins.PluginInterface): """Runs all relevant plugins that provide time related information and orders the results by time.""" _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self.timeline = {} self.usable_plugins = None self.automagics = None @classmethod def get_usable_plugins(cls, selected_list: List[str] = None) -> List[Type]: # Initialize for the run plugin_list = list(framework.class_subclasses(TimeLinerInterface)) # Get the filter from the configuration def passthrough(name: str, selected: List[str]) -> bool: return True filter_func = passthrough if selected_list: def filter_plugins(name: str, selected: List[str]) -> bool: return any([s in name for s in selected]) filter_func = filter_plugins else: selected_list = [] return [plugin_class for plugin_class in plugin_list if filter_func(plugin_class.__name__, selected_list)] @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.StringRequirement(name = 'plugins', description = "Comma separated list of plugins to run", optional = True, default = None), requirements.BooleanRequirement( name = 'record-config', description = "Whether to record the state of all the plugins once complete", optional = True, default = False), requirements.ListRequirement(name = 'plugin-filter', description = "Only run plugins featuring this substring", element_type = str, optional = True, default = []), requirements.BooleanRequirement(name = 'create-bodyfile', description = "Whether to create a body file whilst producing results", optional = True, default = False) ] def _sort_function(self, item): data = item[1] def sortable(timestamp): max_date = datetime.datetime(day = 1, month = 12, year = datetime.MAXYEAR) if isinstance(timestamp, interfaces.renderers.BaseAbsentValue): return max_date return timestamp return [sortable(timestamp) for timestamp in data[2:]] def _generator(self, runable_plugins: List[TimeLinerInterface]) -> Optional[Iterable[Tuple[int, Tuple]]]: """Takes a timeline, sorts it and output the data from each relevant row from each plugin.""" # Generate the results for each plugin data = [] for plugin in runable_plugins: plugin_name = plugin.__class__.__name__ self._progress_callback((runable_plugins.index(plugin) * 100) // len(runable_plugins), "Running plugin {}...".format(plugin_name)) try: vollog.log(logging.INFO, "Running {}".format(plugin_name)) for (item, timestamp_type, timestamp) in plugin.generate_timeline(): times = self.timeline.get((plugin_name, item), {}) if times.get(timestamp_type, None) is not None: vollog.debug("Multiple timestamps for the same plugin/file combination found: {} {}".format( plugin_name, item)) times[timestamp_type] = timestamp self.timeline[(plugin_name, item)] = times data.append((0, [ plugin_name, item, times.get(TimeLinerType.CREATED, renderers.NotApplicableValue()), times.get(TimeLinerType.MODIFIED, renderers.NotApplicableValue()), times.get(TimeLinerType.ACCESSED, renderers.NotApplicableValue()), times.get(TimeLinerType.CHANGED, renderers.NotApplicableValue()) ])) except Exception: vollog.log(logging.INFO, "Exception occurred running plugin: {}".format(plugin_name)) vollog.log(logging.DEBUG, traceback.format_exc()) for data_item in sorted(data, key = self._sort_function): yield data_item # Write out a body file if necessary if self.config.get('create-bodyfile', True): with self.open("volatility.body") as file_data: with io.TextIOWrapper(file_data, write_through = True) as fp: for (plugin_name, item) in self.timeline: times = self.timeline[(plugin_name, item)] # Body format is: MD5|name|inode|mode_as_string|UID|GID|size|atime|mtime|ctime|crtime if self._any_time_present(times): fp.write("|{} - {}||||||{}|{}|{}|{}\n".format( plugin_name, self._sanitize_body_format(item), self._text_format(times.get(TimeLinerType.ACCESSED, "")), self._text_format(times.get(TimeLinerType.MODIFIED, "")), self._text_format(times.get(TimeLinerType.CHANGED, "")), self._text_format(times.get(TimeLinerType.CREATED, "")))) def _sanitize_body_format(self, value): return value.replace("|", "_") def _any_time_present(self, times): for time in TimeLinerType: if not isinstance(times.get(time, renderers.NotApplicableValue), interfaces.renderers.BaseAbsentValue): return True return False def _text_format(self, value): """Formats a value as text, in case it is an AbsentValue""" if isinstance(value, interfaces.renderers.BaseAbsentValue): return "" if isinstance(value, datetime.datetime): return int(value.timestamp()) return value def run(self): """Isolate each plugin and run it.""" # Use all the plugins if there's no filter self.usable_plugins = self.usable_plugins or self.get_usable_plugins() self.automagics = self.automagics or automagic.available(self._context) plugins_to_run = [] filter_list = self.config['plugin-filter'] # Identify plugins that we can run which output datetimes for plugin_class in self.usable_plugins: try: automagics = automagic.choose_automagic(self.automagics, plugin_class) plugin = plugins.construct_plugin(self.context, automagics, plugin_class, self.config_path, self._progress_callback, self.open) if isinstance(plugin, TimeLinerInterface): if not len(filter_list) or any( [filter in plugin.__module__ + '.' + plugin.__class__.__name__ for filter in filter_list]): plugins_to_run.append(plugin) except exceptions.UnsatisfiedException as excp: # Remove the failed plugin from the list and continue vollog.debug("Unable to satisfy {}: {}".format(plugin_class.__name__, excp.unsatisfied)) continue if self.config.get('record-config', False): total_config = {} for plugin in plugins_to_run: old_dict = dict(plugin.build_configuration()) for entry in old_dict: total_config[interfaces.configuration.path_join(plugin.__class__.__name__, entry)] = old_dict[entry] with self.open("config.json") as file_data: with io.TextIOWrapper(file_data, write_through = True) as fp: json.dump(total_config, fp, sort_keys = True, indent = 2) return renderers.TreeGrid(columns = [("Plugin", str), ("Description", str), ("Created Date", datetime.datetime), ("Modified Date", datetime.datetime), ("Accessed Date", datetime.datetime), ("Changed Date", datetime.datetime)], generator = self._generator(plugins_to_run)) def build_configuration(self): """Builds the configuration to save for the plugin such that it can be reconstructed.""" vollog.warning("Unable to record configuration data for the timeliner plugin") return [] volatility3-1.0.1/volatility3/framework/plugins/windows/000077500000000000000000000000001405267600400234335ustar00rootroot00000000000000volatility3-1.0.1/volatility3/framework/plugins/windows/__init__.py000066400000000000000000000004761405267600400255530ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """All core windows plugins. These modules should only be imported from volatility3.plugins NOT volatility3.framework.plugins """ volatility3-1.0.1/volatility3/framework/plugins/windows/bigpools.py000066400000000000000000000135321405267600400256270ustar00rootroot00000000000000# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import List, Optional, Tuple, Iterator from volatility3.framework import interfaces, renderers, exceptions, symbols from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import configuration from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows import extensions from volatility3.framework.symbols.windows import versions vollog = logging.getLogger(__name__) class BigPools(interfaces.plugins.PluginInterface): """List big page pools.""" _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.StringRequirement(name = 'tags', description = "Comma separated list of pool tags to filter pools returned", optional = True, default = None) ] @classmethod def list_big_pools(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str, tags: Optional[list] = None): """Returns the big page pool objects from the kernel PoolBigPageTable array. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols tags: An optional list of pool tags to filter big page pool tags by Yields: A big page pool object """ kvo = context.layers[layer_name].config['kernel_virtual_offset'] ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo) big_page_table_offset = ntkrnlmp.get_symbol("PoolBigPageTable").address big_page_table = ntkrnlmp.object(object_type = "unsigned long long", offset = big_page_table_offset) big_page_table_size_offset = ntkrnlmp.get_symbol("PoolBigPageTableSize").address big_page_table_size = ntkrnlmp.object(object_type = "unsigned long", offset = big_page_table_size_offset) try: big_page_table_type = ntkrnlmp.get_type("_POOL_TRACKER_BIG_PAGES") except exceptions.SymbolError: # We have to manually load a symbol table is_vista_or_later = versions.is_vista_or_later(context, symbol_table) is_win10 = versions.is_win10(context, symbol_table) if is_win10: big_pools_json_filename = "bigpools-win10" elif is_vista_or_later: big_pools_json_filename = "bigpools-vista" else: big_pools_json_filename = "bigpools" if symbols.symbol_table_is_64bit(context, symbol_table): big_pools_json_filename += "-x64" else: big_pools_json_filename += "-x86" new_table_name = intermed.IntermediateSymbolTable.create( context = context, config_path = configuration.path_join(context.symbol_space[symbol_table].config_path, "bigpools"), sub_path = "windows", filename = big_pools_json_filename, table_mapping = {'nt_symbols': symbol_table}, class_types = {'_POOL_TRACKER_BIG_PAGES': extensions.pool.POOL_TRACKER_BIG_PAGES}) module = context.module(new_table_name, layer_name, offset = 0) big_page_table_type = module.get_type("_POOL_TRACKER_BIG_PAGES") big_pools = ntkrnlmp.object(object_type = "array", offset = big_page_table, subtype = big_page_table_type, count = big_page_table_size, absolute = True) for big_pool in big_pools: if big_pool.is_valid(): if tags is None or big_pool.get_key() in tags: yield big_pool def _generator(self) -> Iterator[Tuple[int, Tuple[int, str]]]: # , str, int]]]: if self.config.get("tags"): tags = [tag for tag in self.config["tags"].split(',')] else: tags = None for big_pool in self.list_big_pools(context = self.context, layer_name = self.config["primary"], symbol_table = self.config["nt_symbols"], tags = tags): num_bytes = big_pool.get_number_of_bytes() if not isinstance(num_bytes, interfaces.renderers.BaseAbsentValue): num_bytes = format_hints.Hex(num_bytes) yield (0, (format_hints.Hex(big_pool.Va), big_pool.get_key(), big_pool.get_pool_type(), num_bytes)) def run(self): return renderers.TreeGrid([ ('Allocation', format_hints.Hex), ('Tag', str), ('PoolType', str), ('NumberOfBytes', format_hints.Hex), ], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/windows/cachedump.py000066400000000000000000000134041405267600400257400ustar00rootroot00000000000000# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from struct import unpack from Crypto.Cipher import ARC4, AES from Crypto.Hash import HMAC from volatility3.framework import interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.symbols.windows import versions from volatility3.plugins.windows import hashdump, lsadump from volatility3.plugins.windows.registry import hivelist class Cachedump(interfaces.plugins.PluginInterface): """Dumps lsa secrets from memory""" _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.PluginRequirement(name = 'hivelist', plugin = hivelist.HiveList, version = (1, 0, 0)), requirements.PluginRequirement(name = 'lsadump', plugin = lsadump.Lsadump, version = (1, 0, 0)) ] def get_nlkm(self, sechive, lsakey, is_vista_or_later): return lsadump.Lsadump.get_secret_by_name(sechive, 'NL$KM', lsakey, is_vista_or_later) def decrypt_hash(self, edata, nlkm, ch, xp): if xp: hmac_md5 = HMAC.new(nlkm, ch) rc4key = hmac_md5.digest() rc4 = ARC4.new(rc4key) data = rc4.encrypt(edata) else: # based on Based on code from http://lab.mediaservice.net/code/cachedump.rb aes = AES.new(nlkm[16:32], AES.MODE_CBC, ch) data = "" for i in range(0, len(edata), 16): buf = edata[i:i + 16] if len(buf) < 16: buf += (16 - len(buf)) * "\00" data += aes.decrypt(buf) return data def parse_cache_entry(self, cache_data): (uname_len, domain_len) = unpack(" List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.PluginRequirement(name = 'ssdt', plugin = ssdt.SSDT, version = (1, 0, 0)), requirements.PluginRequirement(name = 'svcscan', plugin = svcscan.SvcScan, version = (1, 0, 0)) ] @staticmethod def create_callback_table(context: interfaces.context.ContextInterface, symbol_table: str, config_path: str) -> str: """Creates a symbol table for a set of callbacks. Args: context: The context to retrieve required elements (layers, symbol tables) from symbol_table: The name of an existing symbol table containing the kernel symbols config_path: The configuration path within the context of the symbol table to create Returns: The name of the constructed callback table """ native_types = context.symbol_space[symbol_table].natives is_64bit = symbols.symbol_table_is_64bit(context, symbol_table) table_mapping = {"nt_symbols": symbol_table} if is_64bit: symbol_filename = "callbacks-x64" else: symbol_filename = "callbacks-x86" return intermed.IntermediateSymbolTable.create(context, config_path, "windows", symbol_filename, native_types = native_types, table_mapping = table_mapping) @classmethod def list_notify_routines(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str, callback_table_name: str) -> Iterable[Tuple[str, int, Optional[str]]]: """Lists all kernel notification routines. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols callback_table_name: The nae of the table containing the callback symbols Yields: A name, location and optional detail string """ kvo = context.layers[layer_name].config['kernel_virtual_offset'] ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo) is_vista_or_later = versions.is_vista_or_later(context = context, symbol_table = symbol_table) full_type_name = callback_table_name + constants.BANG + "_GENERIC_CALLBACK" symbol_names = [("PspLoadImageNotifyRoutine", False), ("PspCreateThreadNotifyRoutine", True), ("PspCreateProcessNotifyRoutine", True)] for symbol_name, extended_list in symbol_names: try: symbol_offset = ntkrnlmp.get_symbol(symbol_name).address except exceptions.SymbolError: vollog.debug("Cannot find {}".format(symbol_name)) continue if is_vista_or_later and extended_list: count = 64 else: count = 8 fast_refs = ntkrnlmp.object(object_type = "array", offset = symbol_offset, subtype = ntkrnlmp.get_type("_EX_FAST_REF"), count = count) for fast_ref in fast_refs: try: callback = fast_ref.dereference().cast(full_type_name) except exceptions.InvalidAddressException: continue if callback.Callback != 0: yield symbol_name, callback.Callback, None @classmethod def list_registry_callbacks(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str, callback_table_name: str) -> Iterable[Tuple[str, int, None]]: """Lists all registry callbacks. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols callback_table_name: The nae of the table containing the callback symbols Yields: A name, location and optional detail string """ kvo = context.layers[layer_name].config['kernel_virtual_offset'] ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo) full_type_name = callback_table_name + constants.BANG + "_EX_CALLBACK_ROUTINE_BLOCK" try: symbol_offset = ntkrnlmp.get_symbol("CmpCallBackVector").address symbol_count_offset = ntkrnlmp.get_symbol("CmpCallBackCount").address except exceptions.SymbolError: vollog.debug("Cannot find CmpCallBackVector or CmpCallBackCount") return callback_count = ntkrnlmp.object(object_type = "unsigned int", offset = symbol_count_offset) if callback_count == 0: return fast_refs = ntkrnlmp.object(object_type = "array", offset = symbol_offset, subtype = ntkrnlmp.get_type("_EX_FAST_REF"), count = callback_count) for fast_ref in fast_refs: try: callback = fast_ref.dereference().cast(full_type_name) except exceptions.InvalidAddressException: continue if callback.Function != 0: yield "CmRegisterCallback", callback.Function, None @classmethod def list_bugcheck_reason_callbacks(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str, callback_table_name: str) -> Iterable[Tuple[str, int, str]]: """Lists all kernel bugcheck reason callbacks. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols callback_table_name: The nae of the table containing the callback symbols Yields: A name, location and optional detail string """ kvo = context.layers[layer_name].config['kernel_virtual_offset'] ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo) try: list_offset = ntkrnlmp.get_symbol("KeBugCheckReasonCallbackListHead").address except exceptions.SymbolError: vollog.debug("Cannot find KeBugCheckReasonCallbackListHead") return full_type_name = callback_table_name + constants.BANG + "_KBUGCHECK_REASON_CALLBACK_RECORD" callback_record = context.object(object_type = full_type_name, offset = kvo + list_offset, layer_name = layer_name) for callback in callback_record.Entry: if not context.layers[layer_name].is_valid(callback.CallbackRoutine, 64): continue try: component = ntkrnlmp.object( "string", absolute = True, offset = callback.Component, max_length = 64, errors = "replace" ) # type: Union[interfaces.renderers.BaseAbsentValue, interfaces.objects.ObjectInterface] except exceptions.InvalidAddressException: component = renderers.UnreadableValue() yield "KeBugCheckReasonCallbackListHead", callback.CallbackRoutine, component @classmethod def list_bugcheck_callbacks(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str, callback_table_name: str) -> Iterable[Tuple[str, int, str]]: """Lists all kernel bugcheck callbacks. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols callback_table_name: The nae of the table containing the callback symbols Yields: A name, location and optional detail string """ kvo = context.layers[layer_name].config['kernel_virtual_offset'] ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo) try: list_offset = ntkrnlmp.get_symbol("KeBugCheckCallbackListHead").address except exceptions.SymbolError: vollog.debug("Cannot find KeBugCheckCallbackListHead") return full_type_name = callback_table_name + constants.BANG + "_KBUGCHECK_CALLBACK_RECORD" callback_record = context.object(full_type_name, offset = kvo + list_offset, layer_name = layer_name) for callback in callback_record.Entry: if not context.layers[layer_name].is_valid(callback.CallbackRoutine, 64): continue try: component = context.object(symbol_table + constants.BANG + "string", layer_name = layer_name, offset = callback.Component, max_length = 64, errors = "replace") except exceptions.InvalidAddressException: component = renderers.UnreadableValue() yield "KeBugCheckCallbackListHead", callback.CallbackRoutine, component def _generator(self): callback_table_name = self.create_callback_table(self.context, self.config["nt_symbols"], self.config_path) collection = ssdt.SSDT.build_module_collection(self.context, self.config['primary'], self.config['nt_symbols']) callback_methods = (self.list_notify_routines, self.list_bugcheck_callbacks, self.list_bugcheck_reason_callbacks, self.list_registry_callbacks) for callback_method in callback_methods: for callback_type, callback_address, callback_detail in callback_method(self.context, self.config['primary'], self.config['nt_symbols'], callback_table_name): if callback_detail is None: detail = renderers.NotApplicableValue() else: detail = callback_detail module_symbols = list(collection.get_module_symbols_by_absolute_location(callback_address)) if module_symbols: for module_name, symbol_generator in module_symbols: symbols_found = False # we might have multiple symbols pointing to the same location for symbol in symbol_generator: symbols_found = True yield (0, (callback_type, format_hints.Hex(callback_address), module_name, symbol.split(constants.BANG)[1], detail)) # no symbols, but we at least can report the module name if not symbols_found: yield (0, (callback_type, format_hints.Hex(callback_address), module_name, renderers.NotAvailableValue(), detail)) else: # no module was found at the absolute location yield (0, (callback_type, format_hints.Hex(callback_address), renderers.NotAvailableValue(), renderers.NotAvailableValue(), detail)) def run(self): return renderers.TreeGrid([("Type", str), ("Callback", format_hints.Hex), ("Module", str), ("Symbol", str), ("Detail", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/windows/cmdline.py000066400000000000000000000077401405267600400254300ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import List from volatility3.framework import constants, exceptions, renderers, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) class CmdLine(interfaces.plugins.PluginInterface): """Lists process command line arguments.""" _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.ListRequirement(name = 'pid', element_type = int, description = "Process IDs to include (all other processes are excluded)", optional = True) ] @classmethod def get_cmdline(cls, context: interfaces.context.ContextInterface, kernel_table_name: str, proc): """Extracts the cmdline from PEB Args: context: the context to operate upon kernel_table_name: the name for the symbol table containing the kernel's symbols proc: the process object Returns: A string with the command line """ proc_layer_name = proc.add_process_layer() peb = context.object(kernel_table_name + constants.BANG + "_PEB", layer_name = proc_layer_name, offset = proc.Peb) result_text = peb.ProcessParameters.CommandLine.get_string() return result_text def _generator(self, procs): for proc in procs: process_name = utility.array_to_string(proc.ImageFileName) proc_id = "Unknown" try: proc_id = proc.UniqueProcessId result_text = self.get_cmdline(self.context, self.config["nt_symbols"], proc) except exceptions.SwappedInvalidAddressException as exp: result_text = "Required memory at {0:#x} is inaccessible (swapped)".format(exp.invalid_address) except exceptions.PagedInvalidAddressException as exp: result_text = "Required memory at {0:#x} is not valid (process exited?)".format(exp.invalid_address) except exceptions.InvalidAddressException as exp: result_text = "Process {}: Required memory at {:#x} is not valid (incomplete layer {}?)".format( proc_id, exp.invalid_address, exp.layer_name) yield (0, (proc.UniqueProcessId, process_name, result_text)) def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), ("Args", str)], self._generator( pslist.PsList.list_processes(context = self.context, layer_name = self.config['primary'], symbol_table = self.config['nt_symbols'], filter_func = filter_func))) volatility3-1.0.1/volatility3/framework/plugins/windows/dlllist.py000066400000000000000000000214211405267600400254540ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import datetime import logging import ntpath from typing import List, Optional, Type from volatility3.framework import exceptions, renderers, interfaces, constants from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints, conversion from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows.extensions import pe from volatility3.plugins import timeliner from volatility3.plugins.windows import pslist, info vollog = logging.getLogger(__name__) class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Lists the loaded modules in a particular windows memory image.""" _required_framework_version = (1, 0, 0) _version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.VersionRequirement(name = 'pslist', component = pslist.PsList, version = (2, 0, 0)), requirements.VersionRequirement(name = 'info', component = info.Info, version = (1, 0, 0)), requirements.ListRequirement(name = 'pid', element_type = int, description = "Process IDs to include (all other processes are excluded)", optional = True), requirements.BooleanRequirement(name = 'dump', description = "Extract listed DLLs", default = False, optional = True) ] @classmethod def dump_pe(cls, context: interfaces.context.ContextInterface, pe_table_name: str, dll_entry: interfaces.objects.ObjectInterface, open_method: Type[interfaces.plugins.FileHandlerInterface], layer_name: str = None, prefix: str = '') -> Optional[interfaces.plugins.FileHandlerInterface]: """Extracts the complete data for a process as a FileInterface Args: context: the context to operate upon pe_table_name: the name for the symbol table containing the PE format symbols dll_entry: the object representing the module layer_name: the layer that the DLL lives within open_method: class for constructing output files Returns: An open FileHandlerInterface object containing the complete data for the DLL or None in the case of failure """ try: try: name = dll_entry.FullDllName.get_string() except exceptions.InvalidAddressException: name = 'UnreadbleDLLName' if layer_name is None: layer_name = dll_entry.vol.layer_name file_handle = open_method("{}{}.{:#x}.{:#x}.dmp".format(prefix, ntpath.basename(name), dll_entry.vol.offset, dll_entry.DllBase)) dos_header = context.object(pe_table_name + constants.BANG + "_IMAGE_DOS_HEADER", offset = dll_entry.DllBase, layer_name = layer_name) for offset, data in dos_header.reconstruct(): file_handle.seek(offset) file_handle.write(data) except (IOError, exceptions.VolatilityException, OverflowError, ValueError) as excp: vollog.debug("Unable to dump dll at offset {}: {}".format(dll_entry.DllBase, excp)) return None return file_handle def _generator(self, procs): pe_table_name = intermed.IntermediateSymbolTable.create(self.context, self.config_path, "windows", "pe", class_types = pe.class_types) kuser = info.Info.get_kuser_structure(self.context, self.config['primary'], self.config['nt_symbols']) nt_major_version = int(kuser.NtMajorVersion) nt_minor_version = int(kuser.NtMinorVersion) # LoadTime only applies to versions higher or equal to Window 7 (6.1 and higher) dll_load_time_field = (nt_major_version > 6) or (nt_major_version == 6 and nt_minor_version >= 1) for proc in procs: proc_id = proc.UniqueProcessId proc_layer_name = proc.add_process_layer() for entry in proc.load_order_modules(): BaseDllName = FullDllName = renderers.UnreadableValue() try: BaseDllName = entry.BaseDllName.get_string() # We assume that if the BaseDllName points to an invalid buffer, so will FullDllName FullDllName = entry.FullDllName.get_string() except exceptions.InvalidAddressException: pass if dll_load_time_field: # Versions prior to 6.1 won't have the LoadTime attribute # and 32bit version shouldn't have the Quadpart according to MSDN try: DllLoadTime = conversion.wintime_to_datetime(entry.LoadTime.QuadPart) except exceptions.InvalidAddressException: DllLoadTime = renderers.UnreadableValue() else: DllLoadTime = renderers.NotApplicableValue() file_output = "Disabled" if self.config['dump']: file_handle = self.dump_pe(self.context, pe_table_name, entry, self.open, proc_layer_name, prefix = "pid.{}.".format(proc_id)) file_output = "Error outputting file" if file_handle: file_handle.close() file_output = file_handle.preferred_filename yield (0, (proc.UniqueProcessId, proc.ImageFileName.cast("string", max_length = proc.ImageFileName.vol.count, errors = 'replace'), format_hints.Hex(entry.DllBase), format_hints.Hex(entry.SizeOfImage), BaseDllName, FullDllName, DllLoadTime, file_output)) def generate_timeline(self): for row in self._generator( pslist.PsList.list_processes(context = self.context, layer_name = self.config['primary'], symbol_table = self.config['nt_symbols'])): _depth, row_data = row if not isinstance(row_data[6], datetime.datetime): continue description = "DLL Load: Process {} {} Loaded {} ({}) Size {} Offset {}".format( row_data[0], row_data[1], row_data[4], row_data[5], row_data[3], row_data[2]) yield (description, timeliner.TimeLinerType.CREATED, row_data[6]) def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), ("Base", format_hints.Hex), ("Size", format_hints.Hex), ("Name", str), ("Path", str), ("LoadTime", datetime.datetime), ("File output", str)], self._generator( pslist.PsList.list_processes(context = self.context, layer_name = self.config['primary'], symbol_table = self.config['nt_symbols'], filter_func = filter_func))) volatility3-1.0.1/volatility3/framework/plugins/windows/driverirp.py000066400000000000000000000071221405267600400260150ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from volatility3.framework import constants from volatility3.framework import renderers, exceptions, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.plugins.windows import ssdt, driverscan MAJOR_FUNCTIONS = [ 'IRP_MJ_CREATE', 'IRP_MJ_CREATE_NAMED_PIPE', 'IRP_MJ_CLOSE', 'IRP_MJ_READ', 'IRP_MJ_WRITE', 'IRP_MJ_QUERY_INFORMATION', 'IRP_MJ_SET_INFORMATION', 'IRP_MJ_QUERY_EA', 'IRP_MJ_SET_EA', 'IRP_MJ_FLUSH_BUFFERS', 'IRP_MJ_QUERY_VOLUME_INFORMATION', 'IRP_MJ_SET_VOLUME_INFORMATION', 'IRP_MJ_DIRECTORY_CONTROL', 'IRP_MJ_FILE_SYSTEM_CONTROL', 'IRP_MJ_DEVICE_CONTROL', 'IRP_MJ_INTERNAL_DEVICE_CONTROL', 'IRP_MJ_SHUTDOWN', 'IRP_MJ_LOCK_CONTROL', 'IRP_MJ_CLEANUP', 'IRP_MJ_CREATE_MAILSLOT', 'IRP_MJ_QUERY_SECURITY', 'IRP_MJ_SET_SECURITY', 'IRP_MJ_POWER', 'IRP_MJ_SYSTEM_CONTROL', 'IRP_MJ_DEVICE_CHANGE', 'IRP_MJ_QUERY_QUOTA', 'IRP_MJ_SET_QUOTA', 'IRP_MJ_PNP' ] class DriverIrp(interfaces.plugins.PluginInterface): """List IRPs for drivers in a particular windows memory image.""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.PluginRequirement(name = 'ssdt', plugin = ssdt.SSDT, version = (1, 0, 0)), requirements.PluginRequirement(name = 'driverscan', plugin = driverscan.DriverScan, version = (1, 0, 0)), requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), ] def _generator(self): collection = ssdt.SSDT.build_module_collection(self.context, self.config['primary'], self.config['nt_symbols']) for driver in driverscan.DriverScan.scan_drivers(self.context, self.config['primary'], self.config['nt_symbols']): try: driver_name = driver.get_driver_name() except (ValueError, exceptions.InvalidAddressException): driver_name = renderers.NotApplicableValue() for i, address in enumerate(driver.MajorFunction): module_symbols = collection.get_module_symbols_by_absolute_location(address) for module_name, symbol_generator in module_symbols: symbols_found = False for symbol in symbol_generator: symbols_found = True yield (0, (format_hints.Hex(driver.vol.offset), driver_name, MAJOR_FUNCTIONS[i], format_hints.Hex(address), module_name, symbol.split(constants.BANG)[1])) if not symbols_found: yield (0, (format_hints.Hex(driver.vol.offset), driver_name, MAJOR_FUNCTIONS[i], format_hints.Hex(address), module_name, renderers.NotAvailableValue())) def run(self): return renderers.TreeGrid([ ("Offset", format_hints.Hex), ("Driver Name", str), ("IRP", str), ("Address", format_hints.Hex), ("Module", str), ("Symbol", str), ], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/windows/driverscan.py000066400000000000000000000065651405267600400261610ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from typing import Iterable from volatility3.framework import renderers, interfaces, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.plugins.windows import poolscanner class DriverScan(interfaces.plugins.PluginInterface): """Scans for drivers present in a particular windows memory image.""" _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.PluginRequirement(name = 'poolscanner', plugin = poolscanner.PoolScanner, version = (1, 0, 0)), ] @classmethod def scan_drivers(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str) -> \ Iterable[interfaces.objects.ObjectInterface]: """Scans for drivers using the poolscanner module and constraints. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols Returns: A list of Driver objects as found from the `layer_name` layer based on Driver pool signatures """ constraints = poolscanner.PoolScanner.builtin_constraints(symbol_table, [b'Dri\xf6', b'Driv']) for result in poolscanner.PoolScanner.generate_pool_scan(context, layer_name, symbol_table, constraints): _constraint, mem_object, _header = result yield mem_object def _generator(self): for driver in self.scan_drivers(self.context, self.config['primary'], self.config['nt_symbols']): try: driver_name = driver.get_driver_name() except (ValueError, exceptions.InvalidAddressException): driver_name = renderers.NotApplicableValue() try: service_key = driver.DriverExtension.ServiceKeyName.String except exceptions.InvalidAddressException: service_key = renderers.NotApplicableValue() try: name = driver.DriverName.String except exceptions.InvalidAddressException: name = renderers.NotApplicableValue() yield (0, (format_hints.Hex(driver.vol.offset), format_hints.Hex(driver.DriverStart), format_hints.Hex(driver.DriverSize), service_key, driver_name, name)) def run(self): return renderers.TreeGrid([("Offset", format_hints.Hex), ("Start", format_hints.Hex), ("Size", format_hints.Hex), ("Service Key", str), ("Driver Name", str), ("Name", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/windows/dumpfiles.py000077500000000000000000000342221405267600400260030ustar00rootroot00000000000000# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging import ntpath from volatility3.framework import interfaces, renderers, exceptions, constants from volatility3.plugins.windows import handles from volatility3.plugins.windows import pslist from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.framework.objects import utility from typing import List, Tuple, Type, Optional vollog = logging.getLogger(__name__) FILE_DEVICE_DISK = 0x7 FILE_DEVICE_NETWORK_FILE_SYSTEM = 0x14 EXTENSION_CACHE_MAP = { "dat": "DataSectionObject", "img": "ImageSectionObject", "vacb": "SharedCacheMap", } class DumpFiles(interfaces.plugins.PluginInterface): """Dumps cached file contents from Windows memory samples.""" _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.IntRequirement(name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True), requirements.IntRequirement(name = 'virtaddr', description = "Dump a single _FILE_OBJECT at this virtual address", optional = True), requirements.IntRequirement(name = 'physaddr', description = "Dump a single _FILE_OBJECT at this physical address", optional = True), requirements.VersionRequirement(name = 'pslist', component = pslist.PsList, version = (2, 0, 0)), requirements.VersionRequirement(name = 'handles', component = handles.Handles, version = (1, 0, 0)) ] @classmethod def dump_file_producer(cls, file_object: interfaces.objects.ObjectInterface, memory_object: interfaces.objects.ObjectInterface, open_method: Type[interfaces.plugins.FileHandlerInterface], layer: interfaces.layers.DataLayerInterface, desired_file_name: str) -> Optional[interfaces.plugins.FileHandlerInterface]: """Produce a file from the memory object's get_available_pages() interface. :param file_object: the parent _FILE_OBJECT :param memory_object: the _CONTROL_AREA or _SHARED_CACHE_MAP :param open_method: class for constructing output files :param layer: the memory layer to read from :param desired_file_name: name of the output file :return: result status """ filedata = open_method(desired_file_name) try: # Description of these variables: # memoffset: offset in the specified layer where the page begins # fileoffset: write to this offset in the destination file # datasize: size of the page # track number of bytes written so we don't write empty files to disk bytes_written = 0 for memoffset, fileoffset, datasize in memory_object.get_available_pages(): data = layer.read(memoffset, datasize, pad = True) bytes_written += len(data) filedata.seek(fileoffset) filedata.write(data) if not bytes_written: vollog.debug("No data is cached for the file at {0:#x}".format(file_object.vol.offset)) return None else: vollog.debug("Stored {}".format(filedata.preferred_filename)) return filedata except exceptions.InvalidAddressException: vollog.debug("Unable to dump file at {0:#x}".format(file_object.vol.offset)) return None @classmethod def process_file_object(cls, context: interfaces.context.ContextInterface, primary_layer_name: str, open_method: Type[interfaces.plugins.FileHandlerInterface], file_obj: interfaces.objects.ObjectInterface) -> Tuple: """Given a FILE_OBJECT, dump data to separate files for each of the three file caches. :param context: the context to operate upon :param primary_layer_name: primary/virtual layer to operate on :param open_method: class for constructing output files :param file_object: the FILE_OBJECT """ # Filtering by these types of devices prevents us from processing other types of devices that # use the "File" object type, such as \Device\Tcp and \Device\NamedPipe. if file_obj.DeviceObject.DeviceType not in [FILE_DEVICE_DISK, FILE_DEVICE_NETWORK_FILE_SYSTEM]: vollog.log(constants.LOGLEVEL_VVV, "The file object at {0:#x} is not a file on disk".format(file_obj.vol.offset)) return # Depending on the type of object (DataSection, ImageSection, SharedCacheMap) we may need to # read from the memory layer or the primary layer. memory_layer_name = context.layers[primary_layer_name].config['memory_layer'] memory_layer = context.layers[memory_layer_name] primary_layer = context.layers[primary_layer_name] obj_name = file_obj.file_name_with_device() # This stores a list of tuples, describing what to dump and how to dump it. # Ex: ( # memory_object with get_available_pages() API (either CONTROL_AREA or SHARED_CACHE_MAP), # layer to read from, # file extension to apply, # ) dump_parameters = [] # The DataSectionObject and ImageSectionObject caches are handled in basically the same way. # We carve these "pages" from the memory_layer. for member_name, extension in [("DataSectionObject", "dat"), ("ImageSectionObject", "img")]: try: section_obj = getattr(file_obj.SectionObjectPointer, member_name) control_area = section_obj.dereference().cast("_CONTROL_AREA") if control_area.is_valid(): dump_parameters.append((control_area, memory_layer, extension)) except exceptions.InvalidAddressException: vollog.log(constants.LOGLEVEL_VVV, "{0} is unavailable for file {1:#x}".format(member_name, file_obj.vol.offset)) # The SharedCacheMap is handled differently than the caches above. # We carve these "pages" from the primary_layer. try: scm_pointer = file_obj.SectionObjectPointer.SharedCacheMap shared_cache_map = scm_pointer.dereference().cast("_SHARED_CACHE_MAP") if shared_cache_map.is_valid(): dump_parameters.append((shared_cache_map, primary_layer, "vacb")) except exceptions.InvalidAddressException: vollog.log(constants.LOGLEVEL_VVV, "SharedCacheMap is unavailable for file {0:#x}".format(file_obj.vol.offset)) for memory_object, layer, extension in dump_parameters: cache_name = EXTENSION_CACHE_MAP[extension] desired_file_name = "file.{0:#x}.{1:#x}.{2}.{3}.{4}".format(file_obj.vol.offset, memory_object.vol.offset, cache_name, ntpath.basename(obj_name), extension) file_handle = DumpFiles.dump_file_producer(file_obj, memory_object, open_method, layer, desired_file_name) file_output = "Error dumping file" if file_handle: file_handle.close() file_output = file_handle.preferred_filename yield ( cache_name, format_hints.Hex(file_obj.vol.offset), ntpath.basename(obj_name), # temporary, so its easier to visualize output file_output) def _generator(self, procs: List, offsets: List): if procs: # The handles plugin doesn't expose any staticmethod/classmethod, and it also requires stashing # private variables, so we need an instance (for now, anyway). We _could_ call Handles._generator() # to do some of the other work that is duplicated here, but then we'd need to parse the TreeGrid # results instead of just dealing with them as direct objects here. handles_plugin = handles.Handles(context = self.context, config_path = self._config_path) type_map = handles_plugin.get_type_map(context = self.context, layer_name = self.config["primary"], symbol_table = self.config["nt_symbols"]) cookie = handles_plugin.find_cookie(context = self.context, layer_name = self.config["primary"], symbol_table = self.config["nt_symbols"]) for proc in procs: try: object_table = proc.ObjectTable except exceptions.InvalidAddressException: vollog.log(constants.LOGLEVEL_VVV, "Cannot access _EPROCESS.ObjectTable at {0:#x}".format(proc.vol.offset)) continue for entry in handles_plugin.handles(object_table): try: obj_type = entry.get_object_type(type_map, cookie) if obj_type == "File": file_obj = entry.Body.cast("_FILE_OBJECT") for result in self.process_file_object(self.context, self.config["primary"], self.open, file_obj): yield (0, result) except exceptions.InvalidAddressException: vollog.log(constants.LOGLEVEL_VVV, "Cannot extract file from _OBJECT_HEADER at {0:#x}".format(entry.vol.offset)) # Pull file objects from the VADs. This will produce DLLs and EXEs that are # mapped into the process as images, but that the process doesn't have an # explicit handle remaining open to those files on disk. for vad in proc.get_vad_root().traverse(): try: if vad.has_member("ControlArea"): # Windows xp and 2003 file_obj = vad.ControlArea.FilePointer.dereference() elif vad.has_member("Subsection"): # Vista and beyond file_obj = vad.Subsection.ControlArea.FilePointer.dereference().cast("_FILE_OBJECT") else: continue if not file_obj.is_valid(): continue for result in self.process_file_object(self.context, self.config["primary"], self.open, file_obj): yield (0, result) except exceptions.InvalidAddressException: vollog.log(constants.LOGLEVEL_VVV, "Cannot extract file from VAD at {0:#x}".format(vad.vol.offset)) elif offsets: # Now process any offsets explicitly requested by the user. for offset, is_virtual in offsets: try: layer_name = self.config["primary"] # switch to a memory layer if the user provided --physaddr instead of --virtaddr if not is_virtual: layer_name = self.context.layers[layer_name].config["memory_layer"] file_obj = self.context.object(self.config["nt_symbols"] + constants.BANG + "_FILE_OBJECT", layer_name = layer_name, native_layer_name = self.config["primary"], offset = offset) for result in self.process_file_object(self.context, self.config["primary"], self.open, file_obj): yield (0, result) except exceptions.InvalidAddressException: vollog.log(constants.LOGLEVEL_VVV, "Cannot extract file at {0:#x}".format(offset)) def run(self): # a list of tuples (, ) where is the address and is True for virtual. offsets = [] # a list of processes matching the pid filter. all files for these process(es) will be dumped. procs = [] if self.config.get("virtaddr", None) is not None: offsets.append((self.config["virtaddr"], True)) elif self.config.get("physaddr", None) is not None: offsets.append((self.config["physaddr"], False)) else: filter_func = pslist.PsList.create_pid_filter([self.config.get("pid", None)]) procs = pslist.PsList.list_processes(self.context, self.config["primary"], self.config["nt_symbols"], filter_func = filter_func) return renderers.TreeGrid([("Cache", str), ("FileObject", format_hints.Hex), ("FileName", str), ("Result", str)], self._generator(procs, offsets)) volatility3-1.0.1/volatility3/framework/plugins/windows/envars.py000066400000000000000000000210021405267600400252760ustar00rootroot00000000000000# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 import logging from typing import List from volatility3.framework import renderers, interfaces, objects, exceptions, constants from volatility3.framework.configuration import requirements from volatility3.framework.layers import registry from volatility3.plugins.windows import pslist from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) class Envars(interfaces.plugins.PluginInterface): "Display process environment variables" _version = (1, 0, 0) _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, optional = True), requirements.BooleanRequirement(name = 'silent', description = 'Suppress common and non-persistent variables', optional = True), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.PluginRequirement(name = 'hivelist', plugin = hivelist.HiveList, version = (1, 0, 0)) ] def _get_silent_vars(self) -> List[str]: """Enumerate persistent & common variables. This function collects the global (all users) and user-specific environment variables from the registry. Any variables in a process env block that does not exist in the persistent list was explicitly set with the SetEnvironmentVariable() API. """ values = [] for hive in hivelist.HiveList.list_hives(context = self.context, base_config_path = self.config_path, layer_name = self.config['primary'], symbol_table = self.config['nt_symbols'], hive_offsets = None): sys = False ntuser = False ## The global variables try: key = hive.get_key('CurrentControlSet\\Control\\Session Manager\\Environment') sys = True except KeyError: try: key = hive.get_key('ControlSet001\\Control\\Session Manager\\Environment') sys = True except KeyError: pass if sys: try: for node in key.get_values(): try: value_node_name = node.get_name() if value_node_name: values.append(value_node_name) except (exceptions.InvalidAddressException, registry.RegistryFormatException) as excp: vollog.log( constants.LOGLEVEL_VVV, "Error while parsing global environment variables keys (some keys might be excluded)") continue except KeyError: pass ## The user-specific variables try: key = hive.get_key('Environment') ntuser = True except KeyError: pass if ntuser: try: for node in key.get_values(): try: value_node_name = node.get_name() if value_node_name: values.append(value_node_name) except (exceptions.InvalidAddressException, registry.RegistryFormatException) as excp: vollog.log( constants.LOGLEVEL_VVV, "Error while parsing user environment variables keys (some keys might be excluded)") continue except KeyError: pass ## The volatile user variables try: key = hive.get_key('Volatile Environment') except KeyError: continue try: for node in key.get_values(): try: value_node_name = node.get_name() if value_node_name: values.append(value_node_name) except (exceptions.InvalidAddressException, registry.RegistryFormatException) as excp: vollog.log( constants.LOGLEVEL_VVV, "Error while parsing volatile environment variables keys (some keys might be excluded)") continue except KeyError: continue ## These are variables set explicitly but are ## common enough to ignore safely. values.extend([ "ProgramFiles", "CommonProgramFiles", "SystemDrive", "SystemRoot", "ProgramData", "PUBLIC", "ALLUSERSPROFILE", "COMPUTERNAME", "SESSIONNAME", "USERNAME", "USERPROFILE", "PROMPT", "USERDOMAIN", "AppData", "CommonFiles", "CommonDesktop", "CommonProgramGroups", "CommonStartMenu", "CommonStartUp", "Cookies", "DesktopDirectory", "Favorites", "History", "NetHood", "PersonalDocuments", "RecycleBin", "StartMenu", "Templates", "AltStartup", "CommonFavorites", "ConnectionWizard", "DocAndSettingRoot", "InternetCache", "windir", "Path", "HOMEDRIVE", "PROCESSOR_ARCHITECTURE", "NUMBER_OF_PROCESSORS", "ProgramFiles(x86)", "CommonProgramFiles(x86)", "CommonProgramW6432", "PSModulePath", "PROCESSOR_IDENTIFIER", "FP_NO_HOST_CHECK", "LOCALAPPDATA", "TMP", "ProgramW6432", ]) return values def _generator(self, data): silent_vars = [] if self.config.get('SILENT', None): silent_vars = self._get_silent_vars() for task in data: for var, val in task.environment_variables(): if self.config.get('silent', None): if var in silent_vars: continue yield (0, (int(task.UniqueProcessId), str(objects.utility.array_to_string(task.ImageFileName)), hex(task.get_peb().ProcessParameters.Environment.vol.offset), str(var), str(val))) def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), ("Block", str), ("Variable", str), ("Value", str)], self._generator( pslist.PsList.list_processes(context = self.context, layer_name = self.config['primary'], symbol_table = self.config['nt_symbols'], filter_func = filter_func))) volatility3-1.0.1/volatility3/framework/plugins/windows/filescan.py000066400000000000000000000052361405267600400255770ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from typing import Iterable from volatility3.framework import renderers, interfaces, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.plugins.windows import poolscanner class FileScan(interfaces.plugins.PluginInterface): """Scans for file objects present in a particular windows memory image.""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.PluginRequirement(name = 'poolscanner', plugin = poolscanner.PoolScanner, version = (1, 0, 0)), ] @classmethod def scan_files(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str) -> \ Iterable[interfaces.objects.ObjectInterface]: """Scans for file objects using the poolscanner module and constraints. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols Returns: A list of File objects as found from the `layer_name` layer based on File pool signatures """ constraints = poolscanner.PoolScanner.builtin_constraints(symbol_table, [b'Fil\xe5', b'File']) for result in poolscanner.PoolScanner.generate_pool_scan(context, layer_name, symbol_table, constraints): _constraint, mem_object, _header = result yield mem_object def _generator(self): for fileobj in self.scan_files(self.context, self.config['primary'], self.config['nt_symbols']): try: file_name = fileobj.FileName.String except exceptions.InvalidAddressException: continue yield (0, (format_hints.Hex(fileobj.vol.offset), file_name, fileobj.Size)) def run(self): return renderers.TreeGrid([("Offset", format_hints.Hex), ("Name", str), ("Size", int)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/windows/getservicesids.py000066400000000000000000000076471405267600400270460ustar00rootroot00000000000000# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 import hashlib import json import logging import os import struct from typing import List from volatility3.framework import renderers, interfaces, constants, exceptions from volatility3.framework.configuration import requirements from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) def createservicesid(svc) -> str: """ Calculate the Service SID """ uni = ''.join([c + '\x00' for c in svc]) sha = hashlib.sha1(uni.upper().encode("utf-8")).digest() # pylint: disable-msg=E1101 dec = list() for i in range(5): ## The use of struct here is OK. It doesn't make much sense ## to leverage obj.Object inside this loop. dec.append(struct.unpack(' List[interfaces.configuration.RequirementInterface]: # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.PluginRequirement(name = 'hivelist', plugin = hivelist.HiveList, version = (1, 0, 0)) ] def _generator(self): # Go all over the hives for hive in hivelist.HiveList.list_hives(context = self.context, base_config_path = self.config_path, layer_name = self.config['primary'], symbol_table = self.config['nt_symbols'], hive_offsets = None): # Get ConrolSet\Services. try: services = hive.get_key(r"CurrentControlSet\Services") except (KeyError, exceptions.InvalidAddressException): try: services = hive.get_key(r"ControlSet001\Services") except (KeyError, exceptions.InvalidAddressException): continue if services: for s in services.get_subkeys(): if s.get_name() not in self.servicesids.values(): sid = createservicesid(s.get_name()) yield (0, (sid, s.get_name())) def run(self): return renderers.TreeGrid([("SID", str), ("Service", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/windows/getsids.py000066400000000000000000000176371405267600400254650ustar00rootroot00000000000000# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 import json import logging import ntpath import os import re from typing import List, Dict, Union from volatility3.framework import renderers, interfaces, objects, exceptions, constants, layers from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.framework.symbols.windows.extensions import registry from volatility3.plugins.windows import pslist from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) def find_sid_re(sid_string, sid_re_list) -> Union[str, interfaces.renderers.BaseAbsentValue]: for reg, name in sid_re_list: if reg.search(sid_string): return name return renderers.NotAvailableValue() class GetSIDs(interfaces.plugins.PluginInterface): """Print the SIDs owning each process""" _version = (1, 0, 0) _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) for plugin_dir in constants.PLUGINS_PATH: sids_json_file_name = os.path.join(plugin_dir, os.path.join("windows", "sids_and_privileges.json")) if os.path.exists(sids_json_file_name): break else: vollog.log(constants.LOGLEVEL_VVV, 'sids_and_privileges.json file is missing plugin error') raise RuntimeError("The sids_and_privileges.json file missed from you plugin directory") # Get all the sids from the json file. with open(sids_json_file_name, 'r') as file_handle: sids_json_data = json.load(file_handle) self.servicesids = sids_json_data['service sids'] self.well_known_sids = sids_json_data['well known'] # Compile all the sids regex. self.well_known_sid_re = [(re.compile(c_list[0]), c_list[1]) for c_list in sids_json_data['sids re']] @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, optional = True), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.PluginRequirement(name = 'hivelist', plugin = hivelist.HiveList, version = (1, 0, 0)) ] def lookup_user_sids(self) -> Dict[str, str]: """ Enumerate the registry for all the users. Returns: An dictionary of {sid: user name} """ key = "Microsoft\\Windows NT\\CurrentVersion\\ProfileList" val = "ProfileImagePath" sids = {} for hive in hivelist.HiveList.list_hives(context = self.context, base_config_path = self.config_path, layer_name = self.config['primary'], symbol_table = self.config['nt_symbols'], hive_offsets = None): try: for subkey in hive.get_key(key).get_subkeys(): sid = str(subkey.get_name()) path = "" for node in subkey.get_values(): try: value_node_name = node.get_name() or "(Default)" except (exceptions.InvalidAddressException, layers.registry.RegistryFormatException) as excp: continue try: value_data = node.decode_data() if isinstance(value_data, int): value_data = format_hints.MultiTypeData(value_data, encoding = 'utf-8') elif registry.RegValueTypes.get(node.Type) == registry.RegValueTypes.REG_BINARY: value_data = format_hints.MultiTypeData(value_data, show_hex = True) elif registry.RegValueTypes.get(node.Type) == registry.RegValueTypes.REG_MULTI_SZ: value_data = format_hints.MultiTypeData(value_data, encoding = 'utf-16-le', split_nulls = True) else: value_data = format_hints.MultiTypeData(value_data, encoding = 'utf-16-le') if value_node_name == val: path = str(value_data).replace('\\x00', '')[:-1] user = ntpath.basename(path) sids[sid] = user except (ValueError, exceptions.InvalidAddressException, layers.registry.RegistryFormatException) as excp: continue except (KeyError, exceptions.InvalidAddressException): continue return sids def _generator(self, procs): user_sids = self.lookup_user_sids() # Go all over the process list, get the token for task in procs: # Make sure we have a valid token try: token = task.Token.dereference().cast("_TOKEN") except exceptions.InvalidAddressException: token = False if not token or not isinstance(token, interfaces.objects.ObjectInterface): yield (0, [int(task.UniqueProcessId), str(task.ImageFileName), "Token unreadable", ""]) continue # Go all over the sids and try to translate them with one of the tables we have for sid_string in token.get_sids(): if sid_string in self.well_known_sids: sid_name = self.well_known_sids[sid_string] elif sid_string in self.servicesids: sid_name = self.servicesids[sid_string] elif sid_string in user_sids: sid_name = user_sids[sid_string] else: sid_name_re = find_sid_re(sid_string, self.well_known_sid_re) if sid_name_re: sid_name = sid_name_re else: sid_name = "" yield (0, (task.UniqueProcessId, objects.utility.array_to_string(task.ImageFileName), sid_string, sid_name)) def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), ("SID", str), ("Name", str)], self._generator( pslist.PsList.list_processes(context = self.context, layer_name = self.config['primary'], symbol_table = self.config['nt_symbols'], filter_func = filter_func))) volatility3-1.0.1/volatility3/framework/plugins/windows/handles.py000066400000000000000000000354551405267600400254370ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import List, Optional, Dict from volatility3.framework import constants, exceptions, renderers, interfaces, symbols from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility from volatility3.framework.renderers import format_hints from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) try: import capstone has_capstone = True except ImportError: has_capstone = False class Handles(interfaces.plugins.PluginInterface): """Lists process open handles.""" _required_framework_version = (1, 0, 0) _version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self._sar_value = None self._type_map = None self._cookie = None self._level_mask = 7 @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.ListRequirement(name = 'pid', element_type = int, description = "Process IDs to include (all other processes are excluded)", optional = True), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)) ] def _decode_pointer(self, value, magic): """Windows encodes pointers to objects and decodes them on the fly before using them. This function mimics the decoding routine so we can generate the proper pointer values as well. """ value = value & 0xFFFFFFFFFFFFFFF8 value = value >> magic # if (value & (1 << 47)): # value = value | 0xFFFF000000000000 return value def _get_item(self, handle_table_entry, handle_value): """Given a handle table entry (_HANDLE_TABLE_ENTRY) structure from a process' handle table, determine where the corresponding object's _OBJECT_HEADER can be found.""" virtual = self.config["primary"] try: # before windows 7 if not self.context.layers[virtual].is_valid(handle_table_entry.Object): return None fast_ref = handle_table_entry.Object.cast("_EX_FAST_REF") object_header = fast_ref.dereference().cast("_OBJECT_HEADER") object_header.GrantedAccess = handle_table_entry.GrantedAccess except AttributeError: # starting with windows 8 is_64bit = symbols.symbol_table_is_64bit(self.context, self.config["nt_symbols"]) if is_64bit: if handle_table_entry.LowValue == 0: return None magic = self.find_sar_value() # is this the right thing to raise here? if magic is None: if has_capstone: raise AttributeError("Unable to find the SAR value for decoding handle table pointers") else: raise exceptions.MissingModuleException( "capstone", "Requires capstone to find the SAR value for decoding handle table pointers") offset = self._decode_pointer(handle_table_entry.LowValue, magic) else: if handle_table_entry.InfoTable == 0: return None offset = handle_table_entry.InfoTable & ~7 # print("LowValue: {0:#x} Magic: {1:#x} Offset: {2:#x}".format(handle_table_entry.InfoTable, magic, offset)) object_header = self.context.object(self.config["nt_symbols"] + constants.BANG + "_OBJECT_HEADER", virtual, offset = offset) object_header.GrantedAccess = handle_table_entry.GrantedAccessBits object_header.HandleValue = handle_value return object_header def find_sar_value(self): """Locate ObpCaptureHandleInformationEx if it exists in the sample. Once found, parse it for the SAR value that we need to decode pointers in the _HANDLE_TABLE_ENTRY which allows us to find the associated _OBJECT_HEADER. """ if self._sar_value is None: if not has_capstone: return None virtual_layer_name = self.config['primary'] kvo = self.context.layers[virtual_layer_name].config['kernel_virtual_offset'] ntkrnlmp = self.context.module(self.config["nt_symbols"], layer_name = virtual_layer_name, offset = kvo) try: func_addr = ntkrnlmp.get_symbol("ObpCaptureHandleInformationEx").address except exceptions.SymbolError: return None data = self.context.layers.read(virtual_layer_name, kvo + func_addr, 0x200) if data is None: return None md = capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_64) for (address, size, mnemonic, op_str) in md.disasm_lite(data, kvo + func_addr): # print("{} {} {} {}".format(address, size, mnemonic, op_str)) if mnemonic.startswith("sar"): # if we don't want to parse op strings, we can disasm the # single sar instruction again, but we use disasm_lite for speed self._sar_value = int(op_str.split(",")[1].strip(), 16) break return self._sar_value @classmethod def get_type_map(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str) -> Dict[int, str]: """List the executive object types (_OBJECT_TYPE) using the ObTypeIndexTable or ObpObjectTypes symbol (differs per OS). This method will be necessary for determining what type of object we have given an object header. Note: The object type index map was hard coded into profiles in previous versions of volatility. It is now generated dynamically. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols Returns: A mapping of type indicies to type names """ type_map = {} # type: Dict[int, str] kvo = context.layers[layer_name].config['kernel_virtual_offset'] ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo) try: table_addr = ntkrnlmp.get_symbol("ObTypeIndexTable").address except exceptions.SymbolError: table_addr = ntkrnlmp.get_symbol("ObpObjectTypes").address trans_layer = context.layers[layer_name] if not trans_layer.is_valid(kvo + table_addr): return type_map ptrs = ntkrnlmp.object(object_type = "array", offset = table_addr, subtype = ntkrnlmp.get_type("pointer"), count = 100) for i, ptr in enumerate(ptrs): # type: ignore # the first entry in the table is always null. break the # loop when we encounter the first null entry after that if i > 0 and ptr == 0: break try: objt = ptr.dereference().cast(symbol_table + constants.BANG + "_OBJECT_TYPE") type_name = objt.Name.String except exceptions.InvalidAddressException: vollog.log(constants.LOGLEVEL_VVV, "Cannot access _OBJECT_HEADER Name at {0:#x}".format(objt.vol.offset)) continue type_map[i] = type_name return type_map @classmethod def find_cookie(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str) -> Optional[interfaces.objects.ObjectInterface]: """Find the ObHeaderCookie value (if it exists)""" try: offset = context.symbol_space.get_symbol(symbol_table + constants.BANG + "ObHeaderCookie").address except exceptions.SymbolError: return None kvo = context.layers[layer_name].config['kernel_virtual_offset'] return context.object(symbol_table + constants.BANG + "unsigned int", layer_name, offset = kvo + offset) def _make_handle_array(self, offset, level, depth = 0): """Parse a process' handle table and yield valid handle table entries, going as deep into the table "levels" as necessary.""" virtual = self.config["primary"] kvo = self.context.layers[virtual].config['kernel_virtual_offset'] ntkrnlmp = self.context.module(self.config["nt_symbols"], layer_name = virtual, offset = kvo) if level > 0: subtype = ntkrnlmp.get_type("pointer") count = 0x1000 / subtype.size else: subtype = ntkrnlmp.get_type("_HANDLE_TABLE_ENTRY") count = 0x1000 / subtype.size if not self.context.layers[virtual].is_valid(offset): return table = ntkrnlmp.object(object_type = "array", offset = offset, subtype = subtype, count = int(count), absolute = True) layer_object = self.context.layers[virtual] masked_offset = (offset & layer_object.maximum_address) for entry in table: if level > 0: for x in self._make_handle_array(entry, level - 1, depth): yield x depth += 1 else: handle_multiplier = 4 handle_level_base = depth * count * handle_multiplier handle_value = ((entry.vol.offset - masked_offset) / (subtype.size / handle_multiplier)) + handle_level_base item = self._get_item(entry, handle_value) if item is None: continue try: if item.TypeIndex != 0x0: yield item except AttributeError: if item.Type.Name: yield item except exceptions.InvalidAddressException: continue def handles(self, handle_table): try: TableCode = handle_table.TableCode & ~self._level_mask table_levels = handle_table.TableCode & self._level_mask except exceptions.InvalidAddressException: vollog.log(constants.LOGLEVEL_VVV, "Handle table parsing was aborted due to an invalid address exception") return for handle_table_entry in self._make_handle_array(TableCode, table_levels): yield handle_table_entry def _generator(self, procs): type_map = self.get_type_map(context = self.context, layer_name = self.config["primary"], symbol_table = self.config["nt_symbols"]) cookie = self.find_cookie(context = self.context, layer_name = self.config["primary"], symbol_table = self.config["nt_symbols"]) for proc in procs: try: object_table = proc.ObjectTable except exceptions.InvalidAddressException: vollog.log(constants.LOGLEVEL_VVV, "Cannot access _EPROCESS.ObjectType at {0:#x}".format(proc.vol.offset)) continue process_name = utility.array_to_string(proc.ImageFileName) for entry in self.handles(object_table): try: obj_type = entry.get_object_type(type_map, cookie) if obj_type is None: continue if obj_type == "File": item = entry.Body.cast("_FILE_OBJECT") obj_name = item.file_name_with_device() elif obj_type == "Process": item = entry.Body.cast("_EPROCESS") obj_name = "{} Pid {}".format(utility.array_to_string(proc.ImageFileName), item.UniqueProcessId) elif obj_type == "Thread": item = entry.Body.cast("_ETHREAD") obj_name = "Tid {} Pid {}".format(item.Cid.UniqueThread, item.Cid.UniqueProcess) elif obj_type == "Key": item = entry.Body.cast("_CM_KEY_BODY") obj_name = item.get_full_key_name() else: try: obj_name = entry.NameInfo.Name.String except (ValueError, exceptions.InvalidAddressException): obj_name = "" except (exceptions.InvalidAddressException): vollog.log(constants.LOGLEVEL_VVV, "Cannot access _OBJECT_HEADER at {0:#x}".format(entry.vol.offset)) continue yield (0, (proc.UniqueProcessId, process_name, format_hints.Hex(entry.Body.vol.offset), format_hints.Hex(entry.HandleValue), obj_type, format_hints.Hex(entry.GrantedAccess), obj_name)) def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), ("Offset", format_hints.Hex), ("HandleValue", format_hints.Hex), ("Type", str), ("GrantedAccess", format_hints.Hex), ("Name", str)], self._generator( pslist.PsList.list_processes(self.context, self.config['primary'], self.config['nt_symbols'], filter_func = filter_func))) volatility3-1.0.1/volatility3/framework/plugins/windows/hashdump.py000066400000000000000000000313211405267600400256160ustar00rootroot00000000000000# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import binascii import hashlib import logging from struct import unpack, pack from typing import List, Tuple, Optional from Crypto.Cipher import ARC4, DES, AES from Crypto.Hash import MD5 from volatility3.framework import interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.symbols.windows.extensions import registry from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) class Hashdump(interfaces.plugins.PluginInterface): """Dumps user hashes from memory""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.PluginRequirement(name = 'hivelist', plugin = hivelist.HiveList, version = (1, 0, 0)) ] odd_parity = [ 1, 1, 2, 2, 4, 4, 7, 7, 8, 8, 11, 11, 13, 13, 14, 14, 16, 16, 19, 19, 21, 21, 22, 22, 25, 25, 26, 26, 28, 28, 31, 31, 32, 32, 35, 35, 37, 37, 38, 38, 41, 41, 42, 42, 44, 44, 47, 47, 49, 49, 50, 50, 52, 52, 55, 55, 56, 56, 59, 59, 61, 61, 62, 62, 64, 64, 67, 67, 69, 69, 70, 70, 73, 73, 74, 74, 76, 76, 79, 79, 81, 81, 82, 82, 84, 84, 87, 87, 88, 88, 91, 91, 93, 93, 94, 94, 97, 97, 98, 98, 100, 100, 103, 103, 104, 104, 107, 107, 109, 109, 110, 110, 112, 112, 115, 115, 117, 117, 118, 118, 121, 121, 122, 122, 124, 124, 127, 127, 128, 128, 131, 131, 133, 133, 134, 134, 137, 137, 138, 138, 140, 140, 143, 143, 145, 145, 146, 146, 148, 148, 151, 151, 152, 152, 155, 155, 157, 157, 158, 158, 161, 161, 162, 162, 164, 164, 167, 167, 168, 168, 171, 171, 173, 173, 174, 174, 176, 176, 179, 179, 181, 181, 182, 182, 185, 185, 186, 186, 188, 188, 191, 191, 193, 193, 194, 194, 196, 196, 199, 199, 200, 200, 203, 203, 205, 205, 206, 206, 208, 208, 211, 211, 213, 213, 214, 214, 217, 217, 218, 218, 220, 220, 223, 223, 224, 224, 227, 227, 229, 229, 230, 230, 233, 233, 234, 234, 236, 236, 239, 239, 241, 241, 242, 242, 244, 244, 247, 247, 248, 248, 251, 251, 253, 253, 254, 254 ] # Permutation matrix for boot key bootkey_perm_table = [0x8, 0x5, 0x4, 0x2, 0xb, 0x9, 0xd, 0x3, 0x0, 0x6, 0x1, 0xc, 0xe, 0xa, 0xf, 0x7] # Constants for SAM decrypt algorithm aqwerty = b"!@#$%^&*()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(*@&%\0" anum = b"0123456789012345678901234567890123456789\0" antpassword = b"NTPASSWORD\0" almpassword = b"LMPASSWORD\0" lmkey = b"KGS!@#$%" empty_lm = b"\xaa\xd3\xb4\x35\xb5\x14\x04\xee\xaa\xd3\xb4\x35\xb5\x14\x04\xee" empty_nt = b"\x31\xd6\xcf\xe0\xd1\x6a\xe9\x31\xb7\x3c\x59\xd7\xe0\xc0\x89\xc0" @classmethod def get_user_keys(cls, samhive: registry.RegistryHive) -> List[interfaces.objects.ObjectInterface]: user_key_path = "SAM\\Domains\\Account\\Users" user_key = samhive.get_key(user_key_path) if not user_key: return [] return [k for k in user_key.get_subkeys() if k.Name != "Names"] @classmethod def get_bootkey(cls, syshive: registry.RegistryHive) -> Optional[bytes]: cs = 1 lsa_base = "ControlSet{0:03}".format(cs) + "\\Control\\Lsa" lsa_keys = ["JD", "Skew1", "GBG", "Data"] lsa = syshive.get_key(lsa_base) if not lsa: return None bootkey = '' for lk in lsa_keys: key = syshive.get_key(lsa_base + '\\' + lk) class_data = syshive.read(key.Class + 4, key.ClassLength) if class_data is None: return None bootkey += class_data.decode('utf-16-le') bootkey_str = binascii.unhexlify(bootkey) bootkey_scrambled = bytes([bootkey_str[cls.bootkey_perm_table[i]] for i in range(len(bootkey_str))]) return bootkey_scrambled @classmethod def get_hbootkey(cls, samhive: registry.RegistryHive, bootkey: bytes) -> Optional[bytes]: sam_account_path = "SAM\\Domains\\Account" if not bootkey: return None sam_account_key = samhive.get_key(sam_account_path) if not sam_account_key: return None sam_data = None for v in sam_account_key.get_values(): if v.get_name() == 'F': sam_data = samhive.read(v.Data + 4, v.DataLength) if not sam_data: return None revision = sam_data[0x00] if revision == 2: md5 = hashlib.md5() md5.update(sam_data[0x70:0x80] + cls.aqwerty + bootkey + cls.anum) rc4_key = md5.digest() rc4 = ARC4.new(rc4_key) hbootkey = rc4.encrypt(sam_data[0x80:0xA0]) return hbootkey elif revision == 3: # AES encrypted iv = sam_data[0x78:0x88] encryptedHBootKey = sam_data[0x88:0xA8] cipher = AES.new(bootkey, AES.MODE_CBC, iv) hbootkey = cipher.decrypt(encryptedHBootKey) return hbootkey[:16] return None @classmethod def decrypt_single_salted_hash(cls, rid, hbootkey: bytes, enc_hash: bytes, lmntstr, salt: bytes) -> Optional[bytes]: (des_k1, des_k2) = cls.sid_to_key(rid) des1 = DES.new(des_k1, DES.MODE_ECB) des2 = DES.new(des_k2, DES.MODE_ECB) cipher = AES.new(hbootkey[:16], AES.MODE_CBC, salt) obfkey = cipher.decrypt(enc_hash) return des1.decrypt(obfkey[:8]) + des2.decrypt(obfkey[8:16]) @classmethod def get_user_hashes(cls, user: registry.CM_KEY_NODE, samhive: registry.RegistryHive, hbootkey: bytes) -> Tuple[bytes, bytes]: ## Will sometimes find extra user with rid = NAMES, returns empty strings right now try: rid = int(str(user.get_name()), 16) except ValueError: return None sam_data = None for v in user.get_values(): if v.get_name() == 'V': sam_data = samhive.read(v.Data + 4, v.DataLength) if not sam_data: return None lm_offset = unpack(" Tuple[bytes, bytes]: """Takes rid of a user and converts it to a key to be used by the DES cipher""" bytestr1 = [sid & 0xFF, (sid >> 8) & 0xFF, (sid >> 16) & 0xFF, (sid >> 24) & 0xFF] bytestr1 += bytestr1[0:3] bytestr2 = [bytestr1[3]] + bytestr1[0:3] bytestr2 += bytestr2[0:3] return cls.sidbytes_to_key(bytes(bytestr1)), cls.sidbytes_to_key(bytes(bytestr2)) @classmethod def sidbytes_to_key(cls, s: bytes) -> bytes: """Builds final DES key from the strings generated in sid_to_key""" key = [] key.append(s[0] >> 1) key.append(((s[0] & 0x01) << 6) | (s[1] >> 2)) key.append(((s[1] & 0x03) << 5) | (s[2] >> 3)) key.append(((s[2] & 0x07) << 4) | (s[3] >> 4)) key.append(((s[3] & 0x0F) << 3) | (s[4] >> 5)) key.append(((s[4] & 0x1F) << 2) | (s[5] >> 6)) key.append(((s[5] & 0x3F) << 1) | (s[6] >> 7)) key.append(s[6] & 0x7F) for i in range(8): key[i] = (key[i] << 1) key[i] = cls.odd_parity[key[i]] return bytes(key) @classmethod def decrypt_single_hash(cls, rid, hbootkey, enc_hash: bytes, lmntstr): (des_k1, des_k2) = cls.sid_to_key(rid) des1 = DES.new(des_k1, DES.MODE_ECB) des2 = DES.new(des_k2, DES.MODE_ECB) md5 = MD5.new() md5.update(hbootkey[:0x10] + pack(" Optional[bytes]: V = None for v in user.get_values(): if v.get_name() == 'V': V = samhive.read(v.Data + 4, v.DataLength) if not V: return None name_offset = unpack(" len(V): return None username = V[name_offset:name_offset + name_length] return username # replaces the dump_hashes method in vol2 def _generator(self, syshive: registry.RegistryHive, samhive: registry.RegistryHive): if syshive is None: vollog.debug("SYSTEM address is None: Did you use the correct profile?") yield (0, (renderers.NotAvailableValue(), renderers.NotAvailableValue(), renderers.NotAvailableValue(), renderers.NotAvailableValue())) if samhive is None: vollog.debug("SAM address is None: Did you use the correct profile?") yield (0, (renderers.NotAvailableValue(), renderers.NotAvailableValue(), renderers.NotAvailableValue(), renderers.NotAvailableValue())) bootkey = self.get_bootkey(syshive) hbootkey = self.get_hbootkey(samhive, bootkey) if hbootkey: for user in self.get_user_keys(samhive): ret = self.get_user_hashes(user, samhive, hbootkey) if ret: lmhash, nthash = ret ## temporary fix to prevent UnicodeDecodeError backtraces ## however this can cause truncated user names as a result name = self.get_user_name(user, samhive) if name is None: name = renderers.NotAvailableValue() else: name = str(name, 'utf-16-le', errors = 'ignore') lmout = str(binascii.hexlify(lmhash or self.empty_lm), 'latin-1') ntout = str(binascii.hexlify(nthash or self.empty_nt), 'latin-1') rid = int(str(user.get_name()), 16) yield (0, (name, rid, lmout, ntout)) else: raise ValueError("Hbootkey is not valid") def run(self): offset = self.config.get('offset', None) syshive = None samhive = None for hive in hivelist.HiveList.list_hives(self.context, self.config_path, self.config['primary'], self.config['nt_symbols'], hive_offsets = None if offset is None else [offset]): if hive.get_name().split('\\')[-1].upper() == 'SYSTEM': syshive = hive if hive.get_name().split('\\')[-1].upper() == 'SAM': samhive = hive return renderers.TreeGrid([("User", str), ("rid", int), ("lmhash", str), ("nthash", str)], self._generator(syshive, samhive)) volatility3-1.0.1/volatility3/framework/plugins/windows/info.py000066400000000000000000000232071405267600400247440ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import time from typing import List, Tuple, Iterable from volatility3.framework import constants, interfaces, layers, symbols from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.renderers import TreeGrid from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows import extensions class Info(plugins.PluginInterface): """Show OS & kernel details of the memory sample being analyzed.""" _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") ] @classmethod def get_depends(cls, context: interfaces.context.ContextInterface, layer_name: str, index: int = 0) -> Iterable[Tuple[int, interfaces.layers.DataLayerInterface]]: """List the dependencies of a given layer. Args: context: The context to retrieve required layers from layer_name: the name of the starting layer index: the index/order of the layer Returns: An iterable containing the levels and layer objects for all dependent layers """ layer = context.layers[layer_name] yield index, layer try: for depends in layer.dependencies: for j, dep in cls.get_depends(context, depends, index + 1): yield j, context.layers[dep.name] except AttributeError: # FileLayer won't have dependencies pass @classmethod def get_kernel_module(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str): """Returns the kernel module based on the layer and symbol_table""" virtual_layer = context.layers[layer_name] if not isinstance(virtual_layer, layers.intel.Intel): raise TypeError("Virtual Layer is not an intel layer") kvo = virtual_layer.config["kernel_virtual_offset"] ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo) return ntkrnlmp @classmethod def get_kdbg_structure(cls, context: interfaces.context.ContextInterface, config_path: str, layer_name: str, symbol_table: str) -> interfaces.objects.ObjectInterface: """Returns the KDDEBUGGER_DATA64 structure for a kernel""" ntkrnlmp = cls.get_kernel_module(context, layer_name, symbol_table) native_types = context.symbol_space[symbol_table].natives kdbg_offset = ntkrnlmp.get_symbol("KdDebuggerDataBlock").address kdbg_table_name = intermed.IntermediateSymbolTable.create(context, interfaces.configuration.path_join( config_path, 'kdbg'), "windows", "kdbg", native_types = native_types, class_types = extensions.kdbg.class_types) kdbg = context.object(kdbg_table_name + constants.BANG + "_KDDEBUGGER_DATA64", offset = ntkrnlmp.offset + kdbg_offset, layer_name = layer_name) return kdbg @classmethod def get_kuser_structure(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str) -> interfaces.objects.ObjectInterface: """Returns the _KUSER_SHARED_DATA structure for a kernel""" virtual_layer = context.layers[layer_name] if not isinstance(virtual_layer, layers.intel.Intel): raise TypeError("Virtual Layer is not an intel layer") ntkrnlmp = cls.get_kernel_module(context, layer_name, symbol_table) # this is a hard-coded address in the Windows OS if virtual_layer.bits_per_register == 32: kuser_addr = 0xFFDF0000 else: kuser_addr = 0xFFFFF78000000000 kuser = ntkrnlmp.object(object_type = "_KUSER_SHARED_DATA", layer_name = layer_name, offset = kuser_addr, absolute = True) return kuser @classmethod def get_version_structure(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str) -> interfaces.objects.ObjectInterface: """Returns the KdVersionBlock information from a kernel""" ntkrnlmp = cls.get_kernel_module(context, layer_name, symbol_table) vers_offset = ntkrnlmp.get_symbol("KdVersionBlock").address vers = ntkrnlmp.object(object_type = "_DBGKD_GET_VERSION64", layer_name = layer_name, offset = vers_offset) return vers @classmethod def get_ntheader_structure(cls, context: interfaces.context.ContextInterface, config_path: str, layer_name: str) -> interfaces.objects.ObjectInterface: """Gets the ntheader structure for the kernel of the specified layer""" virtual_layer = context.layers[layer_name] if not isinstance(virtual_layer, layers.intel.Intel): raise TypeError("Virtual Layer is not an intel layer") kvo = virtual_layer.config["kernel_virtual_offset"] pe_table_name = intermed.IntermediateSymbolTable.create(context, interfaces.configuration.path_join(config_path, 'pe'), "windows", "pe", class_types = extensions.pe.class_types) dos_header = context.object(pe_table_name + constants.BANG + "_IMAGE_DOS_HEADER", offset = kvo, layer_name = layer_name) nt_header = dos_header.get_nt_header() return nt_header def _generator(self): layer_name = self.config['primary'] symbol_table = self.config['nt_symbols'] kdbg = self.get_kdbg_structure(self.context, self.config_path, layer_name, symbol_table) yield (0, ("Kernel Base", hex(self.config["primary.kernel_virtual_offset"]))) yield (0, ("DTB", hex(self.config["primary.page_map_offset"]))) yield (0, ("Symbols", self.config["nt_symbols.isf_url"])) yield (0, ("Is64Bit", str(symbols.symbol_table_is_64bit(self.context, symbol_table)))) yield (0, ("IsPAE", str(self.context.layers[layer_name].metadata.get("pae", False)))) for i, layer in self.get_depends(self.context, "primary"): yield (0, (layer.name, "{} {}".format(i, layer.__class__.__name__))) if kdbg.Header.OwnerTag == 0x4742444B: yield (0, ("KdDebuggerDataBlock", hex(kdbg.vol.offset))) yield (0, ("NTBuildLab", kdbg.get_build_lab())) yield (0, ("CSDVersion", str(kdbg.get_csdversion()))) vers = self.get_version_structure(self.context, layer_name, symbol_table) yield (0, ("KdVersionBlock", hex(vers.vol.offset))) yield (0, ("Major/Minor", "{0}.{1}".format(vers.MajorVersion, vers.MinorVersion))) yield (0, ("MachineType", str(vers.MachineType))) ntkrnlmp = self.get_kernel_module(self.context, layer_name, symbol_table) cpu_count_offset = ntkrnlmp.get_symbol("KeNumberProcessors").address cpu_count = ntkrnlmp.object(object_type = "unsigned int", layer_name = layer_name, offset = cpu_count_offset) yield (0, ("KeNumberProcessors", str(cpu_count))) kuser = self.get_kuser_structure(self.context, layer_name, symbol_table) yield (0, ("SystemTime", str(kuser.SystemTime.get_time()))) yield (0, ("NtSystemRoot", str(kuser.NtSystemRoot.cast("string", encoding = "utf-16", errors = "replace", max_length = 260)))) yield (0, ("NtProductType", str(kuser.NtProductType.description))) yield (0, ("NtMajorVersion", str(kuser.NtMajorVersion))) yield (0, ("NtMinorVersion", str(kuser.NtMinorVersion))) # yield (0, ("KdDebuggerEnabled", "True" if kuser.KdDebuggerEnabled else "False")) # yield (0, ("SafeBootMode", "True" if kuser.SafeBootMode else "False")) nt_header = self.get_ntheader_structure(self.context, self.config_path, layer_name) yield (0, ("PE MajorOperatingSystemVersion", str(nt_header.OptionalHeader.MajorOperatingSystemVersion))) yield (0, ("PE MinorOperatingSystemVersion", str(nt_header.OptionalHeader.MinorOperatingSystemVersion))) yield (0, ("PE Machine", str(nt_header.FileHeader.Machine))) yield (0, ("PE TimeDateStamp", time.asctime(time.gmtime(nt_header.FileHeader.TimeDateStamp)))) def run(self): return TreeGrid([("Variable", str), ("Value", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/windows/lsadump.py000066400000000000000000000151621405267600400254570ustar00rootroot00000000000000# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from struct import unpack from Crypto.Cipher import ARC4, DES, AES from Crypto.Hash import MD5, SHA256 from volatility3.framework import interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.symbols.windows import versions from volatility3.plugins.windows import hashdump from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) class Lsadump(interfaces.plugins.PluginInterface): """Dumps lsa secrets from memory""" _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.PluginRequirement(name = 'hivelist', plugin = hivelist.HiveList, version = (1, 0, 0)) ] @classmethod def decrypt_aes(cls, secret, key): """ Based on code from http://lab.mediaservice.net/code/cachedump.rb """ sha = SHA256.new() sha.update(key) for _i in range(1, 1000 + 1): sha.update(secret[28:60]) aeskey = sha.digest() data = b"" for i in range(60, len(secret), 16): aes = AES.new(aeskey, AES.MODE_CBC, b'\x00' * 16) buf = secret[i:i + 16] if len(buf) < 16: buf += (16 - len(buf)) * "\00" data += aes.decrypt(buf) return data @classmethod def get_lsa_key(cls, sechive, bootkey, vista_or_later): if not bootkey: return None if vista_or_later: policy_key = 'PolEKList' else: policy_key = 'PolSecretEncryptionKey' enc_reg_key = sechive.get_key("Policy\\" + policy_key) if not enc_reg_key: return None enc_reg_value = next(enc_reg_key.get_values()) if not enc_reg_value: return None obf_lsa_key = sechive.read(enc_reg_value.Data + 4, enc_reg_value.DataLength) if not obf_lsa_key: return None if not vista_or_later: md5 = MD5.new() md5.update(bootkey) for _i in range(1000): md5.update(obf_lsa_key[60:76]) rc4key = md5.digest() rc4 = ARC4.new(rc4key) lsa_key = rc4.decrypt(obf_lsa_key[12:60]) lsa_key = lsa_key[0x10:0x20] else: lsa_key = cls.decrypt_aes(obf_lsa_key, bootkey) lsa_key = lsa_key[68:100] return lsa_key @classmethod def get_secret_by_name(cls, sechive, name, lsakey, is_vista_or_later): try: enc_secret_key = sechive.get_key("Policy\\Secrets\\" + name + "\\CurrVal") except KeyError: raise ValueError("Unable to read cache from memory") enc_secret_value = next(enc_secret_key.get_values()) if not enc_secret_value: return None enc_secret = sechive.read(enc_secret_value.Data + 4, enc_secret_value.DataLength) if not enc_secret: return None if not is_vista_or_later: secret = cls.decrypt_secret(enc_secret[0xC:], lsakey) else: secret = cls.decrypt_aes(enc_secret, lsakey) return secret @classmethod def decrypt_secret(cls, secret, key): """Python implementation of SystemFunction005. Decrypts a block of data with DES using given key. Note that key can be longer than 7 bytes.""" decrypted_data = b'' j = 0 # key index for i in range(0, len(secret), 8): enc_block = secret[i:i + 8] block_key = key[j:j + 7] des_key = hashdump.Hashdump.sidbytes_to_key(block_key) des = DES.new(des_key, DES.MODE_ECB) enc_block = enc_block + b"\x00" * int(abs(8 - len(enc_block)) % 8) decrypted_data += des.decrypt(enc_block) j += 7 if len(key[j:j + 7]) < 7: j = len(key[j:j + 7]) (dec_data_len, ) = unpack(" Iterable[Tuple[interfaces.objects.ObjectInterface, bytes]]: """Generate memory regions for a process that may contain injected code. Args: context: The context to retrieve required elements (layers, symbol tables) from kernel_layer_name: The name of the kernel layer from which to read the VAD protections symbol_table: The name of the table containing the kernel symbols proc: an _EPROCESS instance Returns: An iterable of VAD instances and the first 64 bytes of data containing in that region """ proc_id = "Unknown" try: proc_id = proc.UniqueProcessId proc_layer_name = proc.add_process_layer() except exceptions.InvalidAddressException as excp: vollog.debug("Process {}: invalid address {} in layer {}".format(proc_id, excp.invalid_address, excp.layer_name)) return proc_layer = context.layers[proc_layer_name] for vad in proc.get_vad_root().traverse(): protection_string = vad.get_protection( vadinfo.VadInfo.protect_values(context, kernel_layer_name, symbol_table), vadinfo.winnt_protections) write_exec = "EXECUTE" in protection_string and "WRITE" in protection_string # the write/exec check applies to everything if not write_exec: continue if (vad.get_private_memory() == 1 and vad.get_tag() == "VadS") or (vad.get_private_memory() == 0 and protection_string != "PAGE_EXECUTE_WRITECOPY"): if cls.is_vad_empty(proc_layer, vad): continue data = proc_layer.read(vad.get_start(), 64, pad = True) yield vad, data def _generator(self, procs): # determine if we're on a 32 or 64 bit kernel is_32bit_arch = not symbols.symbol_table_is_64bit(self.context, self.config["nt_symbols"]) for proc in procs: process_name = utility.array_to_string(proc.ImageFileName) for vad, data in self.list_injections(self.context, self.config["primary"], self.config["nt_symbols"], proc): # if we're on a 64 bit kernel, we may still need 32 bit disasm due to wow64 if is_32bit_arch or proc.get_is_wow64(): architecture = "intel" else: architecture = "intel64" disasm = interfaces.renderers.Disassembly(data, vad.get_start(), architecture) file_output = "Disabled" if self.config['dump']: file_output = "Error outputting to file" try: file_handle = vadinfo.VadInfo.vad_dump(self.context, proc, vad, self.open) file_handle.close() file_output = file_handle.preferred_filename except (exceptions.InvalidAddressException, OverflowError) as excp: vollog.debug("Unable to dump PE with pid {0}.{1:#x}: {2}".format( proc.UniqueProcessId, vad.get_start(), excp)) yield (0, (proc.UniqueProcessId, process_name, format_hints.Hex(vad.get_start()), format_hints.Hex(vad.get_end()), vad.get_tag(), vad.get_protection( vadinfo.VadInfo.protect_values(self.context, self.config["primary"], self.config["nt_symbols"]), vadinfo.winnt_protections), vad.get_commit_charge(), vad.get_private_memory(), file_output, format_hints.HexBytes(data), disasm)) def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), ("Start VPN", format_hints.Hex), ("End VPN", format_hints.Hex), ("Tag", str), ("Protection", str), ("CommitCharge", int), ("PrivateMemory", int), ("File output", str), ("Hexdump", format_hints.HexBytes), ("Disasm", interfaces.renderers.Disassembly)], self._generator( pslist.PsList.list_processes(context = self.context, layer_name = self.config['primary'], symbol_table = self.config['nt_symbols'], filter_func = filter_func))) volatility3-1.0.1/volatility3/framework/plugins/windows/memmap.py000066400000000000000000000103451405267600400252640ustar00rootroot00000000000000# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import List from volatility3.framework import exceptions, renderers, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) class Memmap(interfaces.plugins.PluginInterface): """Prints the memory map""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.IntRequirement(name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True), requirements.BooleanRequirement(name = 'dump', description = "Extract listed memory segments", default = False, optional = True) ] def _generator(self, procs): for proc in procs: pid = "Unknown" try: pid = proc.UniqueProcessId proc_layer_name = proc.add_process_layer() proc_layer = self.context.layers[proc_layer_name] except exceptions.InvalidAddressException as excp: vollog.debug("Process {}: invalid address {} in layer {}".format(pid, excp.invalid_address, excp.layer_name)) continue file_handle = self.open("pid.{}.dmp".format(pid)) with file_handle as file_data: for mapval in proc_layer.mapping(0x0, proc_layer.maximum_address, ignore_errors = True): offset, size, mapped_offset, mapped_size, maplayer = mapval file_output = "Disabled" if self.config['dump']: try: data = proc_layer.read(offset, size, pad = True) file_data.write(data) file_output = file_handle.preferred_filename except exceptions.InvalidAddressException: file_output = "Error outputting to file" vollog.debug("Unable to write {}'s address {} to {}".format( proc_layer_name, offset, file_handle.preferred_filename)) yield (0, (format_hints.Hex(offset), format_hints.Hex(mapped_offset), format_hints.Hex(mapped_size), format_hints.Hex(offset), file_output)) offset += mapped_size def run(self): filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) return renderers.TreeGrid([("Virtual", format_hints.Hex), ("Physical", format_hints.Hex), ("Size", format_hints.Hex), ("Offset", format_hints.Hex), ("File output", str)], self._generator( pslist.PsList.list_processes(context = self.context, layer_name = self.config['primary'], symbol_table = self.config['nt_symbols'], filter_func = filter_func))) volatility3-1.0.1/volatility3/framework/plugins/windows/modscan.py000066400000000000000000000207341405267600400254370ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import Iterable, List, Generator from volatility3.framework import renderers, interfaces, exceptions, constants from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows.extensions import pe from volatility3.plugins.windows import poolscanner, dlllist, pslist vollog = logging.getLogger(__name__) class ModScan(interfaces.plugins.PluginInterface): """Scans for modules present in a particular windows memory image.""" _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.VersionRequirement(name = 'poolerscanner', component = poolscanner.PoolScanner, version = (1, 0, 0)), requirements.VersionRequirement(name = 'pslist', component = pslist.PsList, version = (2, 0, 0)), requirements.VersionRequirement(name = 'dlllist', component = dlllist.DllList, version = (2, 0, 0)), requirements.BooleanRequirement(name = 'dump', description = "Extract listed modules", default = False, optional = True) ] @classmethod def scan_modules(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str) -> \ Iterable[interfaces.objects.ObjectInterface]: """Scans for modules using the poolscanner module and constraints. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols Returns: A list of Driver objects as found from the `layer_name` layer based on Driver pool signatures """ constraints = poolscanner.PoolScanner.builtin_constraints(symbol_table, [b'MmLd']) for result in poolscanner.PoolScanner.generate_pool_scan(context, layer_name, symbol_table, constraints): _constraint, mem_object, _header = result yield mem_object @classmethod def get_session_layers(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str, pids: List[int] = None) -> Generator[str, None, None]: """Build a cache of possible virtual layers, in priority starting with the primary/kernel layer. Then keep one layer per session by cycling through the process list. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols pids: A list of process identifiers to include exclusively or None for no filter Returns: A list of session layer names """ seen_ids = [] # type: List[interfaces.objects.ObjectInterface] filter_func = pslist.PsList.create_pid_filter(pids or []) for proc in pslist.PsList.list_processes(context = context, layer_name = layer_name, symbol_table = symbol_table, filter_func = filter_func): proc_id = "Unknown" try: proc_id = proc.UniqueProcessId proc_layer_name = proc.add_process_layer() # create the session space object in the process' own layer. # not all processes have a valid session pointer. session_space = context.object(symbol_table + constants.BANG + "_MM_SESSION_SPACE", layer_name = layer_name, offset = proc.Session) if session_space.SessionId in seen_ids: continue except exceptions.InvalidAddressException: vollog.log( constants.LOGLEVEL_VVV, "Process {} does not have a valid Session or a layer could not be constructed for it".format( proc_id)) continue # save the layer if we haven't seen the session yet seen_ids.append(session_space.SessionId) yield proc_layer_name @classmethod def find_session_layer(cls, context: interfaces.context.ContextInterface, session_layers: Iterable[str], base_address: int): """Given a base address and a list of layer names, find a layer that can access the specified address. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols session_layers: A list of session layer names base_address: The base address to identify the layers that can access it Returns: Layer name or None if no layers that contain the base address can be found """ for layer_name in session_layers: if context.layers[layer_name].is_valid(base_address): return layer_name return None def _generator(self): session_layers = list(self.get_session_layers(self.context, self.config['primary'], self.config['nt_symbols'])) pe_table_name = intermed.IntermediateSymbolTable.create(self.context, self.config_path, "windows", "pe", class_types = pe.class_types) for mod in self.scan_modules(self.context, self.config['primary'], self.config['nt_symbols']): try: BaseDllName = mod.BaseDllName.get_string() except exceptions.InvalidAddressException: BaseDllName = "" try: FullDllName = mod.FullDllName.get_string() except exceptions.InvalidAddressException: FullDllName = "" file_output = "Disabled" if self.config['dump']: session_layer_name = self.find_session_layer(self.context, session_layers, mod.DllBase) file_output = "Cannot find a viable session layer for {0:#x}".format(mod.DllBase) if session_layer_name: file_handle = dlllist.DllList.dump_pe(self.context, pe_table_name, mod, self.open, layer_name = session_layer_name) file_output = "Error outputting file" if file_handle: file_output = file_handle.preferred_filename yield (0, (format_hints.Hex(mod.vol.offset), format_hints.Hex(mod.DllBase), format_hints.Hex(mod.SizeOfImage), BaseDllName, FullDllName, file_output)) def run(self): return renderers.TreeGrid([("Offset", format_hints.Hex), ("Base", format_hints.Hex), ("Size", format_hints.Hex), ("Name", str), ("Path", str), ("File output", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/windows/modules.py000066400000000000000000000203651405267600400254630ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import List, Iterable, Generator from volatility3.framework import constants from volatility3.framework import exceptions, interfaces from volatility3.framework import renderers from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows.extensions import pe from volatility3.plugins.windows import pslist, dlllist vollog = logging.getLogger(__name__) class Modules(interfaces.plugins.PluginInterface): """Lists the loaded kernel modules.""" _required_framework_version = (1, 0, 0) _version = (1, 1, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.VersionRequirement(name = 'pslist', component = pslist.PsList, version = (2, 0, 0)), requirements.VersionRequirement(name = 'dlllist', component = dlllist.DllList, version = (2, 0, 0)), requirements.BooleanRequirement(name = 'dump', description = "Extract listed modules", default = False, optional = True) ] def _generator(self): pe_table_name = intermed.IntermediateSymbolTable.create(self.context, self.config_path, "windows", "pe", class_types = pe.class_types) for mod in self.list_modules(self.context, self.config['primary'], self.config['nt_symbols']): try: BaseDllName = mod.BaseDllName.get_string() except exceptions.InvalidAddressException: BaseDllName = "" try: FullDllName = mod.FullDllName.get_string() except exceptions.InvalidAddressException: FullDllName = "" file_output = "Disabled" if self.config['dump']: file_handle = dlllist.DllList.dump_pe(self.context, pe_table_name, mod, self.open) file_output = "Error outputting file" if file_handle: file_handle.close() file_output = file_handle.preferred_filename yield (0, (format_hints.Hex(mod.vol.offset), format_hints.Hex(mod.DllBase), format_hints.Hex(mod.SizeOfImage), BaseDllName, FullDllName, file_output)) @classmethod def get_session_layers(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str, pids: List[int] = None) -> Generator[str, None, None]: """Build a cache of possible virtual layers, in priority starting with the primary/kernel layer. Then keep one layer per session by cycling through the process list. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols pids: A list of process identifiers to include exclusively or None for no filter Returns: A list of session layer names """ seen_ids = [] # type: List[interfaces.objects.ObjectInterface] filter_func = pslist.PsList.create_pid_filter(pids or []) for proc in pslist.PsList.list_processes(context = context, layer_name = layer_name, symbol_table = symbol_table, filter_func = filter_func): proc_id = "Unknown" try: proc_id = proc.UniqueProcessId proc_layer_name = proc.add_process_layer() # create the session space object in the process' own layer. # not all processes have a valid session pointer. session_space = context.object(symbol_table + constants.BANG + "_MM_SESSION_SPACE", layer_name = layer_name, offset = proc.Session) if session_space.SessionId in seen_ids: continue except exceptions.InvalidAddressException: vollog.log( constants.LOGLEVEL_VVV, "Process {} does not have a valid Session or a layer could not be constructed for it".format( proc_id)) continue # save the layer if we haven't seen the session yet seen_ids.append(session_space.SessionId) yield proc_layer_name @classmethod def find_session_layer(cls, context: interfaces.context.ContextInterface, session_layers: Iterable[str], base_address: int): """Given a base address and a list of layer names, find a layer that can access the specified address. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols session_layers: A list of session layer names base_address: The base address to identify the layers that can access it Returns: Layer name or None if no layers that contain the base address can be found """ for layer_name in session_layers: if context.layers[layer_name].is_valid(base_address): return layer_name return None @classmethod def list_modules(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str) -> Iterable[interfaces.objects.ObjectInterface]: """Lists all the modules in the primary layer. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols Returns: A list of Modules as retrieved from PsLoadedModuleList """ kvo = context.layers[layer_name].config['kernel_virtual_offset'] ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo) try: # use this type if its available (starting with windows 10) ldr_entry_type = ntkrnlmp.get_type("_KLDR_DATA_TABLE_ENTRY") except exceptions.SymbolError: ldr_entry_type = ntkrnlmp.get_type("_LDR_DATA_TABLE_ENTRY") type_name = ldr_entry_type.type_name.split(constants.BANG)[1] list_head = ntkrnlmp.get_symbol("PsLoadedModuleList").address list_entry = ntkrnlmp.object(object_type = "_LIST_ENTRY", offset = list_head) reloff = ldr_entry_type.relative_child_offset("InLoadOrderLinks") module = ntkrnlmp.object(object_type = type_name, offset = list_entry.vol.offset - reloff, absolute = True) for mod in module.InLoadOrderLinks: yield mod def run(self): return renderers.TreeGrid([("Offset", format_hints.Hex), ("Base", format_hints.Hex), ("Size", format_hints.Hex), ("Name", str), ("Path", str), ("File output", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/windows/mutantscan.py000066400000000000000000000052701405267600400261660ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from typing import Iterable from volatility3.framework import renderers, interfaces, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.plugins.windows import poolscanner class MutantScan(interfaces.plugins.PluginInterface): """Scans for mutexes present in a particular windows memory image.""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.PluginRequirement(name = 'poolscanner', plugin = poolscanner.PoolScanner, version = (1, 0, 0)), ] @classmethod def scan_mutants(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str) -> \ Iterable[interfaces.objects.ObjectInterface]: """Scans for mutants using the poolscanner module and constraints. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols Returns: A list of Mutant objects found by scanning memory for the Mutant pool signatures """ constraints = poolscanner.PoolScanner.builtin_constraints(symbol_table, [b'Mut\xe1', b'Muta']) for result in poolscanner.PoolScanner.generate_pool_scan(context, layer_name, symbol_table, constraints): _constraint, mem_object, _header = result yield mem_object def _generator(self): for mutant in self.scan_mutants(self.context, self.config['primary'], self.config['nt_symbols']): try: name = mutant.get_name() except (ValueError, exceptions.InvalidAddressException): name = renderers.NotApplicableValue() yield (0, (format_hints.Hex(mutant.vol.offset), name)) def run(self): return renderers.TreeGrid([ ("Offset", format_hints.Hex), ("Name", str), ], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/windows/netscan.py000066400000000000000000000454731405267600400254550ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import datetime import logging from typing import Iterable, List, Optional from volatility3.framework import constants, exceptions, interfaces, renderers, symbols from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows import versions from volatility3.framework.symbols.windows.extensions import network from volatility3.plugins import timeliner from volatility3.plugins.windows import info, poolscanner vollog = logging.getLogger(__name__) class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Scans for network objects present in a particular windows memory image.""" _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.VersionRequirement(name = 'poolscanner', component = poolscanner.PoolScanner, version = (1, 0, 0)), requirements.VersionRequirement(name = 'info', component = info.Info, version = (1, 0, 0)), requirements.BooleanRequirement( name = 'include-corrupt', description = "Radically eases result validation. This will show partially overwritten data. WARNING: the results are likely to include garbage and/or corrupt data. Be cautious!", default = False, optional = True), ] @staticmethod def create_netscan_constraints(context: interfaces.context.ContextInterface, symbol_table: str) -> List[poolscanner.PoolConstraint]: """Creates a list of Pool Tag Constraints for network objects. Args: context: The context to retrieve required elements (layers, symbol tables) from symbol_table: The name of an existing symbol table containing the symbols / types Returns: The list containing the built constraints. """ tcpl_size = context.symbol_space.get_type(symbol_table + constants.BANG + "_TCP_LISTENER").size tcpe_size = context.symbol_space.get_type(symbol_table + constants.BANG + "_TCP_ENDPOINT").size udpa_size = context.symbol_space.get_type(symbol_table + constants.BANG + "_UDP_ENDPOINT").size # ~ vollog.debug("Using pool size constraints: TcpL {}, TcpE {}, UdpA {}".format(tcpl_size, tcpe_size, udpa_size)) return [ # TCP listener poolscanner.PoolConstraint(b'TcpL', type_name = symbol_table + constants.BANG + "_TCP_LISTENER", size = (tcpl_size, None), page_type = poolscanner.PoolType.NONPAGED | poolscanner.PoolType.FREE), # TCP Endpoint poolscanner.PoolConstraint(b'TcpE', type_name = symbol_table + constants.BANG + "_TCP_ENDPOINT", size = (tcpe_size, None), page_type = poolscanner.PoolType.NONPAGED | poolscanner.PoolType.FREE), # UDP Endpoint poolscanner.PoolConstraint(b'UdpA', type_name = symbol_table + constants.BANG + "_UDP_ENDPOINT", size = (udpa_size, None), page_type = poolscanner.PoolType.NONPAGED | poolscanner.PoolType.FREE) ] @classmethod def determine_tcpip_version(cls, context: interfaces.context.ContextInterface, layer_name: str, nt_symbol_table: str) -> str: """Tries to determine which symbol filename to use for the image's tcpip driver. The logic is partially taken from the info plugin. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate nt_symbol_table: The name of the table containing the kernel symbols Returns: The filename of the symbol table to use. """ # while the failsafe way to determine the version of tcpip.sys would be to # extract the driver and parse its PE header containing the versionstring, # unfortunately that header is not guaranteed to persist within memory. # therefore we determine the version based on the kernel version as testing # with several windows versions has showed this to work out correctly. is_64bit = symbols.symbol_table_is_64bit(context, nt_symbol_table) is_18363_or_later = versions.is_win10_18363_or_later(context = context, symbol_table = nt_symbol_table) if is_64bit: arch = "x64" else: arch = "x86" vers = info.Info.get_version_structure(context, layer_name, nt_symbol_table) kuser = info.Info.get_kuser_structure(context, layer_name, nt_symbol_table) try: vers_minor_version = int(vers.MinorVersion) nt_major_version = int(kuser.NtMajorVersion) nt_minor_version = int(kuser.NtMinorVersion) except ValueError: # vers struct exists, but is not an int anymore? raise NotImplementedError("Kernel Debug Structure version format not supported!") except: # unsure what to raise here. Also, it might be useful to add some kind of fallback, # either to a user-provided version or to another method to determine tcpip.sys's version raise exceptions.VolatilityException( "Kernel Debug Structure missing VERSION/KUSER structure, unable to determine Windows version!") vollog.debug("Determined OS Version: {}.{} {}.{}".format(kuser.NtMajorVersion, kuser.NtMinorVersion, vers.MajorVersion, vers.MinorVersion)) if nt_major_version == 10 and arch == "x64": # win10 x64 has an additional class type we have to include. class_types = network.win10_x64_class_types else: # default to general class types class_types = network.class_types # these versions are listed explicitly because symbol files differ based on # version *and* architecture. this is currently the clearest way to show # the differences, even if it introduces a fair bit of redundancy. # furthermore, it is easy to append new versions. if arch == "x86": version_dict = { (6, 0, 6000): "netscan-vista-x86", (6, 0, 6001): "netscan-vista-x86", (6, 0, 6002): "netscan-vista-x86", (6, 0, 6003): "netscan-vista-x86", (6, 1, 7600): "netscan-win7-x86", (6, 1, 7601): "netscan-win7-x86", (6, 1, 8400): "netscan-win7-x86", (6, 2, 9200): "netscan-win8-x86", (6, 3, 9600): "netscan-win81-x86", (10, 0, 10240): "netscan-win10-x86", (10, 0, 10586): "netscan-win10-x86", (10, 0, 14393): "netscan-win10-14393-x86", (10, 0, 15063): "netscan-win10-15063-x86", (10, 0, 16299): "netscan-win10-15063-x86", (10, 0, 17134): "netscan-win10-17134-x86", (10, 0, 17763): "netscan-win10-17134-x86", (10, 0, 18362): "netscan-win10-17134-x86", (10, 0, 18363): "netscan-win10-17134-x86" } else: version_dict = { (6, 0, 6000): "netscan-vista-x64", (6, 0, 6001): "netscan-vista-sp12-x64", (6, 0, 6002): "netscan-vista-sp12-x64", (6, 0, 6003): "netscan-vista-sp12-x64", (6, 1, 7600): "netscan-win7-x64", (6, 1, 7601): "netscan-win7-x64", (6, 1, 8400): "netscan-win7-x64", (6, 2, 9200): "netscan-win8-x64", (6, 3, 9600): "netscan-win81-x64", (10, 0, 10240): "netscan-win10-x64", (10, 0, 10586): "netscan-win10-x64", (10, 0, 14393): "netscan-win10-x64", (10, 0, 15063): "netscan-win10-15063-x64", (10, 0, 16299): "netscan-win10-16299-x64", (10, 0, 17134): "netscan-win10-17134-x64", (10, 0, 17763): "netscan-win10-17763-x64", (10, 0, 18362): "netscan-win10-17763-x64", (10, 0, 18363): "netscan-win10-18363-x64", (10, 0, 19041): "netscan-win10-19041-x64" } # special use case: Win10_18363 is not recognized by windows.info as 18363 # because all kernel file headers and debug structures report 18363 as # "10.0.18362.1198" with the last part being incremented. However, we can use # os_distinguisher to differentiate between 18362 and 18363 if vers_minor_version == 18362 and is_18363_or_later: vollog.debug("Detected 18363 data structures: working with 18363 symbol table.") vers_minor_version = 18363 # when determining the symbol file we have to consider the following cases: # the determined version's symbol file is found by intermed.create -> proceed # the determined version's symbol file is not found by intermed -> intermed will throw an exc and abort # the determined version has no mapped symbol file -> if win10 use latest, otherwise throw exc # windows version cannot be determined -> throw exc filename = version_dict.get((nt_major_version, nt_minor_version, vers_minor_version)) if not filename: # no match on filename means that we possibly have a version newer than those listed here. # try to grab the latest supported version of the current image NT version. If that symbol # version does not work, support has to be added manually. current_versions = [ key for key in list(version_dict.keys()) if key[0] == nt_major_version and key[1] == nt_minor_version ] current_versions.sort() if current_versions: latest_version = current_versions[-1] filename = version_dict.get(latest_version) vollog.debug("Unable to find exact matching symbol file, going with latest: {}".format(filename)) else: raise NotImplementedError("This version of Windows is not supported: {}.{} {}.{}!".format( nt_major_version, nt_minor_version, vers.MajorVersion, vers_minor_version)) vollog.debug("Determined symbol filename: {}".format(filename)) return filename, class_types @classmethod def create_netscan_symbol_table(cls, context: interfaces.context.ContextInterface, layer_name: str, nt_symbol_table: str, config_path: str) -> str: """Creates a symbol table for TCP Listeners and TCP/UDP Endpoints. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate nt_symbol_table: The name of the table containing the kernel symbols config_path: The config path where to find symbol files Returns: The name of the constructed symbol table """ table_mapping = {"nt_symbols": nt_symbol_table} symbol_filename, class_types = cls.determine_tcpip_version( context, layer_name, nt_symbol_table, ) return intermed.IntermediateSymbolTable.create(context, config_path, "windows", symbol_filename, class_types = class_types, table_mapping = table_mapping) @classmethod def scan(cls, context: interfaces.context.ContextInterface, layer_name: str, nt_symbol_table: str, netscan_symbol_table: str) -> \ Iterable[interfaces.objects.ObjectInterface]: """Scans for network objects using the poolscanner module and constraints. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate nt_symbol_table: The name of the table containing the kernel symbols netscan_symbol_table: The name of the table containing the network object symbols (_TCP_LISTENER etc.) Returns: A list of network objects found by scanning the `layer_name` layer for network pool signatures """ constraints = cls.create_netscan_constraints(context, netscan_symbol_table) for result in poolscanner.PoolScanner.generate_pool_scan(context, layer_name, nt_symbol_table, constraints): _constraint, mem_object, _header = result yield mem_object def _generator(self, show_corrupt_results: Optional[bool] = None): """ Generates the network objects for use in rendering. """ netscan_symbol_table = self.create_netscan_symbol_table(self.context, self.config["primary"], self.config["nt_symbols"], self.config_path) for netw_obj in self.scan(self.context, self.config['primary'], self.config['nt_symbols'], netscan_symbol_table): vollog.debug("Found netw obj @ 0x{:2x} of assumed type {}".format(netw_obj.vol.offset, type(netw_obj))) # objects passed pool header constraints. check for additional constraints if strict flag is set. if not show_corrupt_results and not netw_obj.is_valid(): continue if isinstance(netw_obj, network._UDP_ENDPOINT): vollog.debug("Found UDP_ENDPOINT @ 0x{:2x}".format(netw_obj.vol.offset)) # For UdpA, the state is always blank and the remote end is asterisks for ver, laddr, _ in netw_obj.dual_stack_sockets(): yield (0, (format_hints.Hex(netw_obj.vol.offset), "UDP" + ver, laddr, netw_obj.Port, "*", 0, "", netw_obj.get_owner_pid() or renderers.UnreadableValue(), netw_obj.get_owner_procname() or renderers.UnreadableValue(), netw_obj.get_create_time() or renderers.UnreadableValue())) elif isinstance(netw_obj, network._TCP_ENDPOINT): vollog.debug("Found _TCP_ENDPOINT @ 0x{:2x}".format(netw_obj.vol.offset)) if netw_obj.get_address_family() == network.AF_INET: proto = "TCPv4" elif netw_obj.get_address_family() == network.AF_INET6: proto = "TCPv6" else: proto = "TCPv?" try: state = netw_obj.State.description except ValueError: state = renderers.UnreadableValue() yield (0, (format_hints.Hex(netw_obj.vol.offset), proto, netw_obj.get_local_address() or renderers.UnreadableValue(), netw_obj.LocalPort, netw_obj.get_remote_address() or renderers.UnreadableValue(), netw_obj.RemotePort, state, netw_obj.get_owner_pid() or renderers.UnreadableValue(), netw_obj.get_owner_procname() or renderers.UnreadableValue(), netw_obj.get_create_time() or renderers.UnreadableValue())) # check for isinstance of tcp listener last, because all other objects are inherited from here elif isinstance(netw_obj, network._TCP_LISTENER): vollog.debug("Found _TCP_LISTENER @ 0x{:2x}".format(netw_obj.vol.offset)) # For TcpL, the state is always listening and the remote port is zero for ver, laddr, raddr in netw_obj.dual_stack_sockets(): yield (0, (format_hints.Hex(netw_obj.vol.offset), "TCP" + ver, laddr, netw_obj.Port, raddr, 0, "LISTENING", netw_obj.get_owner_pid() or renderers.UnreadableValue(), netw_obj.get_owner_procname() or renderers.UnreadableValue(), netw_obj.get_create_time() or renderers.UnreadableValue())) else: # this should not happen therefore we log it. vollog.debug("Found network object unsure of its type: {} of type {}".format(netw_obj, type(netw_obj))) def generate_timeline(self): for row in self._generator(): _depth, row_data = row # Skip network connections without creation time if not isinstance(row_data[9], datetime.datetime): continue row_data = [ "N/A" if isinstance(i, renderers.UnreadableValue) or isinstance(i, renderers.UnparsableValue) else i for i in row_data ] description = "Network connection: Process {} {} Local Address {}:{} " \ "Remote Address {}:{} State {} Protocol {} ".format(row_data[7], row_data[8], row_data[2], row_data[3], row_data[4], row_data[5], row_data[6], row_data[1]) yield (description, timeliner.TimeLinerType.CREATED, row_data[9]) def run(self): show_corrupt_results = self.config.get('include-corrupt', None) return renderers.TreeGrid([ ("Offset", format_hints.Hex), ("Proto", str), ("LocalAddr", str), ("LocalPort", int), ("ForeignAddr", str), ("ForeignPort", int), ("State", str), ("PID", int), ("Owner", str), ("Created", datetime.datetime), ], self._generator(show_corrupt_results = show_corrupt_results)) volatility3-1.0.1/volatility3/framework/plugins/windows/poolscanner.py000066400000000000000000000464361405267600400263450ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import enum import logging from typing import Dict, Generator, List, Optional, Tuple from volatility3.framework import constants, interfaces, renderers, exceptions, symbols from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins, configuration from volatility3.framework.layers import scanners from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows import extensions, versions from volatility3.plugins.windows import handles vollog = logging.getLogger(__name__) # TODO: When python3.5 is no longer supported, make this enum.IntFlag # Revisit the page_type signature of PoolConstraint once using enum.IntFlag class PoolType(enum.IntEnum): """Class to maintain the different possible PoolTypes The values must be integer powers of 2.""" PAGED = 1 NONPAGED = 2 FREE = 4 class PoolConstraint: """Class to maintain tag/size/index/type information about Pool header tags.""" def __init__(self, tag: bytes, type_name: str, object_type: Optional[str] = None, page_type: Optional[int] = None, size: Optional[Tuple[Optional[int], Optional[int]]] = None, index: Optional[Tuple[Optional[int], Optional[int]]] = None, alignment: Optional[int] = 1, skip_type_test: bool = False) -> None: self.tag = tag self.type_name = type_name self.object_type = object_type self.page_type = page_type self.size = size self.index = index self.alignment = alignment self.skip_type_test = skip_type_test class PoolHeaderScanner(interfaces.layers.ScannerInterface): def __init__(self, module: interfaces.context.ModuleInterface, constraint_lookup: Dict[bytes, PoolConstraint], alignment: int): super().__init__() self._module = module self._constraint_lookup = constraint_lookup self._alignment = alignment header_type = self._module.get_type('_POOL_HEADER') self._header_offset = header_type.relative_child_offset('PoolTag') self._subscanner = scanners.MultiStringScanner([c for c in constraint_lookup.keys()]) def __call__(self, data: bytes, data_offset: int): for offset, pattern in self._subscanner(data, data_offset): header = self._module.object(object_type = "_POOL_HEADER", offset = offset - self._header_offset, absolute = True) constraint = self._constraint_lookup[pattern] try: # Size check if constraint.size is not None: if constraint.size[0]: if (self._alignment * header.BlockSize) < constraint.size[0]: continue if constraint.size[1]: if (self._alignment * header.BlockSize) > constraint.size[1]: continue # Type check if constraint.page_type is not None: checks_pass = False if (constraint.page_type & PoolType.FREE) and header.is_free_pool(): checks_pass = True elif (constraint.page_type & PoolType.NONPAGED) and header.is_nonpaged_pool(): checks_pass = True elif (constraint.page_type & PoolType.PAGED) and header.is_paged_pool(): checks_pass = True if not checks_pass: continue if constraint.index is not None: if constraint.index[0]: if header.PoolIndex < constraint.index[0]: continue if constraint.index[1]: if header.PoolIndex > constraint.index[1]: continue except exceptions.InvalidAddressException: # The tested object's header doesn't point to valid addresses, ignore it continue # We found one that passed! yield (constraint, header) class PoolScanner(plugins.PluginInterface): """A generic pool scanner plugin.""" _version = (1, 0, 0) _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.PluginRequirement(name = 'handles', plugin = handles.Handles, version = (1, 0, 0)), ] def _generator(self): symbol_table = self.config["nt_symbols"] constraints = self.builtin_constraints(symbol_table) for constraint, mem_object, header in self.generate_pool_scan(self.context, self.config["primary"], symbol_table, constraints): # generate some type-specific info for sanity checking if constraint.object_type == "Process": name = mem_object.ImageFileName.cast("string", max_length = mem_object.ImageFileName.vol.count, errors = "replace") elif constraint.object_type == "File": try: name = mem_object.FileName.String except exceptions.InvalidAddressException: vollog.log(constants.LOGLEVEL_VVV, "Skipping file at {0:#x}".format(mem_object.vol.offset)) continue else: name = renderers.NotApplicableValue() yield (0, (constraint.type_name, format_hints.Hex(header.vol.offset), header.vol.layer_name, name)) @staticmethod def builtin_constraints(symbol_table: str, tags_filter: List[bytes] = None) -> List[PoolConstraint]: """Get built-in PoolConstraints given a list of pool tags. The tags_filter is a list of pool tags, and the associated PoolConstraints are returned. If tags_filter is empty or not supplied, then all builtin constraints are returned. Args: symbol_table: The name of the symbol table to prepend to the types used tags_filter: List of tags to return or None to return all Returns: A list of well-known constructed PoolConstraints that match the provided tags """ builtins = [ # atom tables PoolConstraint(b'AtmT', type_name = symbol_table + constants.BANG + "_RTL_ATOM_TABLE", size = (200, None), page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE), # processes on windows before windows 8 PoolConstraint(b'Pro\xe3', type_name = symbol_table + constants.BANG + "_EPROCESS", object_type = "Process", size = (600, None), skip_type_test = True, page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE), # processes on windows starting with windows 8 PoolConstraint(b'Proc', type_name = symbol_table + constants.BANG + "_EPROCESS", object_type = "Process", size = (600, None), page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE), # files on windows before windows 8 PoolConstraint(b'Fil\xe5', type_name = symbol_table + constants.BANG + "_FILE_OBJECT", object_type = "File", size = (150, None), page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE), # files on windows starting with windows 8 PoolConstraint(b'File', type_name = symbol_table + constants.BANG + "_FILE_OBJECT", object_type = "File", size = (150, None), page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE), # mutants on windows before windows 8 PoolConstraint(b'Mut\xe1', type_name = symbol_table + constants.BANG + "_KMUTANT", object_type = "Mutant", size = (64, None), page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE), # mutants on windows starting with windows 8 PoolConstraint(b'Muta', type_name = symbol_table + constants.BANG + "_KMUTANT", object_type = "Mutant", size = (64, None), page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE), # drivers on windows before windows 8 PoolConstraint(b'Dri\xf6', type_name = symbol_table + constants.BANG + "_DRIVER_OBJECT", object_type = "Driver", size = (248, None), page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE), # drivers on windows starting with windows 8 PoolConstraint(b'Driv', type_name = symbol_table + constants.BANG + "_DRIVER_OBJECT", object_type = "Driver", size = (248, None), page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE), # kernel modules PoolConstraint(b'MmLd', type_name = symbol_table + constants.BANG + "_LDR_DATA_TABLE_ENTRY", size = (76, None), page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE), # symlinks on windows before windows 8 PoolConstraint(b'Sym\xe2', type_name = symbol_table + constants.BANG + "_OBJECT_SYMBOLIC_LINK", object_type = "SymbolicLink", size = (72, None), page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE), # symlinks on windows starting with windows 8 PoolConstraint(b'Symb', type_name = symbol_table + constants.BANG + "_OBJECT_SYMBOLIC_LINK", object_type = "SymbolicLink", size = (72, None), page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE), # registry hives PoolConstraint(b'CM10', type_name = symbol_table + constants.BANG + "_CMHIVE", size = (800, None), page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE, skip_type_test = True), ] if not tags_filter: return builtins return [constraint for constraint in builtins if constraint.tag in tags_filter] @classmethod def generate_pool_scan(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str, constraints: List[PoolConstraint]) \ -> Generator[Tuple[ PoolConstraint, interfaces.objects.ObjectInterface, interfaces.objects.ObjectInterface], None, None]: """ Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols constraints: List of pool constraints used to limit the scan results Returns: Iterable of tuples, containing the constraint that matched, the object from memory, the object header used to determine the object """ # get the object type map type_map = handles.Handles.get_type_map(context = context, layer_name = layer_name, symbol_table = symbol_table) cookie = handles.Handles.find_cookie(context = context, layer_name = layer_name, symbol_table = symbol_table) is_windows_10 = versions.is_windows_10(context, symbol_table) is_windows_8_or_later = versions.is_windows_8_or_later(context, symbol_table) # start off with the primary virtual layer scan_layer = layer_name # switch to a non-virtual layer if necessary if not is_windows_10: scan_layer = context.layers[scan_layer].config['memory_layer'] if symbols.symbol_table_is_64bit(context, symbol_table): alignment = 0x10 else: alignment = 8 for constraint, header in cls.pool_scan(context, scan_layer, symbol_table, constraints, alignment = alignment): mem_object = header.get_object(type_name = constraint.type_name, use_top_down = is_windows_8_or_later, executive = constraint.object_type is not None, native_layer_name = 'primary', kernel_symbol_table = symbol_table) if mem_object is None: vollog.log(constants.LOGLEVEL_VVV, "Cannot create an instance of {}".format(constraint.type_name)) continue if constraint.object_type is not None and not constraint.skip_type_test: try: if mem_object.get_object_header().get_object_type(type_map, cookie) != constraint.object_type: continue except exceptions.InvalidAddressException: vollog.log(constants.LOGLEVEL_VVV, "Cannot test instance type check for {}".format(constraint.type_name)) continue yield constraint, mem_object, header @classmethod def pool_scan(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str, pool_constraints: List[PoolConstraint], alignment: int = 8, progress_callback: Optional[constants.ProgressCallback] = None) \ -> Generator[Tuple[PoolConstraint, interfaces.objects.ObjectInterface], None, None]: """Returns the _POOL_HEADER object (based on the symbol_table template) after scanning through layer_name returning all headers that match any of the constraints provided. Only one constraint can be provided per tag. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols pool_constraints: List of pool constraints used to limit the scan results alignment: An optional value that all pool headers will be aligned to progress_callback: An optional function to provide progress feedback whilst scanning Returns: An Iterable of pool constraints and the pool headers associated with them """ # Setup the pattern constraint_lookup = {} # type: Dict[bytes, PoolConstraint] for constraint in pool_constraints: if constraint.tag in constraint_lookup: raise ValueError("Constraint tag is used for more than one constraint: {}".format(repr(constraint.tag))) constraint_lookup[constraint.tag] = constraint pool_header_table_name = cls.get_pool_header_table(context, symbol_table) module = context.module(pool_header_table_name, layer_name, offset = 0) # Run the scan locating the offsets of a particular tag layer = context.layers[layer_name] scanner = PoolHeaderScanner(module, constraint_lookup, alignment) yield from layer.scan(context, scanner, progress_callback) @classmethod def get_pool_header_table(cls, context: interfaces.context.ContextInterface, symbol_table: str) -> str: """Returns the appropriate symbol_table containing a _POOL_HEADER type, even if the original symbol table doesn't contain one. Args: context: The context that the symbol tables does (or will) reside in symbol_table: The expected symbol_table to contain the _POOL_HEADER type """ # Setup the pool header and offset differential try: context.symbol_space.get_type(symbol_table + constants.BANG + "_POOL_HEADER") table_name = symbol_table except exceptions.SymbolError: # We have to manually load a symbol table if symbols.symbol_table_is_64bit(context, symbol_table): is_win_7 = versions.is_windows_7(context, symbol_table) if is_win_7: pool_header_json_filename = "poolheader-x64-win7" else: pool_header_json_filename = "poolheader-x64" else: pool_header_json_filename = "poolheader-x86" # set the class_type to match the normal WindowsKernelIntermedSymbols is_vista_or_later = versions.is_vista_or_later(context, symbol_table) if is_vista_or_later: class_type = extensions.pool.POOL_HEADER_VISTA else: class_type = extensions.pool.POOL_HEADER table_name = intermed.IntermediateSymbolTable.create(context = context, config_path = configuration.path_join( context.symbol_space[symbol_table].config_path, "poolheader"), sub_path = "windows", filename = pool_header_json_filename, table_mapping = {'nt_symbols': symbol_table}, class_types = {'_POOL_HEADER': class_type}) return table_name def run(self) -> renderers.TreeGrid: return renderers.TreeGrid([("Tag", str), ("Offset", format_hints.Hex), ("Layer", str), ("Name", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/windows/privileges.py000066400000000000000000000111341405267600400261560ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 import json import logging import os from typing import List from volatility3.framework import renderers, interfaces, objects, exceptions, constants from volatility3.framework.configuration import requirements from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) class Privs(interfaces.plugins.PluginInterface): """Lists process token privileges""" _version = (1, 0, 0) _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) # Find the sids json path (or raise error if its not in the plugin directory). for plugin_dir in constants.PLUGINS_PATH: sids_json_file_name = os.path.join(plugin_dir, os.path.join("windows", "sids_and_privileges.json")) if os.path.exists(sids_json_file_name): break else: vollog.log(constants.LOGLEVEL_VVV, 'sids_and_privileges.json file is missing plugin error') raise RuntimeError("The sids_and_privileges.json file missed from you plugin directory") # Get service sids dictionary (we need only the service sids). with open(sids_json_file_name, 'r') as file_handle: temp_json = json.load(file_handle)['privileges'] self.privilege_info = {int(priv_num): temp_json[priv_num] for priv_num in temp_json} @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, optional = True), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), ] def _generator(self, procs): for task in procs: try: process_token = task.Token.dereference().cast("_TOKEN") except exceptions.InvalidAddressException: vollog.log(constants.LOGLEVEL_VVV, 'Skeep invalid token.') continue for value, present, enabled, default in process_token.privileges(): # Skip privileges whose bit positions cannot be # translated to a privilege name if not self.privilege_info.get(int(value)): vollog.log(constants.LOGLEVEL_VVV, 'Skeep invalid privilege ({}).'.format(value)) continue name, desc = self.privilege_info.get(int(value)) # Set the attributes attributes = [] if present: attributes.append("Present") if enabled: attributes.append("Enabled") if default: attributes.append("Default") yield (0, [ int(task.UniqueProcessId), objects.utility.array_to_string(task.ImageFileName), int(value), str(name), ",".join(attributes), str(desc) ]) def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), ("Value", int), ("Privilege", str), ("Attributes", str), ("Description", str)], self._generator( pslist.PsList.list_processes(context = self.context, layer_name = self.config['primary'], symbol_table = self.config['nt_symbols'], filter_func = filter_func))) volatility3-1.0.1/volatility3/framework/plugins/windows/pslist.py000066400000000000000000000252441405267600400253320ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import datetime import logging from typing import Callable, Iterable, List, Type from volatility3.framework import renderers, interfaces, layers, constants from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows.extensions import pe from volatility3.plugins import timeliner vollog = logging.getLogger(__name__) class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Lists the processes present in a particular windows memory image.""" _required_framework_version = (1, 0, 0) _version = (2, 0, 0) PHYSICAL_DEFAULT = False @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.BooleanRequirement(name = 'physical', description = 'Display physical offsets instead of virtual', default = cls.PHYSICAL_DEFAULT, optional = True), requirements.ListRequirement(name = 'pid', element_type = int, description = "Process ID to include (all other processes are excluded)", optional = True), requirements.BooleanRequirement(name = 'dump', description = "Extract listed processes", default = False, optional = True) ] @classmethod def process_dump( cls, context: interfaces.context.ContextInterface, kernel_table_name: str, pe_table_name: str, proc: interfaces.objects.ObjectInterface, open_method: Type[interfaces.plugins.FileHandlerInterface]) -> interfaces.plugins.FileHandlerInterface: """Extracts the complete data for a process as a FileHandlerInterface Args: context: the context to operate upon kernel_table_name: the name for the symbol table containing the kernel's symbols pe_table_name: the name for the symbol table containing the PE format symbols proc: the process object whose memory should be output open_method: class to provide context manager for opening the file Returns: An open FileHandlerInterface object containing the complete data for the process or None in the case of failure """ file_handle = None try: proc_layer_name = proc.add_process_layer() peb = context.object(kernel_table_name + constants.BANG + "_PEB", layer_name = proc_layer_name, offset = proc.Peb) dos_header = context.object(pe_table_name + constants.BANG + "_IMAGE_DOS_HEADER", offset = peb.ImageBaseAddress, layer_name = proc_layer_name) file_handle = open_method("pid.{0}.{1:#x}.dmp".format(proc.UniqueProcessId, peb.ImageBaseAddress)) for offset, data in dos_header.reconstruct(): file_handle.seek(offset) file_handle.write(data) except Exception as excp: vollog.debug("Unable to dump PE with pid {}: {}".format(proc.UniqueProcessId, excp)) return file_handle @classmethod def create_pid_filter(cls, pid_list: List[int] = None) -> Callable[[interfaces.objects.ObjectInterface], bool]: """A factory for producing filter functions that filter based on a list of process IDs. Args: pid_list: A list of process IDs that are acceptable, all other processes will be filtered out Returns: Filter function for passing to the `list_processes` method """ filter_func = lambda _: False # FIXME: mypy #4973 or #2608 pid_list = pid_list or [] filter_list = [x for x in pid_list if x is not None] if filter_list: filter_func = lambda x: x.UniqueProcessId not in filter_list return filter_func @classmethod def create_name_filter(cls, name_list: List[str] = None) -> Callable[[interfaces.objects.ObjectInterface], bool]: """A factory for producing filter functions that filter based on a list of process names. Args: name_list: A list of process names that are acceptable, all other processes will be filtered out Returns: Filter function for passing to the `list_processes` method """ filter_func = lambda _: False # FIXME: mypy #4973 or #2608 name_list = name_list or [] filter_list = [x for x in name_list if x is not None] if filter_list: filter_func = lambda x: utility.array_to_string(x.ImageFileName) not in filter_list return filter_func @classmethod def list_processes(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str, filter_func: Callable[[interfaces.objects.ObjectInterface], bool] = lambda _: False) -> \ Iterable[interfaces.objects.ObjectInterface]: """Lists all the processes in the primary layer that are in the pid config option. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols filter_func: A function which takes an EPROCESS object and returns True if the process should be ignored/filtered Returns: The list of EPROCESS objects from the `layer_name` layer's PsActiveProcessHead list after filtering """ # We only use the object factory to demonstrate how to use one kvo = context.layers[layer_name].config['kernel_virtual_offset'] ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo) ps_aph_offset = ntkrnlmp.get_symbol("PsActiveProcessHead").address list_entry = ntkrnlmp.object(object_type = "_LIST_ENTRY", offset = ps_aph_offset) # This is example code to demonstrate how to use symbol_space directly, rather than through a module: # # ``` # reloff = self.context.symbol_space.get_type( # self.config['nt_symbols'] + constants.BANG + "_EPROCESS").relative_child_offset( # "ActiveProcessLinks") # ``` # # Note: "nt_symbols!_EPROCESS" could have been used, but would rely on the "nt_symbols" symbol table not already # having been present. Strictly, the value of the requirement should be joined with the BANG character # defined in the constants file reloff = ntkrnlmp.get_type("_EPROCESS").relative_child_offset("ActiveProcessLinks") eproc = ntkrnlmp.object(object_type = "_EPROCESS", offset = list_entry.vol.offset - reloff, absolute = True) for proc in eproc.ActiveProcessLinks: if not filter_func(proc): yield proc def _generator(self): pe_table_name = intermed.IntermediateSymbolTable.create(self.context, self.config_path, "windows", "pe", class_types = pe.class_types) memory = self.context.layers[self.config['primary']] if not isinstance(memory, layers.intel.Intel): raise TypeError("Primary layer is not an intel layer") for proc in self.list_processes(self.context, self.config['primary'], self.config['nt_symbols'], filter_func = self.create_pid_filter(self.config.get('pid', None))): if not self.config.get('physical', self.PHYSICAL_DEFAULT): offset = proc.vol.offset else: (_, _, offset, _, _) = list(memory.mapping(offset = proc.vol.offset, length = 0))[0] file_output = "Disabled" if self.config['dump']: file_handle = self.process_dump(self.context, self.config['nt_symbols'], pe_table_name, proc, self.open) file_output = "Error outputting file" if file_handle: file_handle.close() file_output = str(file_handle.preferred_filename) yield (0, (proc.UniqueProcessId, proc.InheritedFromUniqueProcessId, proc.ImageFileName.cast("string", max_length = proc.ImageFileName.vol.count, errors = 'replace'), format_hints.Hex(offset), proc.ActiveThreads, proc.get_handle_count(), proc.get_session_id(), proc.get_is_wow64(), proc.get_create_time(), proc.get_exit_time(), file_output)) def generate_timeline(self): for row in self._generator(): _depth, row_data = row description = "Process: {} {} ({})".format(row_data[0], row_data[2], row_data[3]) yield (description, timeliner.TimeLinerType.CREATED, row_data[8]) yield (description, timeliner.TimeLinerType.MODIFIED, row_data[9]) def run(self): offsettype = "(V)" if not self.config.get('physical', self.PHYSICAL_DEFAULT) else "(P)" return renderers.TreeGrid([("PID", int), ("PPID", int), ("ImageFileName", str), ("Offset{0}".format(offsettype), format_hints.Hex), ("Threads", int), ("Handles", int), ("SessionId", int), ("Wow64", bool), ("CreateTime", datetime.datetime), ("ExitTime", datetime.datetime), ("File output", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/windows/psscan.py000066400000000000000000000227671405267600400253120ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import datetime import logging from typing import Iterable, Callable, Tuple from volatility3.framework import renderers, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows.extensions import pe from volatility3.plugins import timeliner from volatility3.plugins.windows import info from volatility3.plugins.windows import poolscanner from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Scans for processes present in a particular windows memory image.""" _required_framework_version = (1, 0, 0) _version = (1, 1, 0) @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.VersionRequirement(name = 'info', component = info.Info, version = (1, 0, 0)), requirements.ListRequirement(name = 'pid', element_type = int, description = "Process ID to include (all other processes are excluded)", optional = True), requirements.BooleanRequirement(name = 'dump', description = "Extract listed processes", default = False, optional = True) ] @classmethod def scan_processes(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str, filter_func: Callable[[interfaces.objects.ObjectInterface], bool] = lambda _: False) -> \ Iterable[interfaces.objects.ObjectInterface]: """Scans for processes using the poolscanner module and constraints. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols Returns: A list of processes found by scanning the `layer_name` layer for process pool signatures """ constraints = poolscanner.PoolScanner.builtin_constraints(symbol_table, [b'Pro\xe3', b'Proc']) for result in poolscanner.PoolScanner.generate_pool_scan(context, layer_name, symbol_table, constraints): _constraint, mem_object, _header = result if not filter_func(mem_object): yield mem_object @classmethod def virtual_process_from_physical(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str, proc: interfaces.objects.ObjectInterface) -> \ Iterable[interfaces.objects.ObjectInterface]: """ Returns a virtual process from a physical addressed one Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols proc: the process object with phisical address Returns: A process object on virtual address layer """ version = cls.get_osversion(context, layer_name, symbol_table) # If it's WinXP->8.1 we have now a physical process address. # We'll use the first thread to bounce back to the virtual process kvo = context.layers[layer_name].config['kernel_virtual_offset'] ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo) tleoffset = ntkrnlmp.get_type("_ETHREAD").relative_child_offset("ThreadListEntry") # Start out with the member offset offsets = [tleoffset] # If (and only if) we're dealing with 64-bit Windows 7 SP1 # then add the other commonly seen member offset to the list bits = context.layers[layer_name].bits_per_register if version == (6, 1, 7601) and bits == 64: offsets.append(tleoffset + 8) # Now we can try to bounce back for ofs in offsets: ethread = ntkrnlmp.object(object_type = "_ETHREAD", offset = proc.ThreadListHead.Flink - ofs, absolute = True) # Ask for the thread's process to get an _EPROCESS with a virtual address layer virtual_process = ethread.owning_process() # Sanity check the bounce. # This compares the original offset with the new one (translated from virtual layer) (_, _, ph_offset, _, _) = list(context.layers[layer_name].mapping(offset = virtual_process.vol.offset, length = 0))[0] if virtual_process and \ proc.vol.offset == ph_offset: return virtual_process @classmethod def get_osversion(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str) -> Tuple[int, int, int]: """Returns the complete OS version (MAJ,MIN,BUILD) Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols Returns: A tuple with (MAJ,MIN,BUILD) """ kuser = info.Info.get_kuser_structure(context, layer_name, symbol_table) nt_major_version = int(kuser.NtMajorVersion) nt_minor_version = int(kuser.NtMinorVersion) vers = info.Info.get_version_structure(context, layer_name, symbol_table) build = vers.MinorVersion return (nt_major_version, nt_minor_version, build) def _generator(self): pe_table_name = intermed.IntermediateSymbolTable.create(self.context, self.config_path, "windows", "pe", class_types = pe.class_types) for proc in self.scan_processes(self.context, self.config['primary'], self.config['nt_symbols'], filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None))): file_output = "Disabled" if self.config['dump']: # windows 10 objects (maybe others in the future) are already in virtual memory if proc.vol.layer_name == self.config['primary']: vproc = proc else: vproc = self.virtual_process_from_physical(self.context, self.config['primary'], self.config['nt_symbols'], proc) file_handle = pslist.PsList.process_dump(self.context, self.config['nt_symbols'], pe_table_name, vproc, self.open) file_output = "Error outputting file" if file_handle: file_output = file_handle.preferred_filename yield (0, (proc.UniqueProcessId, proc.InheritedFromUniqueProcessId, proc.ImageFileName.cast("string", max_length = proc.ImageFileName.vol.count, errors = 'replace'), format_hints.Hex(proc.vol.offset), proc.ActiveThreads, proc.get_handle_count(), proc.get_session_id(), proc.get_is_wow64(), proc.get_create_time(), proc.get_exit_time(), file_output)) def generate_timeline(self): for row in self._generator(): _depth, row_data = row description = "Process: {} {} ({})".format(row_data[0], row_data[2], row_data[3]) yield (description, timeliner.TimeLinerType.CREATED, row_data[8]) yield (description, timeliner.TimeLinerType.MODIFIED, row_data[9]) def run(self): return renderers.TreeGrid([("PID", int), ("PPID", int), ("ImageFileName", str), ("Offset", format_hints.Hex), ("Threads", int), ("Handles", int), ("SessionId", int), ("Wow64", bool), ("CreateTime", datetime.datetime), ("ExitTime", datetime.datetime), ("File output", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/windows/pstree.py000066400000000000000000000112441405267600400253110ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import datetime from typing import Dict, Set from volatility3.framework import objects, interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.plugins.windows import pslist class PsTree(interfaces.plugins.PluginInterface): """Plugin for listing processes in a tree based on their parent process ID.""" _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs) -> None: super().__init__(*args, **kwargs) self._processes = {} # type: Dict[int, interfaces.objects.ObjectInterface] self._levels = {} # type: Dict[int, int] self._children = {} # type: Dict[int, Set[int]] @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.BooleanRequirement(name = 'physical', description = 'Display physical offsets instead of virtual', default = pslist.PsList.PHYSICAL_DEFAULT, optional = True), requirements.VersionRequirement(name = 'pslist', component = pslist.PsList, version = (2, 0, 0)), requirements.ListRequirement(name = 'pid', element_type = int, description = "Process ID to include (all other processes are excluded)", optional = True) ] def find_level(self, pid: objects.Pointer) -> None: """Finds how deep the pid is in the processes list.""" seen = set([]) seen.add(pid) level = 0 proc = self._processes.get(pid, None) while proc is not None and proc.InheritedFromUniqueProcessId not in seen: child_list = self._children.get(proc.InheritedFromUniqueProcessId, set([])) child_list.add(proc.UniqueProcessId) self._children[proc.InheritedFromUniqueProcessId] = child_list proc = self._processes.get(proc.InheritedFromUniqueProcessId, None) level += 1 self._levels[pid] = level def _generator(self): """Generates the Tree of processes.""" for proc in pslist.PsList.list_processes(self.context, self.config['primary'], self.config['nt_symbols']): if not self.config.get('physical', pslist.PsList.PHYSICAL_DEFAULT): offset = proc.vol.offset else: layer_name = self.config['primary'] memory = self.context.layers[layer_name] (_, _, offset, _, _) = list(memory.mapping(offset = proc.vol.offset, length = 0))[0] self._processes[proc.UniqueProcessId] = proc # Build the child/level maps for pid in self._processes: self.find_level(pid) def yield_processes(pid): proc = self._processes[pid] row = (proc.UniqueProcessId, proc.InheritedFromUniqueProcessId, proc.ImageFileName.cast("string", max_length = proc.ImageFileName.vol.count, errors = 'replace'), format_hints.Hex(offset), proc.ActiveThreads, proc.get_handle_count(), proc.get_session_id(), proc.get_is_wow64(), proc.get_create_time(), proc.get_exit_time()) yield (self._levels[pid] - 1, row) for child_pid in self._children.get(pid, []): yield from yield_processes(child_pid) for pid in self._levels: if self._levels[pid] == 1: yield from yield_processes(pid) def run(self): offsettype = "(V)" if not self.config.get('physical', pslist.PsList.PHYSICAL_DEFAULT) else "(P)" return renderers.TreeGrid([("PID", int), ("PPID", int), ("ImageFileName", str), ("Offset{0}".format(offsettype), format_hints.Hex), ("Threads", int), ("Handles", int), ("SessionId", int), ("Wow64", bool), ("CreateTime", datetime.datetime), ("ExitTime", datetime.datetime)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/windows/registry/000077500000000000000000000000001405267600400253035ustar00rootroot00000000000000volatility3-1.0.1/volatility3/framework/plugins/windows/registry/__init__.py000066400000000000000000000005071405267600400274160ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """All core windows registry plugins. These modules should only be imported from volatility3.plugins NOT volatility3.framework.plugins """ volatility3-1.0.1/volatility3/framework/plugins/windows/registry/hivelist.py000066400000000000000000000311431405267600400275060ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import Iterator, List, Tuple, Iterable, Optional from volatility3.framework import renderers, interfaces, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.layers import registry from volatility3.framework.renderers import format_hints from volatility3.plugins.windows.registry import hivescan vollog = logging.getLogger(__name__) class HiveGenerator: """Walks the registry HiveList linked list in a given direction and stores an invalid offset if it's unable to fully walk the list""" _required_framework_version = (1, 0, 0) def __init__(self, cmhive, forward = True): self._cmhive = cmhive self._forward = forward self._invalid = None def __iter__(self): for hive in self._cmhive.HiveList.to_list(self._cmhive.vol.type_name, "HiveList", forward = self._forward): if not hive.is_valid(): self._invalid = hive.vol.offset return yield hive @property def invalid(self) -> Optional[int]: return self._invalid class HiveList(interfaces.plugins.PluginInterface): """Lists the registry hives present in a particular memory image.""" _version = (1, 0, 0) _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.StringRequirement(name = 'filter', description = "String to filter hive names returned", optional = True, default = None), requirements.PluginRequirement(name = 'hivescan', plugin = hivescan.HiveScan, version = (1, 0, 0)), requirements.BooleanRequirement(name = 'dump', description = "Extract listed registry hives", default = False, optional = True) ] def _sanitize_hive_name(self, name: str) -> str: return name.split('\\')[-1].replace(' ', '_').replace('.', '').replace('[', '').replace(']', '') def _generator(self) -> Iterator[Tuple[int, Tuple[int, str]]]: chunk_size = 0x500000 for hive_object in self.list_hive_objects(context = self.context, layer_name = self.config["primary"], symbol_table = self.config["nt_symbols"], filter_string = self.config.get('filter', None)): file_output = "Disabled" if self.config['dump']: # Construct the hive hive = next( self.list_hives(self.context, self.config_path, layer_name = self.config["primary"], symbol_table = self.config["nt_symbols"], hive_offsets = [hive_object.vol.offset])) maxaddr = hive.hive.Storage[0].Length hive_name = self._sanitize_hive_name(hive.get_name()) file_handle = self.open('registry.{}.{}.hive'.format(hive_name, hex(hive.hive_offset))) with file_handle as file_data: if hive._base_block: hive_data = self.context.layers[hive.dependencies[0]].read(hive.hive.BaseBlock, 1 << 12) else: hive_data = '\x00' * (1 << 12) file_data.write(hive_data) for i in range(0, maxaddr, chunk_size): current_chunk_size = min(chunk_size, maxaddr - i) data = hive.read(i, current_chunk_size, pad = True) file_data.write(data) # if self._progress_callback: # self._progress_callback((i / maxaddr) * 100, 'Writing layer {}'.format(hive_name)) file_output = file_handle.preferred_filename yield (0, (format_hints.Hex(hive_object.vol.offset), hive_object.get_name() or "", file_output)) @classmethod def list_hives(cls, context: interfaces.context.ContextInterface, base_config_path: str, layer_name: str, symbol_table: str, filter_string: Optional[str] = None, hive_offsets: List[int] = None) -> Iterable[registry.RegistryHive]: """Walks through a registry, hive by hive returning the constructed registry layer name. Args: context: The context to retrieve required elements (layers, symbol tables) from base_config_path: The configuration path for any settings required by the new table layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols filter_string: An optional string which must be present in the hive name if specified offset: An optional offset to specify a specific hive to iterate over (takes precedence over filter_string) Yields: A registry hive layer name """ if hive_offsets is None: try: hive_offsets = [ hive.vol.offset for hive in cls.list_hive_objects(context, layer_name, symbol_table, filter_string) ] except ImportError: vollog.warning("Unable to import windows.hivelist plugin, please provide a hive offset") raise ValueError("Unable to import windows.hivelist plugin, please provide a hive offset") for hive_offset in hive_offsets: # Construct the hive reg_config_path = cls.make_subconfig(context = context, base_config_path = base_config_path, hive_offset = hive_offset, base_layer = layer_name, nt_symbols = symbol_table) try: hive = registry.RegistryHive(context, reg_config_path, name = 'hive' + hex(hive_offset)) except exceptions.InvalidAddressException: vollog.warning("Couldn't create RegistryHive layer at offset {}, skipping".format(hex(hive_offset))) continue context.layers.add_layer(hive) yield hive @classmethod def list_hive_objects(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str, filter_string: str = None) -> Iterator[interfaces.objects.ObjectInterface]: """Lists all the hives in the primary layer. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols filter_string: A string which must be present in the hive name if specified Returns: The list of registry hives from the `layer_name` layer as filtered against using the `filter_string` """ # We only use the object factory to demonstrate how to use one kvo = context.layers[layer_name].config['kernel_virtual_offset'] ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo) list_head = ntkrnlmp.get_symbol("CmpHiveListHead").address list_entry = ntkrnlmp.object(object_type = "_LIST_ENTRY", offset = list_head) reloff = ntkrnlmp.get_type("_CMHIVE").relative_child_offset("HiveList") cmhive = ntkrnlmp.object(object_type = "_CMHIVE", offset = list_entry.vol.offset - reloff, absolute = True) # Run through the list forwards seen = set() hg = HiveGenerator(cmhive, forward = True) for hive in hg: if hive.vol.offset in seen: vollog.debug("Hivelist found an already seen offset {} while " \ "traversing forwards, this should not occur".format(hex(hive.vol.offset))) break seen.add(hive.vol.offset) if filter_string is None or filter_string.lower() in str(hive.get_name() or "").lower(): if context.layers[layer_name].is_valid(hive.vol.offset): yield hive forward_invalid = hg.invalid if forward_invalid: vollog.debug("Hivelist failed traversing the list forwards at {}, traversing backwards".format( hex(forward_invalid))) hg = HiveGenerator(cmhive, forward = False) for hive in hg: if hive.vol.offset in seen: vollog.debug("Hivelist found an already seen offset {} while " \ "traversing backwards, list walking met in the middle".format(hex(hive.vol.offset))) break seen.add(hive.vol.offset) if filter_string is None or filter_string.lower() in str(hive.get_name() or "").lower(): if context.layers[layer_name].is_valid(hive.vol.offset): yield hive backward_invalid = hg.invalid if backward_invalid and forward_invalid != backward_invalid: # walking forward and backward did not stop at the same offset. they should if: # 1) there are no invalid hives, walking forwards would reach the end and backwards is not necessary # 2) there is one invalid hive, walking backwards would stop at the same place as forwards # therefore, there must be more 2 or more invalid hives, so the middle of the list is not reachable # by walking the list, so revert to scanning, and walk the list forwards and backwards from each # found hive vollog.debug("Hivelist failed traversing backwards at {}, a different " \ "location from forwards, revert to scanning".format(hex(backward_invalid))) for hive in hivescan.HiveScan.scan_hives(context, layer_name, symbol_table): try: if hive.HiveList.Flink: start_hive_offset = hive.HiveList.Flink - reloff ## Now instantiate the first hive in virtual address space as normal start_hive = ntkrnlmp.object(object_type = "_CMHIVE", offset = start_hive_offset, absolute = True) for forward in (True, False): for linked_hive in start_hive.HiveList.to_list(hive.vol.type_name, "HiveList", forward): if not linked_hive.is_valid() or linked_hive.vol.offset in seen: continue seen.add(linked_hive.vol.offset) if filter_string is None or filter_string.lower() in str(linked_hive.get_name() or "").lower(): if context.layers[layer_name].is_valid(linked_hive.vol.offset): yield linked_hive except exceptions.InvalidAddressException: vollog.debug("InvalidAddressException when traversing hive {} found from scan, skipping".format( hex(hive.vol.offset))) def run(self) -> renderers.TreeGrid: return renderers.TreeGrid([("Offset", format_hints.Hex), ("FileFullPath", str), ("File output", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/windows/registry/hivescan.py000066400000000000000000000070221405267600400274560ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from typing import Iterable from volatility3.framework import renderers, interfaces, symbols from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.framework.symbols.windows import versions from volatility3.plugins.windows import poolscanner, bigpools class HiveScan(interfaces.plugins.PluginInterface): """Scans for registry hives present in a particular windows memory image.""" _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.PluginRequirement(name = 'poolscanner', plugin = poolscanner.PoolScanner, version = (1, 0, 0)), requirements.PluginRequirement(name = 'bigpools', plugin = bigpools.BigPools, version = (1, 0, 0)), ] @classmethod def scan_hives(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str) -> \ Iterable[interfaces.objects.ObjectInterface]: """Scans for hives using the poolscanner module and constraints or bigpools module with tag. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols Returns: A list of Hive objects as found from the `layer_name` layer based on Hive pool signatures """ is_64bit = symbols.symbol_table_is_64bit(context, symbol_table) is_windows_8_1_or_later = versions.is_windows_8_1_or_later(context = context, symbol_table = symbol_table) if is_windows_8_1_or_later and is_64bit: kvo = context.layers[layer_name].config['kernel_virtual_offset'] ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo) for pool in bigpools.BigPools.list_big_pools(context, layer_name = layer_name, symbol_table = symbol_table, tags = ["CM10"]): cmhive = ntkrnlmp.object(object_type = "_CMHIVE", offset = pool.Va, absolute = True) yield cmhive else: constraints = poolscanner.PoolScanner.builtin_constraints(symbol_table, [b'CM10']) for result in poolscanner.PoolScanner.generate_pool_scan(context, layer_name, symbol_table, constraints): _constraint, mem_object, _header = result yield mem_object def _generator(self): for hive in self.scan_hives(self.context, self.config['primary'], self.config['nt_symbols']): yield (0, (format_hints.Hex(hive.vol.offset), )) def run(self): return renderers.TreeGrid([("Offset", format_hints.Hex)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/windows/registry/printkey.py000066400000000000000000000246051405267600400275310ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import datetime import logging from typing import List, Sequence, Iterable, Tuple, Union from volatility3.framework import objects, renderers, exceptions, interfaces, constants from volatility3.framework.configuration import requirements from volatility3.framework.layers.registry import RegistryHive, RegistryFormatException from volatility3.framework.renderers import TreeGrid, conversion, format_hints from volatility3.framework.symbols.windows.extensions.registry import RegValueTypes from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) class PrintKey(interfaces.plugins.PluginInterface): """Lists the registry keys under a hive or specific key value.""" _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.PluginRequirement(name = 'hivelist', plugin = hivelist.HiveList, version = (1, 0, 0)), requirements.IntRequirement(name = 'offset', description = "Hive Offset", default = None, optional = True), requirements.StringRequirement(name = 'key', description = "Key to start from", default = None, optional = True), requirements.BooleanRequirement(name = 'recurse', description = 'Recurses through keys', default = False, optional = True) ] @classmethod def key_iterator( cls, hive: RegistryHive, node_path: Sequence[objects.StructType] = None, recurse: bool = False ) -> Iterable[Tuple[int, bool, datetime.datetime, str, bool, interfaces.objects.ObjectInterface]]: """Walks through a set of nodes from a given node (last one in node_path). Avoids loops by not traversing into nodes already present in the node_path. Args: hive: The registry hive to walk node_path: The list of nodes that make up the recurse: Traverse down the node tree or stay only on the same level Yields: A tuple of results (depth, is_key, last write time, path, volatile, and the node). """ if not node_path: node_path = [hive.get_node(hive.root_cell_offset)] if not isinstance(node_path, list) or len(node_path) < 1: vollog.warning("Hive walker was not passed a valid node_path (or None)") return node = node_path[-1] key_path_items = [hive] + node_path[1:] key_path = '\\'.join([k.get_name() for k in key_path_items]) if node.vol.type_name.endswith(constants.BANG + '_CELL_DATA'): raise RegistryFormatException(hive.name, "Encountered _CELL_DATA instead of _CM_KEY_NODE") last_write_time = conversion.wintime_to_datetime(node.LastWriteTime.QuadPart) for key_node in node.get_subkeys(): result = (len(node_path), True, last_write_time, key_path, key_node.get_volatile(), key_node) yield result if recurse: if key_node.vol.offset not in [x.vol.offset for x in node_path]: try: key_node.get_name() except exceptions.InvalidAddressException as excp: vollog.debug(excp) continue yield from cls.key_iterator(hive, node_path + [key_node], recurse = recurse) for value_node in node.get_values(): result = (len(node_path), False, last_write_time, key_path, node.get_volatile(), value_node) yield result def _printkey_iterator(self, hive: RegistryHive, node_path: Sequence[objects.StructType] = None, recurse: bool = False): """Method that wraps the more generic key_iterator, to provide output for printkey specifically. Args: hive: The registry hive to walk node_path: The list of nodes that make up the recurse: Traverse down the node tree or stay only on the same level Yields: The depth, and a tuple of results (last write time, hive offset, type, path, name, data and volatile) """ for depth, is_key, last_write_time, key_path, volatile, node in self.key_iterator(hive, node_path, recurse): if is_key: try: key_node_name = node.get_name() except (exceptions.InvalidAddressException, RegistryFormatException) as excp: vollog.debug(excp) key_node_name = renderers.UnreadableValue() yield (depth, (last_write_time, renderers.format_hints.Hex(hive.hive_offset), "Key", key_path, key_node_name, renderers.NotApplicableValue(), volatile)) else: try: value_node_name = node.get_name() or "(Default)" except (exceptions.InvalidAddressException, RegistryFormatException) as excp: vollog.debug(excp) value_node_name = renderers.UnreadableValue() try: value_type = RegValueTypes.get(node.Type).name except (exceptions.InvalidAddressException, RegistryFormatException) as excp: vollog.debug(excp) value_type = renderers.UnreadableValue() if isinstance(value_type, renderers.UnreadableValue): vollog.debug("Couldn't read registry value type, so data is unreadable") value_data = renderers.UnreadableValue() # type: Union[interfaces.renderers.BaseAbsentValue, bytes] else: try: value_data = node.decode_data() if isinstance(value_data, int): value_data = format_hints.MultiTypeData(value_data, encoding = 'utf-8') elif RegValueTypes.get(node.Type) == RegValueTypes.REG_BINARY: value_data = format_hints.MultiTypeData(value_data, show_hex = True) elif RegValueTypes.get(node.Type) == RegValueTypes.REG_MULTI_SZ: value_data = format_hints.MultiTypeData(value_data, encoding = 'utf-16-le', split_nulls = True) else: value_data = format_hints.MultiTypeData(value_data, encoding = 'utf-16-le') except (ValueError, exceptions.InvalidAddressException, RegistryFormatException) as excp: vollog.debug(excp) value_data = renderers.UnreadableValue() result = (depth, (last_write_time, renderers.format_hints.Hex(hive.hive_offset), value_type, key_path, value_node_name, value_data, volatile)) yield result def _registry_walker(self, layer_name: str, symbol_table: str, hive_offsets: List[int] = None, key: str = None, recurse: bool = False): for hive in hivelist.HiveList.list_hives(self.context, self.config_path, layer_name = layer_name, symbol_table = symbol_table, hive_offsets = hive_offsets): try: # Walk it if key is not None: node_path = hive.get_key(key, return_list = True) else: node_path = [hive.get_node(hive.root_cell_offset)] for (x, y) in self._printkey_iterator(hive, node_path, recurse = recurse): yield (x - len(node_path), y) except (exceptions.InvalidAddressException, KeyError, RegistryFormatException) as excp: if isinstance(excp, KeyError): vollog.debug("Key '{}' not found in Hive at offset {}.".format(key, hex(hive.hive_offset))) elif isinstance(excp, RegistryFormatException): vollog.debug(excp) elif isinstance(excp, exceptions.InvalidAddressException): vollog.debug("Invalid address identified in Hive: {}".format(hex(excp.invalid_address))) result = (0, (renderers.UnreadableValue(), format_hints.Hex(hive.hive_offset), "Key", '?\\' + (key or ''), renderers.UnreadableValue(), renderers.UnreadableValue(), renderers.UnreadableValue())) yield result def run(self): offset = self.config.get('offset', None) return TreeGrid(columns = [('Last Write Time', datetime.datetime), ('Hive Offset', format_hints.Hex), ('Type', str), ('Key', str), ('Name', str), ('Data', format_hints.MultiTypeData), ('Volatile', bool)], generator = self._registry_walker(self.config['primary'], self.config['nt_symbols'], hive_offsets = None if offset is None else [offset], key = self.config.get('key', None), recurse = self.config.get('recurse', None))) volatility3-1.0.1/volatility3/framework/plugins/windows/registry/userassist.json000066400000000000000000000177041405267600400304140ustar00rootroot00000000000000{ "{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs", "{054FAE61-4DD8-4787-80B6-090220C4B700}": "GameExplorer", "{0762D272-C50A-4BB0-A382-697DCD729B80}": "%SystemDrive%\\Users", "{0AC0837C-BBF8-452A-850D-79D08E667CA7}": "(My) Computer", "{0F214138-B1D3-4a90-BBA9-27CBC0C5389A}": "Sync Setup", "{15CA69B3-30EE-49C1-ACE1-6B5EC372AFB5}": "%PUBLIC%\\Music\\Sample Playlists", "{1777F761-68AD-4D8A-87BD-30B759FA33DD}": "%USERPROFILE%\\Favorites", "{18989B1D-99B5-455B-841C-AB7C74E4DDFC}": "%USERPROFILE%\\Videos", "{190337d1-b8ca-4121-a639-6d472d16972a}": "Search Results", "{1A6FDBA2-F42D-4358-A798-B74D745926C5}": "%PUBLIC%\\RecordedTV.library-ms", "{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}": "%windir%\\system32", "{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}": "%APPDATA%\\Microsoft\\Windows\\Libraries", "{2112AB0A-C86A-4FFE-A368-0DE96E47012E}": "%APPDATA%\\Microsoft\\Windows\\Libraries\\Music.library-ms", "{2400183A-6185-49FB-A2D8-4A392A602BA3}": "%PUBLIC%\\Videos", "{289a9a43-be44-4057-a41b-587a76d7e7f9}": "Sync Results", "{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}": "%windir%\\resources\\0409 (code page)", "{2B0F765D-C0E9-4171-908E-08A611B84FF6}": "%APPDATA%\\Microsoft\\Windows\\Cookies", "{2C36C0AA-5812-4b87-BFD0-4CD0DFB19B39}": "%LOCALAPPDATA%\\Microsoft\\Windows Photo Gallery\\Original Images", "{3214FAB5-9757-4298-BB61-92A9DEAA44FF}": "%PUBLIC%\\Music", "{33E28130-4E1E-4676-835A-98395C3BC3BB}": "%USERPROFILE%\\Pictures", "{352481E8-33BE-4251-BA85-6007CAEDCF9D}": "%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files", "{374DE290-123F-4565-9164-39C4925E467B}": "%USERPROFILE%\\Downloads", "{3D644C9B-1FB8-4f30-9B45-F670235F79C0}": "%PUBLIC%\\Downloads", "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}": "%APPDATA% (%USERPROFILE%\\AppData\\Roaming)", "{43668BF8-C14E-49B2-97C9-747784D784B7}": "Sync Center", "{48DAF80B-E6CF-4F4E-B800-0E69D84EE384}": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Libraries", "{491E922F-5643-4AF4-A7EB-4E7A138D8174}": "%APPDATA%\\Microsoft\\Windows\\Libraries\\Videos.library-ms", "{4BD8D571-6D19-48D3-BE97-422220080E43}": "%USERPROFILE%\\Music", "{4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}": "%USERPROFILE%\\Saved Games", "{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}": "The Internet", "{4bfefb45-347d-4006-a5be-ac0cb0567192}": "Conflicts", "{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}": "Homegroup", "{52a4f021-7b75-48a9-9f6b-4b87a210bc8f}": "%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch", "{56784854-C6CB-462b-8169-88E350ACB882}": "%USERPROFILE%\\Contacts", "{5CD7AEE2-2219-4A67-B85D-6C9CE15660CB}": "%LOCALAPPDATA%\\Programs", "{5CE4A5E9-E4EB-479D-B89F-130C02886155}": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\DeviceMetadataStore", "{5E6C858F-0E22-4760-9AFE-EA3317B67173}": "%USERPROFILE% (%SystemDrive%\\Users\\%USERNAME%)", "{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}": "%APPDATA%\\Microsoft\\Windows\\Start Menu", "{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}": "%ALLUSERSPROFILE% (%ProgramData%, %SystemDrive%\\ProgramData)", "{6365D5A7-0F0D-45E5-87F6-0DA56B6A4F7D}": "%ProgramFiles%\\Common Files", "{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}": "%USERPROFILE%\\Pictures\\Slide Shows", "{6D809377-6AF0-444b-8957-A3773F02200E}": "%ProgramFiles%", "{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}": "Network Connections", "{724EF170-A42D-4FEF-9F26-B60E846FBA4F}": "%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", "{76FC4E2D-D6AD-4519-A663-37BD56068185}": "Printers", "{7B0DB17D-9CD2-4A93-9733-46CC89022E7C}": "%APPDATA%\\Microsoft\\Windows\\Libraries\\Documents.library-ms", "{7B396E54-9EC5-4300-BE0A-2482EBAE1A26}": "%ProgramFiles%\\Windows Sidebar\\Gadgets", "{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}": "%ProgramFiles%", "{7d1d3a04-debb-4115-95cf-2f29da2920da}": "%USERPROFILE%\\Searches", "{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp", "{82A74AEB-AEB4-465C-A014-D097EE346D63}": "Control Panel", "{859EAD94-2E85-48AD-A71A-0969CB56A6CD}": "%PUBLIC%\\Videos\\Sample Videos", "{8983036C-27C0-404B-8F08-102D10DCFD74}": "%APPDATA%\\Microsoft\\Windows\\SendTo", "{8AD10C31-2ADB-4296-A8F7-E4701232C972}": "%windir%\\Resources", "{905e63b6-c1bf-494e-b29c-65b732d3d21a}": "%ProgramFiles%", "{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}": "%APPDATA%\\Microsoft\\Windows\\Printer Shortcuts", "{98ec0e18-2098-4d44-8644-66979315a281}": "Microsoft Office Outlook", "{9E3995AB-1F9C-4F13-B827-48B24B6C7174}": "%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", "{9E52AB10-F80D-49DF-ACB8-4330F5687855}": "%LOCALAPPDATA%\\Microsoft\\Windows\\Burn\\Burn", "{A302545D-DEFF-464b-ABE8-61C8648D939B}": "Libraries", "{A4115719-D62E-491D-AA7C-E74B8BE3B067}": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu", "{A520A1A4-1780-4FF6-BD18-167343C5AF16}": "%USERPROFILE%\\AppData\\LocalLow", "{A63293E8-664E-48DB-A079-DF759E0509F7}": "%APPDATA%\\Microsoft\\Windows\\Templates", "{A75D362E-50FC-4fb7-AC2C-A8BEAA314493}": "%LOCALAPPDATA%\\Microsoft\\Windows Sidebar\\Gadgets", "{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}": "%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs", "{A990AE9F-A03B-4E80-94BC-9912D7504104}": "%APPDATA%\\Microsoft\\Windows\\Libraries\\Pictures.library-ms", "{AE50C081-EBD2-438A-8655-8A092E34987A}": "%APPDATA%\\Microsoft\\Windows\\Recent", "{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}": "%PUBLIC%\\Music\\Sample Music", "{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}": "Desktop", "{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}": "%PUBLIC%\\Pictures", "{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}": "Recycle Bin", "{B94237E7-57AC-4347-9151-B08C6C32D1F7}": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Templates", "{B97D20BB-F46A-4C97-BA10-5E3608430854}": "%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp", "{BCB5256F-79F6-4CEE-B725-DC34E402FD46}": "%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", "{BCBD3057-CA5C-4622-B42D-BC56DB0AE516}": "%LOCALAPPDATA%\\Programs\\Common", "{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}": "%ALLUSERSPROFILE%\\OEM Links", "{C4900540-2379-4C75-844B-64E6FAF8716B}": "%PUBLIC%\\Pictures\\Sample Pictures", "{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}": "%PUBLIC%\\Desktop", "{C5ABBF53-E17F-4121-8900-86626FC2C973}": "%APPDATA%\\Microsoft\\Windows\\Network Shortcuts", "{C870044B-F49E-4126-A9C3-B52A1FF411E8}": "%LOCALAPPDATA%\\Microsoft\\Windows\\Ringtones", "{CAC52C1A-B53D-4edc-92D7-6B2E8AC19434}": "Games", "{D0384E7D-BAC3-4797-8F14-CBA229B392B5}": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", "{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}": "Network", "{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}": "%windir%\\system32", "{D9DC8A3B-B784-432E-A781-5A1130A75963}": "%LOCALAPPDATA%\\Microsoft\\Windows\\History", "{DE92C1C7-837F-4F69-A3BB-86E631204A23}": "%USERPROFILE%\\Music\\Playlists", "{DE974D24-D9C6-4D3E-BF91-F4455120B917}": "%ProgramFiles%\\Common Files", "{DEBF2536-E1A8-4c59-B6A2-414586476AEA}": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\GameExplorer", "{DFDF76A2-C82A-4D63-906A-5644AC457385}": "%PUBLIC% (%SystemDrive%\\Users\\Public)", "{E555AB60-153B-4D17-9F04-A5FE99FC15EC}": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Ringtones", "{ED4824AF-DCE4-45A8-81E2-FC7965083634}": "%PUBLIC%\\Documents", "{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}": "%LOCALAPPDATA% (%USERPROFILE%\\AppData\\Local)", "{F38BF404-1D43-42F2-9305-67DE0B28FC23}": "%windir%", "{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}": "%ProgramFiles%\\Common Files", "{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}": "%windir%\\Fonts", "{a305ce99-f527-492b-8b1a-7e76fa98d6e4}": "Installed Updates", "{bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968}": "%USERPROFILE%\\Links", "{de61d971-5ebc-4f02-a3a9-6c82895e5c04}": "Add or Remove Programs (Control Panel)", "{df7266ac-9274-4867-8d55-3bd661de872d}": "Programs and Features", "{ee32e446-31ca-4aba-814f-a5ebd2fd6d5e}": "Offline Files", "{f3ce0f7c-4901-4acc-8648-d5d44b04ef8f}": "The user's full name" }volatility3-1.0.1/volatility3/framework/plugins/windows/registry/userassist.py000066400000000000000000000301261405267600400300640ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import codecs import datetime import json import logging import os from typing import Any, List, Tuple, Generator from volatility3.framework import exceptions, renderers, constants, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.layers.physical import BufferDataLayer from volatility3.framework.layers.registry import RegistryHive from volatility3.framework.renderers import format_hints, conversion from volatility3.framework.symbols import intermed from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) class UserAssist(interfaces.plugins.PluginInterface): """Print userassist registry keys and information.""" _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self._userassist_size = 0 self._userassist_type_name = "_VOL_USERASSIST_TYPES_7" self._reg_table_name = None self._win7 = None # taken from http://msdn.microsoft.com/en-us/library/dd378457%28v=vs.85%29.aspx self._folder_guids = json.load(open(os.path.join(os.path.dirname(__file__), "userassist.json"), "rb")) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.IntRequirement(name = 'offset', description = "Hive Offset", default = None, optional = True), requirements.PluginRequirement(name = 'hivelist', plugin = hivelist.HiveList, version = (1, 0, 0)) ] def parse_userassist_data(self, reg_val): """Reads the raw data of a _CM_KEY_VALUE and returns a dict of userassist fields.""" item = { "id": renderers.UnparsableValue(), "count": renderers.UnparsableValue(), "focus": renderers.UnparsableValue(), "time": renderers.UnparsableValue(), "lastupdated": renderers.UnparsableValue(), "rawdata": renderers.UnparsableValue(), } userassist_data = reg_val.decode_data() if userassist_data is None: return item item["rawdata"] = userassist_data if self._win7 is None: # if OS is still unknown at this point, return the default item which just has the rawdata return item if len(userassist_data) < self._userassist_size: return item userassist_layer_name = self.context.layers.free_layer_name("userassist_buffer") buffer = BufferDataLayer(self.context, self._config_path, userassist_layer_name, userassist_data) self.context.add_layer(buffer) userassist_obj = self.context.object( object_type = self._reg_table_name + constants.BANG + self._userassist_type_name, layer_name = userassist_layer_name, offset = 0) if self._win7: item["id"] = renderers.NotApplicableValue() item["count"] = int(userassist_obj.Count) seconds = (userassist_obj.FocusTime + 500) / 1000.0 time = datetime.timedelta(seconds = seconds) if seconds > 0 else userassist_obj.FocusTime item["focus"] = int(userassist_obj.FocusCount) item["time"] = str(time) else: item["id"] = int(userassist_obj.ID) item["count"] = int(userassist_obj.CountStartingAtFive if userassist_obj.CountStartingAtFive < 5 else userassist_obj.CountStartingAtFive - 5) item["focus"] = renderers.NotApplicableValue() item["time"] = renderers.NotApplicableValue() item["lastupdated"] = conversion.wintime_to_datetime(userassist_obj.LastUpdated.QuadPart) return item def _determine_userassist_type(self) -> None: """Determine the userassist type and size depending on the OS version.""" if self._win7 is True: self._userassist_type_name = "_VOL_USERASSIST_TYPES_7" elif self._win7 is False: self._userassist_type_name = "_VOL_USERASSIST_TYPES_XP" self._userassist_size = self.context.symbol_space.get_type(self._reg_table_name + constants.BANG + self._userassist_type_name).size def _win7_or_later(self) -> bool: # TODO: change this if there is a better way of determining the OS version # _KUSER_SHARED_DATA.CookiePad is in Windows 6.1 (Win7) and later return self.context.symbol_space.get_type(self.config['nt_symbols'] + constants.BANG + "_KUSER_SHARED_DATA").has_member('CookiePad') def list_userassist(self, hive: RegistryHive) -> Generator[Tuple[int, Tuple], None, None]: """Generate userassist data for a registry hive.""" hive_name = hive.hive.cast(self.config["nt_symbols"] + constants.BANG + "_CMHIVE").get_name() if self._win7 is None: try: self._win7 = self._win7_or_later() except exceptions.SymbolError: # self._win7 will be None and only registry value rawdata will be output pass self._determine_userassist_type() userassist_node_path = hive.get_key("software\\microsoft\\windows\\currentversion\\explorer\\userassist", return_list = True) if not userassist_node_path: vollog.warning("list_userassist did not find a valid node_path (or None)") return if not isinstance(userassist_node_path, list): vollog.warning("userassist_node_path did not return a list as expected") return userassist_node = userassist_node_path[-1] # iterate through the GUIDs under the userassist key for guidkey in userassist_node.get_subkeys(): # each guid key should have a Count key in it for countkey in guidkey.get_subkeys(): countkey_path = countkey.get_key_path() countkey_last_write_time = conversion.wintime_to_datetime(countkey.LastWriteTime.QuadPart) # output the parent Count key result = ( 0, (renderers.format_hints.Hex(hive.hive_offset), hive_name, countkey_path, countkey_last_write_time, "Key", renderers.NotApplicableValue(), renderers.NotApplicableValue(), renderers.NotApplicableValue(), renderers.NotApplicableValue(), renderers.NotApplicableValue(), renderers.NotApplicableValue(), renderers.NotApplicableValue()) ) # type: Tuple[int, Tuple[format_hints.Hex, Any, Any, Any, Any, Any, Any, Any, Any, Any, Any, Any]] yield result # output any subkeys under Count for subkey in countkey.get_subkeys(): subkey_name = subkey.get_name() result = (1, ( renderers.format_hints.Hex(hive.hive_offset), hive_name, countkey_path, countkey_last_write_time, "Subkey", subkey_name, renderers.NotApplicableValue(), renderers.NotApplicableValue(), renderers.NotApplicableValue(), renderers.NotApplicableValue(), renderers.NotApplicableValue(), renderers.NotApplicableValue(), )) yield result # output any values under Count for value in countkey.get_values(): value_name = value.get_name() try: value_name = codecs.encode(value_name, "rot_13") except UnicodeDecodeError: pass if self._win7: guid = value_name.split("\\")[0] if guid in self._folder_guids: value_name = value_name.replace(guid, self._folder_guids[guid]) userassist_data_dict = self.parse_userassist_data(value) result = (1, ( renderers.format_hints.Hex(hive.hive_offset), hive_name, countkey_path, countkey_last_write_time, "Value", value_name, userassist_data_dict["id"], userassist_data_dict["count"], userassist_data_dict["focus"], userassist_data_dict["time"], userassist_data_dict["lastupdated"], format_hints.HexBytes(userassist_data_dict["rawdata"]), )) yield result def _generator(self): hive_offsets = None if self.config.get('offset', None) is not None: hive_offsets = [self.config.get('offset', None)] # get all the user hive offsets or use the one specified for hive in hivelist.HiveList.list_hives(context = self.context, base_config_path = self.config_path, layer_name = self.config['primary'], symbol_table = self.config['nt_symbols'], filter_string = 'ntuser.dat', hive_offsets = hive_offsets): try: yield from self.list_userassist(hive) continue except exceptions.PagedInvalidAddressException as excp: vollog.debug("Invalid address identified in Hive: {}".format(hex(excp.invalid_address))) except exceptions.InvalidAddressException as excp: vollog.debug("Invalid address identified in lower layer {}: {}".format( excp.layer_name, excp.invalid_address)) except KeyError: vollog.debug("Key '{}' not found in Hive at offset {}.".format( "software\\microsoft\\windows\\currentversion\\explorer\\userassist", hex(hive.hive_offset))) # yield UnreadableValues when an exception occurs for a given hive_offset result = (0, (renderers.format_hints.Hex(hive.hive_offset), hive.name if hive.name else renderers.UnreadableValue(), renderers.UnreadableValue(), renderers.UnreadableValue(), renderers.UnreadableValue(), renderers.UnreadableValue(), renderers.UnreadableValue(), renderers.UnreadableValue(), renderers.UnreadableValue(), renderers.UnreadableValue(), renderers.UnreadableValue(), renderers.UnreadableValue())) yield result def run(self): self._reg_table_name = intermed.IntermediateSymbolTable.create(self.context, self._config_path, 'windows', 'registry') return renderers.TreeGrid([("Hive Offset", renderers.format_hints.Hex), ("Hive Name", str), ("Path", str), ("Last Write Time", datetime.datetime), ("Type", str), ("Name", str), ("ID", int), ("Count", int), ("Focus Count", int), ("Time Focused", str), ("Last Updated", datetime.datetime), ("Raw Data", format_hints.HexBytes)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/windows/sids_and_privileges.json000066400000000000000000001266261405267600400303600ustar00rootroot00000000000000{ "well known": { "S-1-0": "Null Authority", "S-1-0-0": "Nobody", "S-1-1": "World Authority", "S-1-1-0": "Everyone", "S-1-2": "Local Authority", "S-1-2-0": "Local (Users with the ability to log in locally)", "S-1-2-1": "Console Logon (Users who are logged onto the physical console)", "S-1-3": "Creator Authority", "S-1-3-0": "Creator Owner", "S-1-3-1": "Creator Group", "S-1-3-2": "Creator Owner Server", "S-1-3-3": "Creator Group Server", "S-1-3-4": "Owner Rights", "S-1-4": "Non-unique Authority", "S-1-5": "NT Authority", "S-1-5-1": "Dialup", "S-1-5-2": "Network", "S-1-5-3": "Batch", "S-1-5-4": "Interactive", "S-1-5-6": "Service", "S-1-5-7": "Anonymous", "S-1-5-8": "Proxy", "S-1-5-9": "Enterprise Domain Controllers", "S-1-5-10": "Principal Self", "S-1-5-11": "Authenticated Users", "S-1-5-12": "Restricted Code", "S-1-5-13": "Terminal Server Users", "S-1-5-14": "Remote Interactive Logon", "S-1-5-15": "This Organization", "S-1-5-17": "This Organization (Used by the default IIS user)", "S-1-5-18": "Local System", "S-1-5-19": "NT Authority", "S-1-5-20": "NT Authority", "S-1-5-32-544": "Administrators", "S-1-5-32-545": "Users", "S-1-5-32-546": "Guests", "S-1-5-32-547": "Power Users", "S-1-5-32-548": "Account Operators", "S-1-5-32-549": "Server Operators", "S-1-5-32-550": "Print Operators", "S-1-5-32-551": "Backup Operators", "S-1-5-32-552": "Replicators", "S-1-5-32-554": "BUILTIN\\Pre-Windows 2000 Compatible Access", "S-1-5-32-555": "BUILTIN\\Remote Desktop Users", "S-1-5-32-556": "BUILTIN\\Network Configuration Operators", "S-1-5-32-557": "BUILTIN\\Incoming Forest Trust Builders", "S-1-5-32-558": "BUILTIN\\Performance Monitor Users", "S-1-5-32-559": "BUILTIN\\Performance Log Users", "S-1-5-32-560": "BUILTIN\\Windows Authorization Access Group", "S-1-5-32-561": "BUILTIN\\Terminal Server License Servers", "S-1-5-32-562": "BUILTIN\\Distributed COM Users", "S-1-5-32-568": "BUILTIN\\IIS IUSRS", "S-1-5-32-569": "Cryptographic Operators", "S-1-5-32-573": "BUILTIN\\Event Log Readers", "S-1-5-32-574": "BUILTIN\\Certificate Service DCOM Access", "S-1-5-33": "Write Restricted", "S-1-5-64-10": "NTLM Authentication", "S-1-5-64-14": "SChannel Authentication", "S-1-5-64-21": "Digest Authentication", "S-1-5-80": "NT Service", "S-1-5-86-1544737700-199408000-2549878335-3519669259-381336952": "WMI (Local Service)", "S-1-5-86-615999462-62705297-2911207457-59056572-3668589837": "WMI (Network Service)", "S-1-5-1000": "Other Organization", "S-1-16-0": "Untrusted Mandatory Level", "S-1-16-4096": "Low Mandatory Level", "S-1-16-8192": "Medium Mandatory Level", "S-1-16-8448": "Medium Plus Mandatory Level", "S-1-16-12288": "High Mandatory Level", "S-1-16-16384": "System Mandatory Level", "S-1-16-20480": "Protected Process Mandatory Level", "S-1-16-28672": "Secure Process Mandatory Level", "S-1-5-21-0-0-0-496": "Compounded Authentication", "S-1-5-21-0-0-0-497": "Claims Valid", "S-1-5-32-575": "RDS Remote Application Services", "S-1-5-32-576": "RDS Endpoint Servers", "S-1-5-32-577": "RDS Management Servers", "S-1-5-32-578": "Hyper-V Admins", "S-1-5-32-579": "Access Control Assistance Ops", "S-1-5-32-580": "Remote Management Users", "S-1-5-65-1": "This Organization Certificate (Kerberos PAC)", "S-1-5-84-0-0-0-0-0": "Usermode Drivers", "S-1-5-113": "Local Account", "S-1-5-114": "Local Account (Member of Administrators)", "S-1-15-2-1": "Application Package Context", "S-1-18-1": "Authentication Authority Asserted Identity", "S-1-18-2": "Service Asserted Identity" }, "service sids": { "S-1-5-80-3476726845-1218940557-3240126423-1396283824-3706223860": ".NET CLR Data", "S-1-5-80-3749761688-76038143-2425834820-4129736068-309120712": ".NET CLR Networking", "S-1-5-80-603392709-3706100282-1779817366-3290147925-2109454977": ".NET Data Provider for Oracle", "S-1-5-80-1168016597-2140435647-491797002-352772175-817350590": ".NET Data Provider for SqlServer", "S-1-5-80-255220978-1106536095-1636044468-311807000-281316439": ".NETFramework", "S-1-5-80-799694863-4024754253-4060439485-3284853837-2852070736": "1394ohci", "S-1-5-80-550892281-1246201444-2906082186-2301917840-2280485454": "ACPI", "S-1-5-80-2750316143-92726786-3671103447-4285640526-595803658": "AcpiPmi", "S-1-5-80-4277731759-3688284049-1726419820-405794046-874834352": "adp94xx", "S-1-5-80-1668430318-2462354215-3771841206-4231263990-2365432302": "adpahci", "S-1-5-80-1558789706-915067316-2610504951-4085128407-2746609837": "adpu320", "S-1-5-80-2580340827-1408356417-1236233457-3361088231-1362281560": "adsi", "S-1-5-80-1452425288-2709461340-3274533413-2407537074-986069024": "AeLookupSvc", "S-1-5-80-958185937-3813565417-3041720555-255702914-2218388865": "AFD", "S-1-5-80-1478021307-2683864309-2840291008-2654641652-1914939368": "agp440", "S-1-5-80-2964793103-1312530465-1873688160-795174673-2945876561": "aic78xx", "S-1-5-80-2387347252-3645287876-2469496166-3824418187-3586569773": "ALG", "S-1-5-80-1587539839-2488332913-1287008632-3751426284-4220573165": "aliide", "S-1-5-80-2808999507-317517852-2612044860-3916887390-3713671788": "amdagp", "S-1-5-80-4100430975-1934021090-490597466-3817433801-2954987127": "amdide", "S-1-5-80-2291534435-3322220689-2735625597-3465650106-1340236923": "AmdK8", "S-1-5-80-4046459391-4016695280-780100908-1621843708-2839135617": "AmdPPM", "S-1-5-80-1967003600-1747618720-202510732-1118110944-2056302645": "amdsata", "S-1-5-80-3946629880-3877146532-1020811794-3209710663-3707805237": "amdsbs", "S-1-5-80-2663151763-304964558-3327380674-1150567875-3378868591": "amdxata", "S-1-5-80-4206070390-3011771559-4179333097-3486196663-2896243697": "AppID", "S-1-5-80-2078495744-2416903469-4072184685-3943858305-976987417": "AppIDSvc", "S-1-5-80-1345931346-2714066941-3624776837-1617505694-3927660246": "Appinfo", "S-1-5-80-3213379692-3546485254-1309469428-3810262102-2442199571": "AppMgmt", "S-1-5-80-2586396289-3967100905-3140788560-3910242148-3554126937": "arc", "S-1-5-80-4275531960-1601664531-2254151532-3075236607-956726506": "arcsas", "S-1-5-80-3772676405-1029441937-3739550121-1000989080-3364480489": "AsyncMac", "S-1-5-80-3126347352-2401679295-1536073615-3396758597-3783091149": "atapi", "S-1-5-80-1580948945-3239616721-2529237571-3761093093-1214243633": "AudioEndpointBuilder", "S-1-5-80-2676549577-1911656217-2625096541-4178041876-1366760775": "Audiosrv", "S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147": "AxInstSV", "S-1-5-80-1401731874-3996074688-1963706087-3130220608-1140295258": "b06bdrv", "S-1-5-80-528874604-3378394362-3426265968-3876211711-2956305666": "b57nd60x", "S-1-5-80-2490514847-2461341327-10008697-1811907875-602803682": "BattC", "S-1-5-80-2962817144-200689703-2266453665-3849882635-1986547430": "BDESVC", "S-1-5-80-3186183977-1861961257-3523979229-167170737-1516062821": "Beep", "S-1-5-80-1383147646-27650227-2710666058-1662982300-1023958487": "BFE", "S-1-5-80-864916184-135290571-3087830041-1716922880-4237303741": "BITS", "S-1-5-80-3199704608-2688121514-1535149675-608666402-3313731745": "blbdrive", "S-1-5-80-26818074-245702967-483560604-1005139437-3076944027": "bowser", "S-1-5-80-1926592986-1411939489-3259133927-4064956769-2216240612": "BrFiltLo", "S-1-5-80-3843808474-1199403037-3395254522-1605808544-3221186762": "BrFiltUp", "S-1-5-80-764937145-223273921-1726433829-265908364-3948077829": "Browser", "S-1-5-80-3715020542-2003794336-3716799247-4001019941-1245790858": "Brserid", "S-1-5-80-4014097382-2743177720-3750454595-1699596626-866516122": "BrSerWdm", "S-1-5-80-1195671069-1048138941-897119314-1432864274-834752102": "BrUsbMdm", "S-1-5-80-1736549233-1399426098-2600293700-2473969234-3259996387": "BrUsbSer", "S-1-5-80-505608135-4274227953-3632766965-1888639892-3184055934": "BTHMODEM", "S-1-5-80-1409084391-1870647740-2731517552-2815089321-2189562539": "BTHPORT", "S-1-5-80-2586557155-168560303-1373426920-983201488-1499765686": "bthserv", "S-1-5-80-3223837281-1527595016-2901219760-1358189227-808820507": "cdfs", "S-1-5-80-364680967-1232085744-2960737863-915504889-2752576923": "cdrom", "S-1-5-80-3256172449-2363790065-3617575471-4144056108-756904704": "CertPropSvc", "S-1-5-80-4066704878-4231214995-2335031091-3527122690-1574766183": "circlass", "S-1-5-80-1506673549-1532669541-769420574-1605323189-863873827": "CLFS", "S-1-5-80-776041216-1751974135-1557427478-1892253070-796752000": "clr_optimization_v2.0.50727_32", "S-1-5-80-452204072-1743664639-1560983493-2640850116-597529692": "CmBatt", "S-1-5-80-979911607-31916023-2827320217-2656655436-259985251": "cmdide", "S-1-5-80-3573738861-3694853854-361022443-2442358023-2743921644": "CNG", "S-1-5-80-3960644792-2999129865-644014482-29643289-3842828219": "Compbatt", "S-1-5-80-832194277-1022982267-2217674263-2896671990-3011983110": "CompositeBus", "S-1-5-80-593875016-1044814911-1112741138-2143646632-2690613739": "COMSysApp", "S-1-5-80-3158764370-1001901224-1854525633-1718604346-2756706540": "crcdisk", "S-1-5-80-3747264324-1669729390-1715156009-1010652712-2439569381": "Crusoe", "S-1-5-80-3020380856-1381845346-309829523-1810616773-418643442": "crypt32", "S-1-5-80-242729624-280608522-2219052887-3187409060-2225943459": "CryptSvc", "S-1-5-80-3601020880-2087999432-167179594-730776211-2997520967": "CSC", "S-1-5-80-1987853863-1639573247-1110726908-1137832616-3599624523": "CscService", "S-1-5-80-1564160128-141119064-743480990-78466790-746535033": "DCLocator", "S-1-5-80-1601830629-990752416-3372939810-977361409-3075122917": "DcomLaunch", "S-1-5-80-654447679-1163530548-981569129-3608673666-3128964045": "defragsvc", "S-1-5-80-3837255464-839197112-3211601036-3795322556-2690640524": "DfsC", "S-1-5-80-1267473060-1890374259-1137250836-544356534-2546457154": "DFSR", "S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582": "Dhcp", "S-1-5-80-2142581517-3954605861-2373846864-2138305209-1019737370": "discache", "S-1-5-80-1827140278-1118305254-4004251663-1512899043-4081885502": "Disk", "S-1-5-80-859482183-879914841-863379149-1145462774-2388618682": "Dnscache", "S-1-5-80-3787436395-2174616005-3003730137-1094982900-1570567328": "dot3svc", "S-1-5-80-2970612574-78537857-698502321-558674196-1451644582": "DPS", "S-1-5-80-338020179-181244551-1629881386-919369987-4169324252": "drmkaud", "S-1-5-80-3820654016-1545322283-1804062181-1022271772-3696306321": "DXGKrnl", "S-1-5-80-2212058837-3965059022-779215765-3282659977-917192320": "E1G60", "S-1-5-80-3578261754-285310837-913589462-2834155770-667502746": "EapHost", "S-1-5-80-2437473203-2648204866-3612751994-635271166-3967841232": "Ecache", "S-1-5-80-1191957972-1903257272-3657591267-1787121440-2523964525": "ebdrv", "S-1-5-80-730263862-4055390735-403826019-1175694336-1277635259": "EFS", "S-1-5-80-567955335-3455378119-3305749985-2554534624-1867504835": "ehRecvr", "S-1-5-80-3864065939-1897331054-469427076-3133256761-1570309435": "ehSched", "S-1-5-80-2913099195-3001839937-1914692661-1563395363-459793767": "ehstart", "S-1-5-80-3118383011-3159412168-3368304685-4081854189-1392756948": "elxstor", "S-1-5-80-1436322865-2295268783-31549072-3549518694-69512146": "EmdCache", "S-1-5-80-557382581-4103702789-1349398007-826115979-1301810884": "EMDMgmt", "S-1-5-80-1580004045-3657569029-3054886754-3760858607-1347140441": "ErrDev", "S-1-5-80-1163726475-4032819940-2637749356-1655080563-3495319901": "ESENT", "S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122": "eventlog", "S-1-5-80-1772571935-1555666882-3369284645-1675012128-2386634627": "EventSystem", "S-1-5-80-339744372-1785209941-194342311-2969164887-2874010346": "exfat", "S-1-5-80-3825849991-4144931059-247537738-1429287757-2349637904": "fastfat", "S-1-5-80-2117685068-4011115449-2646761356-2137676340-222423812": "Fax", "S-1-5-80-678085088-615808128-1967178352-3804608619-208504977": "fdc", "S-1-5-80-364023826-931424190-487969545-1024119571-74567675": "fdPHost", "S-1-5-80-3215268152-2863950836-530904203-4246843131-2183915461": "FDResPub", "S-1-5-80-3048209083-3162952562-941345871-1437532549-835501875": "FileInfo", "S-1-5-80-1352441077-2188484239-1994186818-620473926-3758853310": "Filetrace", "S-1-5-80-2678475722-3718149211-1393662077-3558562392-2203603517": "flpydisk", "S-1-5-80-916285479-1714977700-1732101595-331036679-1735462769": "FltMgr", "S-1-5-80-3655275221-2954682349-3644260495-855223267-1438849333": "FontCache", "S-1-5-80-3782458156-2098404076-3767342964-3617937256-1389734963": "FontCache3.0.0.0", "S-1-5-80-4244156434-496195918-1908400060-3754471672-3389379472": "FsDepends", "S-1-5-80-1638897150-273717933-3197303335-567190659-606579740": "Fs_Rec", "S-1-5-80-221025945-1494805562-2841517651-3196795133-192498206": "fvevol", "S-1-5-80-1150850083-1108777032-2236282716-3985597815-2701820264": "gagp30kx", "S-1-5-80-2024188204-2445810227-898691311-2942020084-762398166": "gpsvc", "S-1-5-80-2384017851-2441776339-3346382083-2430645704-3475981877": "hcw85cir", "S-1-5-80-2193151998-1100362924-2192368770-2985476713-896696503": "HDAudBus", "S-1-5-80-1648434057-4219984261-1802816958-334501717-1769477291": "HidBatt", "S-1-5-80-191977210-1053814073-2805336524-1775407748-120039257": "HidBth", "S-1-5-80-498696395-104441048-3395182230-3082814586-1375447691": "HidIr", "S-1-5-80-89818136-74175777-88572358-3912780041-2421659406": "hidserv", "S-1-5-80-1586586559-167648910-1414982260-3863830924-1724542190": "HidUsb", "S-1-5-80-1373701630-3910968185-3388013410-2492353-937432973": "hkmsvc", "S-1-5-80-2291748755-1591405548-1905550586-2340871825-1258388485": "HpCISSs", "S-1-5-80-4028305664-2774326660-44957573-2454826285-2129126537": "HomeGroupListener", "S-1-5-80-2620923248-4247863784-3378508180-2659151310-2535246811": "HomeGroupProvider", "S-1-5-80-3952044490-1864224763-1322162546-396143671-1619397437": "HpSAMD", "S-1-5-80-3734987283-965611577-2130035942-3636592211-2616856863": "HTTP", "S-1-5-80-970016657-3034632851-3048190821-4182690298-3323420226": "i2omp", "S-1-5-80-3096896632-2411553352-2084109408-2930423838-4282791216": "hwpolicy", "S-1-5-80-738727139-3255065492-2264176241-1836141076-1899426695": "i8042prt", "S-1-5-80-1156567179-1019273932-444819734-1772733284-2107707318": "iaStorV", "S-1-5-80-2984992224-2588614340-2167448307-2303456600-125847566": "idsvc", "S-1-5-80-3218395955-317132717-2440444880-267201483-2700625476": "iirsp", "S-1-5-80-698886940-375981264-2691324669-2937073286-3841916615": "IKEEXT", "S-1-5-80-3217419572-1740605331-1127140686-2317006352-2064317000": "inetaccs", "S-1-5-80-3664101217-2276051299-423734030-2746486177-2766044424": "intelide", "S-1-5-80-817570274-767070440-2629795609-3336305482-1678804590": "intelppm", "S-1-5-80-2506443892-94066030-1663014834-2885971264-4189966690": "IPBusEnum", "S-1-5-80-2750735467-3008441591-3989401642-3215998983-1344927289": "IpFilterDriver", "S-1-5-80-62724632-2456781206-3863850748-1496050881-1042387526": "iphlpsvc", "S-1-5-80-1361160473-1867727628-1338406996-3302040194-2851723982": "IpInIp", "S-1-5-80-2771164118-4094026282-2266286801-3306161409-3436440840": "IPMIDRV", "S-1-5-80-2368102602-26431353-856636621-1497418614-482242802": "IPNAT", "S-1-5-80-433158070-3235422099-1317741036-1922328546-1834106188": "IRENUM", "S-1-5-80-1308614567-1511795785-2741360970-8197000-3264788676": "isapnp", "S-1-5-80-1446792217-3918178545-2165441202-3760590537-1875255596": "iScsiPrt", "S-1-5-80-2249099846-2157059493-1994460756-1924820827-2369096692": "iteatapi", "S-1-5-80-750512324-770881543-4197932906-3645560491-3779161573": "iteraid", "S-1-5-80-1974511938-2400693546-1685170019-203554928-1466978163": "kbdclass", "S-1-5-80-3058542000-3285469617-40650340-3734485625-1920508542": "kbdhid", "S-1-5-80-1206118541-1677721718-2423781911-3372378849-3903984073": "KeyIso", "S-1-5-80-3810688523-3855579666-1860693470-2666993558-46302070": "KSecDD", "S-1-5-80-638937566-1168471176-3064579757-2631269312-170126454": "KSecPkg", "S-1-5-80-2818357584-3387065753-4000393942-342927828-138088443": "KtmRm", "S-1-5-80-879696042-2351668846-370232824-2524288904-4023536711": "LanmanServer", "S-1-5-80-719998295-2833700043-1566817583-4093942769-1414026312": "LanmanWorkstation", "S-1-5-80-3356507721-3148410333-1453554623-2317622189-363686743": "ldap", "S-1-5-80-1339741203-2503426401-303705627-250156843-1210515524": "lltdio", "S-1-5-80-940647296-341435850-43817331-158078607-2483727905": "lltdsvc", "S-1-5-80-172094073-716411664-54255058-185476446-2329512179": "lmhosts", "S-1-5-80-1037107160-813189200-1860894220-2610408748-1807657940": "Lsa", "S-1-5-80-973905250-3368826558-2408393701-2645888229-3042295110": "LSI_FC", "S-1-5-80-3066312493-2787136058-3895654580-111488809-2262703568": "LSI_SAS", "S-1-5-80-935126585-3333887566-2369146147-2658756633-3860083864": "LSI_SAS2", "S-1-5-80-702453548-2563122194-4165184037-877730421-2039909086": "LSI_SCSI", "S-1-5-80-381203785-1552481550-3565819581-4159540168-38965703": "luafv", "S-1-5-80-3770938798-2726624435-2075025292-3280341113-3618470894": "Mcx2Svc", "S-1-5-80-1503963800-3543347063-2443146678-2767313893-605308357": "megasas", "S-1-5-80-4024713676-1017792628-381990976-3540878265-1306153904": "MegaSR", "S-1-5-80-2799810402-4136494038-1094338311-2889966999-3154753985": "MMCSS", "S-1-5-80-2005225957-2795451222-469338742-3947262705-2044891099": "Modem", "S-1-5-80-4207690787-1085901060-2295361997-2227230598-1253819078": "monitor", "S-1-5-80-675551267-1826535266-117093185-28668227-296166608": "mouclass", "S-1-5-80-3854853272-3832246511-1244659077-3165440039-2262758429": "mouhid", "S-1-5-80-3601998905-441174471-4117363912-32772110-2632366064": "mountmgr", "S-1-5-80-4261667920-1220466518-1749771309-2316901739-273317064": "mpio", "S-1-5-80-3142377179-3443479297-2149323391-1756545698-484011292": "mpsdrv", "S-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052": "MpsSvc", "S-1-5-80-2250298043-1491746124-3447101336-2334414474-2555807208": "Mraid35x", "S-1-5-80-2688027615-1506195528-3802338144-777155390-618458321": "MRxDAV", "S-1-5-80-2162099894-1456621096-2119874347-3743340265-2368304946": "mrxsmb", "S-1-5-80-2676550360-252586896-1701879715-2742386574-1171030092": "mrxsmb10", "S-1-5-80-3970894941-767821303-4047113619-2738918178-2351404876": "mrxsmb20", "S-1-5-80-276420989-3971400029-4249224515-3588854300-972083571": "msahci", "S-1-5-80-827450036-3359053657-3286484322-221598818-2985401197": "msdsm", "S-1-5-80-3960419045-2460139048-4046793004-1809597027-2250574426": "MSDTC", "S-1-5-80-1515650939-3601430262-2496924429-640160050-3998290523": "MSDTC Bridge 3.0.0.0", "S-1-5-80-3825916667-3375043415-3384654478-3177665693-2200644784": "Msfs", "S-1-5-80-4064639957-1408283007-2091294018-2122350837-1986927883": "mshidkmdf", "S-1-5-80-537088188-2896597613-2307397767-3752262660-2081934664": "msisadrv", "S-1-5-80-917953661-2020045820-2727011118-2260243830-4032185929": "MSiSCSI", "S-1-5-80-685333868-2237257676-1431965530-1907094206-2438021966": "msiserver", "S-1-5-80-1314579368-1827054856-3801607513-4137797117-3785845944": "MSKSSRV", "S-1-5-80-3515336427-2373706795-1189292716-3451446183-2383180522": "MSPCLOCK", "S-1-5-80-2550581486-1497628998-1973453189-3108482975-2816921478": "MSPQM", "S-1-5-80-4273119239-1126992662-2069961181-78804100-786965295": "MsRPC", "S-1-5-80-2731410647-2404537004-1422510964-3385838496-1398925663": "MSSCNTRS", "S-1-5-80-2379877105-2122874852-2028670630-1350450415-3977667049": "mssmbios", "S-1-5-80-294111013-494549581-4136661504-3518049416-761106507": "MSTEE", "S-1-5-80-772196467-3194495650-2141286422-1986870660-3602995159": "MTConfig", "S-1-5-80-2851636321-923882121-3805946377-1773657562-2703951580": "Mup", "S-1-5-80-2006800713-1441093265-249754844-3404434343-1444102779": "napagent", "S-1-5-80-3451137062-797777108-3464068327-231871278-2024511519": "NativeWifiP", "S-1-5-80-2183409222-222800135-1539000935-3109909370-1207982808": "NDIS", "S-1-5-80-1310191460-362243386-72972191-123604350-1188038626": "NdisCap", "S-1-5-80-3307576507-4040802919-832577921-47721884-821370673": "NdisTapi", "S-1-5-80-2426641292-1095310648-1538795067-2456674997-547968854": "Ndisuio", "S-1-5-80-3137956796-3050520361-1309400342-955303752-3583020413": "NdisWan", "S-1-5-80-3999445478-1493703614-491198216-2250085872-3662815299": "NDProxy", "S-1-5-80-298519744-3326885196-200884095-1345730765-1206919721": "NetBIOS", "S-1-5-80-3481163626-3922336224-2171110286-845444925-873416656": "NetBT", "S-1-5-80-1589317753-1926951874-3424712441-2302911845-2572860984": "Netlogon", "S-1-5-80-2898649604-2335086160-1904548223-3761738420-3855444835": "Netman", "S-1-5-80-3635958274-2059881490-2225992882-984577281-633327304": "netprofm", "S-1-5-80-1773860938-1487242074-882566118-4272343956-2175834232": "NetTcpPortSharing", "S-1-5-80-3739586395-593861784-2557645679-4197025642-341497066": "nfrd960", "S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453": "NlaSvc", "S-1-5-80-1093399993-2276725296-2148262981-2274078422-4284582767": "Npfs", "S-1-5-80-2310782386-4237065203-3688974353-390202159-3511571085": "nsi", "S-1-5-80-4100249314-4086313984-28913695-873679419-2144728263": "nsiproxy", "S-1-5-80-1664281202-2302623734-631624840-3461998672-2259661997": "NTDS", "S-1-5-80-1256884789-1691082103-446998474-1367286246-1639025938": "Ntfs", "S-1-5-80-2470698091-2858014709-2643764839-982706939-3434751516": "ntrigdigi", "S-1-5-80-2407861648-785230825-3529290450-2326204529-1810679516": "Null", "S-1-5-80-3495072887-919096479-2204902451-1048921326-800355041": "nvraid", "S-1-5-80-3611874924-3178792031-3565391826-286563291-3680247785": "nvstor", "S-1-5-80-2661219475-1923594960-1294537542-2454943126-82436970": "nv_agp", "S-1-5-80-4169196349-563482612-2169411968-43761830-802868667": "NwlnkFlt", "S-1-5-80-1643415749-1981533051-3884744798-2669202348-601031005": "NwlnkFwd", "S-1-5-80-1196941233-2569882653-2923823926-962244991-4277418": "ohci1394", "S-1-5-80-967499406-1694984581-2959056265-2481940682-939264259": "p2pimsvc", "S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580": "p2psvc", "S-1-5-80-3473791808-4104434288-1928902041-1743473672-1277326840": "Parport", "S-1-5-80-156989346-1343554423-902067029-1673992682-1866693543": "partmgr", "S-1-5-80-4196153372-502005009-1971508045-3354250645-3015555128": "Parvdm", "S-1-5-80-1948712186-1330865447-943413596-1669284603-1648638051": "PcaSvc", "S-1-5-80-2069178898-4023461412-1711560041-390887617-271771820": "pci", "S-1-5-80-4052642423-944120264-588619640-546327341-1110646568": "pciide", "S-1-5-80-2795309555-3957969320-2916397881-2593713121-382316838": "pcmcia", "S-1-5-80-59707871-3298565586-1716270302-948228651-1074156479": "pcw", "S-1-5-80-1570874813-103103538-3327933986-104584388-2119773521": "PEAUTH", "S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329": "PeerDistSvc", "S-1-5-80-4023986828-1464965280-3211893748-414212150-4115790068": "PerfDisk", "S-1-5-80-2413971036-1590988147-3808667159-2204172745-1373631640": "PerfNet", "S-1-5-80-3515570427-2977692895-3762163048-1504969852-99088878": "PerfOS", "S-1-5-80-3544016446-4087985546-3773506770-1472693371-3235341583": "PerfProc", "S-1-5-80-2661322625-712705077-2999183737-3043590567-590698655": "pla", "S-1-5-80-1981970923-922788642-3535304421-2999920573-318732269": "PlugPlay", "S-1-5-80-3141781312-1794533130-3616533224-2008760771-2116720301": "PNRPAutoReg", "S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613": "PNRPsvc", "S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853": "PolicyAgent", "S-1-5-80-4126081702-1836807445-3803306975-1029803806-2479180530": "PortProxy", "S-1-5-80-2343416411-2961288913-598565901-392633850-2111459193": "Power", "S-1-5-80-3735226416-1729687437-1959510470-190511368-398645692": "PptpMiniport", "S-1-5-80-3367479018-119754134-174380200-3035551807-2744700953": "Processor", "S-1-5-80-2422153244-111630262-1029994140-3645224535-4078427153": "PROCEXP", "S-1-5-80-3816717743-33564931-1112267079-3548917561-928358339": "ProfSvc", "S-1-5-80-656433041-336319937-100815201-2263438610-4002557366": "ProtectedStorage", "S-1-5-80-133730547-3458667493-930392497-3658715967-3359215708": "Psched", "S-1-5-80-1010784341-3590640432-2144716203-2371202623-2111191834": "ql2300", "S-1-5-80-3680784227-2138494325-1045417256-846249285-1494284974": "ql40xx", "S-1-5-80-1659118645-3148100556-861291880-3953320898-4045657812": "QWAVE", "S-1-5-80-3324762131-3390532780-137711907-1761928331-1932425801": "QWAVEdrv", "S-1-5-80-951069737-1097907447-3199478753-2018050253-2083677786": "RasAcd", "S-1-5-80-4022575210-2284560452-710265691-3594820739-387418549": "RasAgileVpn", "S-1-5-80-1802467488-1541022566-2033325545-854566965-652742428": "RasAuto", "S-1-5-80-1290287420-3502600185-382990664-1700026297-1337626153": "Rasl2tp", "S-1-5-80-4176366874-305252471-2256717057-2714189771-3552532790": "RasMan", "S-1-5-80-4122454071-3550668693-4211410744-1298358403-2272725717": "RasPppoe", "S-1-5-80-1331337031-2474836174-2661672254-391271513-2096420174": "RasSstp", "S-1-5-80-2489667-2470848582-3865645512-452901963-4178804252": "rdbss", "S-1-5-80-3687944073-3313860148-3136628839-3387249243-1709534714": "rdpbus", "S-1-5-80-2431288241-149984296-2543083935-4067350611-1975817884": "RDPCDD", "S-1-5-80-981872547-3861006530-3984275202-4085961120-2027028908": "RDPDD", "S-1-5-80-23661045-4033652049-3526044993-1401805078-1749661838": "RDPDR", "S-1-5-80-3464459778-79086046-1894495498-3954672505-2750168721": "RDPENCDD", "S-1-5-80-191927475-3325244020-2133763035-2511185485-3827563125": "RDPNP", "S-1-5-80-1432111213-2818786930-2152807080-3377190559-901933699": "RDPREFMP", "S-1-5-80-1857653372-1313752195-3783661666-502273730-1171188227": "RDPWD", "S-1-5-80-3474873350-2412947251-3085823233-2315640422-3546857610": "rdyboost", "S-1-5-80-1954729425-4294152082-187165618-318331177-3831297489": "RemoteAccess", "S-1-5-80-2822507136-3601578665-1013168651-121944544-1825232178": "RemoteRegistry", "S-1-5-80-521322694-906040134-3864710659-1525148216-3451224162": "RpcEptMapper", "S-1-5-80-4056015446-1496461683-1723632270-3351149576-1119802320": "RpcLocator", "S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080": "RpcSs", "S-1-5-80-25112808-303066962-2306571906-3820953744-554449017": "rspndr", "S-1-5-80-3189092957-1825937568-2097962828-592273195-15751640": "s3cap", "S-1-5-80-3453257571-682267348-3447719424-2810041157-893746920": "SamSs", "S-1-5-80-2172748946-1139208647-3745649895-1734051075-2323558886": "sbp2port", "S-1-5-80-1209419826-1829913269-3824447628-1153237837-3789837839": "SCardSvr", "S-1-5-80-3145502940-3408664484-1477142494-2517801300-3177717725": "scfilter", "S-1-5-80-4125092361-1567024937-842823819-2091237918-836075745": "Schedule", "S-1-5-80-1691538513-4084330536-1620899472-1113280783-3554754292": "SCPolicySvc", "S-1-5-80-2983134835-1185273323-1712700529-1489848661-2325612824": "SDRSVC", "S-1-5-80-1722176216-3611007545-3657005850-3814612847-1080390000": "secdrv", "S-1-5-80-1399994486-219206332-302438500-304602034-1537790326": "seclogon", "S-1-5-80-4259241309-1822918763-1176128033-1339750638-3428293995": "SENS", "S-1-5-80-3168472476-176724102-2968832672-2340942973-2241613192": "SensrSvc", "S-1-5-80-1658387481-2925800327-3198882180-3147662777-2274689045": "Serenum", "S-1-5-80-3562253942-857828347-2712713407-944836455-3636585461": "Serial", "S-1-5-80-3369720968-4228855631-3683183521-2094993598-1022421131": "sermouse", "S-1-5-80-675414407-775065359-1035864904-999747831-2072146957": "ServiceModelEndpoint 3.0.0.0", "S-1-5-80-1904953591-2738210791-1061154185-3936071259-221446881": "ServiceModelOperation 3.0.0.0", "S-1-5-80-297390187-2405189348-2222284465-2989988878-4218767654": "ServiceModelService 3.0.0.0", "S-1-5-80-4022436659-1090538466-1613889075-870485073-3428993833": "SessionEnv", "S-1-5-80-1220365695-3871163487-2301282001-885120026-718998505": "sffdisk", "S-1-5-80-1593449009-2408870187-1077724223-1518188577-3728252823": "sffp_mmc", "S-1-5-80-1659054941-531967795-1983128084-3748020815-2241757750": "sffp_sd", "S-1-5-80-1407380289-3518059920-3931497022-2754447733-2222417609": "sfloppy", "S-1-5-80-2009329905-444645132-2728249442-922493431-93864177": "SharedAccess", "S-1-5-80-1690854464-3758363787-3981977099-3843555589-1401248062": "ShellHWDetection", "S-1-5-80-2037654479-150732571-4235160932-1988269395-3027078133": "sisagp", "S-1-5-80-2290943609-1211775869-3660739483-1432647055-1639441565": "SiSRaid2", "S-1-5-80-1016766434-4163349990-2054491751-1265000292-413406215": "SiSRaid4", "S-1-5-80-2119565420-4155874467-2934723793-509086461-374458824": "slsvc", "S-1-5-80-429025866-4105586292-427562881-1309981334-1060966148": "SLUINotify", "S-1-5-80-97513841-1071082959-3069755588-526311685-2961431215": "Smb", "S-1-5-80-2400470686-1781479961-2091307112-2920730856-2901594176": "SMSvcHost 3.0.0.0", "S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619": "SNMPTRAP", "S-1-5-80-2246094146-3761615012-3991572358-959820157-1291755210": "spldr", "S-1-5-80-3951239711-1671533544-1416304335-3763227691-3930497994": "Spooler", "S-1-5-80-123231216-2592883651-3715271367-3753151631-4175906628": "sppsvc", "S-1-5-80-2105443381-1869407242-828286827-1344996006-2512971347": "sppuinotify", "S-1-5-80-3318989984-2647182497-3022510041-1919214433-3551303480": "srv", "S-1-5-80-1034188721-156321652-2901307485-3049929104-2850741453": "srv2", "S-1-5-80-385674269-2427993094-4248660116-187565782-2803330530": "srvnet", "S-1-5-80-486568272-975562994-1883531608-2732234258-332540751": "SSDPSRV", "S-1-5-80-3435701886-799518250-3791383489-3228296122-2938884314": "SstpSvc", "S-1-5-80-2502136977-515215333-1091199184-4078967732-698071891": "stexstor", "S-1-5-80-3182985763-1431228038-2757062859-428472846-3914011746": "StiSvc", "S-1-5-80-3877927215-2009774003-1789373229-1350139498-1490546062": "storflt", "S-1-5-80-3355894222-2288616474-3163838539-1515771758-43395969": "StorSvc", "S-1-5-80-2227193670-1472088527-4216801891-1255609005-3742950393": "storvsc", "S-1-5-80-2499453150-1816575225-2698105218-861119070-2299588587": "swenum", "S-1-5-80-1614360071-3471039648-1078047007-3707138327-1664821506": "swprv", "S-1-5-80-3277458932-3608563558-2424252742-1006353051-3439664691": "Symc8xx", "S-1-5-80-714262929-1152213303-426872964-3738532716-4000887735": "Sym_hi", "S-1-5-80-73616012-2741736120-1450548080-3749295283-3869351969": "Sym_u3", "S-1-5-80-2590341223-3996088049-3993122417-23640849-324535191": "SysMain", "S-1-5-80-949921180-3923668869-394927020-528789358-3592448931": "TabletInputService", "S-1-5-80-4230913304-2206818457-801678004-120036174-1892434133": "TapiSrv", "S-1-5-80-4167276341-681140529-2035857140-584847688-708058301": "TBS", "S-1-5-80-2869215396-3426808149-752611693-425565463-2833823703": "Tcpip", "S-1-5-80-842221325-3630721446-2015653073-424833842-1069621030": "TCPIP6", "S-1-5-80-1243767512-207181711-1639953288-846964026-179032965": "TCPIP6TUNNEL", "S-1-5-80-183440435-3873164873-1814133288-2746138770-1127128543": "tcpipreg", "S-1-5-80-517380867-1805075581-15937331-3649701458-2279870393": "TCPIPTUNNEL", "S-1-5-80-1205525636-1316560639-1871536985-2915653626-3847227622": "TDPIPE", "S-1-5-80-2653571336-860310240-1707811817-3246300807-2032786575": "TDTCP", "S-1-5-80-1811008277-2130293716-2312968959-3698054739-726352487": "tdx", "S-1-5-80-600900383-3940208308-3622757659-1160125390-3717916961": "TermDD", "S-1-5-80-446051430-1559341753-4161941529-1950928533-810483104": "TermService", "S-1-5-80-1189432293-2777010110-2640223427-1344437502-1956879817": "Themes", "S-1-5-80-56840347-690487168-3179794702-1332568925-762031181": "THREADORDER", "S-1-5-80-537470750-3688389562-3749243086-269898693-579266445": "TPAutoConnSvc", "S-1-5-80-1495131930-2676463755-2136540566-1190107536-2533052015": "TPVCGateway", "S-1-5-80-768763963-4214222998-2156221936-2953597973-713500239": "TrkWks", "S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464": "TrustedInstaller", "S-1-5-80-602153688-1728218534-2156437410-2444491971-1703742505": "TSDDD", "S-1-5-80-3250179172-3414919659-2784612865-1947102831-1832745880": "tssecsrv", "S-1-5-80-3666930311-739912689-1101093007-1147922636-412121971": "tunmp", "S-1-5-80-3579196564-3960183121-2393617881-1570124860-2153905208": "tunnel", "S-1-5-80-3249175164-480052304-527258952-251146422-1017202920": "uagp35", "S-1-5-80-4290168682-2694755981-2883756118-2205499398-4079537721": "udfs", "S-1-5-80-2413584400-2834772909-3391057178-2993126719-4094614649": "UGatherer", "S-1-5-80-900581847-2069635957-4095211819-2149323943-1216697729": "UGTHRSVC", "S-1-5-80-997887591-2350776071-3817597635-4146973621-2526406719": "UI0Detect", "S-1-5-80-4194149548-235381792-2829184477-3934495640-667433095": "uliagpkx", "S-1-5-80-2051301031-3598501189-881763489-2611917303-2352103085": "uliahci", "S-1-5-80-4294381996-3573690956-4084941264-2318251564-135754816": "UlSata", "S-1-5-80-2849548708-3602852847-3953931013-1110249439-3333230880": "ulsata2", "S-1-5-80-3018007626-163191633-622627787-1206491734-2917835273": "umbus", "S-1-5-80-2029728201-2796881031-2302868875-2454600822-1203790938": "UmPass", "S-1-5-80-2014626298-1656748749-3847481816-918933055-2469338456": "UmRdpService", "S-1-5-80-448846144-1414373772-1578130625-718576682-2306699751": "upnphost", "S-1-5-80-3724553804-53543757-2557641770-141295351-1687883918": "usb", "S-1-5-80-4022141922-741376770-3260236731-1675477288-3792235576": "usbccgp", "S-1-5-80-2601879200-4032607390-2815923362-3101623786-2213233685": "usbcir", "S-1-5-80-1032545752-2203350250-1701939687-317337126-3231707909": "usbehci", "S-1-5-80-676136802-2607101929-335774531-4135730467-913299484": "usbhub", "S-1-5-80-3434778094-456680973-2488395463-338906152-1015349184": "usbohci", "S-1-5-80-3620574345-1163766744-4010839292-3531329841-768311061": "usbprint", "S-1-5-80-376233901-499118290-773318279-1925188704-297947815": "USBSTOR", "S-1-5-80-2717376493-4290053016-2054941639-3048903775-1780974753": "usbuhci", "S-1-5-80-2815190569-4075358141-1041947382-2198045348-980246365": "UxSms", "S-1-5-80-2901324718-895851292-2096622302-170690027-1637913602": "VaultSvc", "S-1-5-80-2236596344-777810374-464678914-301799185-133794676": "vdrvroot", "S-1-5-80-2196396108-1448510645-203779624-3888580976-3789157697": "vds", "S-1-5-80-1636345116-1749775499-167646407-1402041886-784684825": "vga", "S-1-5-80-1604054522-1120073184-2766342441-3740248177-2194771659": "VgaSave", "S-1-5-80-2349230263-3936233330-585165183-483748113-2063106807": "vhdmp", "S-1-5-80-269018121-2628019534-3958128902-1689023713-3977233287": "viaagp", "S-1-5-80-702914695-4281403409-954615538-3988029004-192649218": "ViaC7", "S-1-5-80-3488702259-1115883433-1783531185-1350626685-2323838072": "viaide", "S-1-5-80-3414199520-1924951526-579304523-1555932441-262361574": "vm3dmp", "S-1-5-80-3316781363-2712907428-2579548995-1296955556-57435734": "VMAUDIO", "S-1-5-80-394042835-174396444-3357755573-789530950-2357907384": "vmbus", "S-1-5-80-3485585108-3288609388-3381644673-894183282-3425970148": "VMBusHID", "S-1-5-80-2053731399-3564616636-592537298-4187980385-3071434599": "vmci", "S-1-5-80-4081816966-3135276745-2345987325-2511854693-3099376874": "vmdebug", "S-1-5-80-2844247271-1920892496-2185725435-2733799570-1491885128": "vmhgfs", "S-1-5-80-2713566713-2012099321-1704287870-164250842-2950185051": "VMMEMCTL", "S-1-5-80-616456234-2657522756-2692773202-1293725715-2143369223": "vmmouse", "S-1-5-80-470576323-3739623512-411527224-1524486745-930631467": "vmrawdsk", "S-1-5-80-994229404-1081919929-268374983-1858992150-4232923339": "VMTools", "S-1-5-80-3615470141-4057994987-1930054357-1444440834-2714780835": "VMUpgradeHelper", "S-1-5-80-3972256235-858188783-2536722634-3029314587-3393749697": "vmvss", "S-1-5-80-1570634675-3893565091-22195573-2267868061-2898682217": "volmgr", "S-1-5-80-2228288927-839465256-4097931996-4258784654-3424789253": "volmgrx", "S-1-5-80-2161309226-1540144261-2901834345-3792977468-1183436922": "volsnap", "S-1-5-80-1269120828-58111527-683397690-4062780901-3407528550": "vsmraid", "S-1-5-80-3195062495-2862850656-3724129271-1847284719-4038691091": "VSS", "S-1-5-80-4271242282-3170619077-2600330701-1558677754-1139114601": "vwifibus", "S-1-5-80-4267341169-2882910712-659946508-2704364837-2204554466": "W32Time", "S-1-5-80-989796750-4090848350-2040919084-978865222-2182970707": "W3SVC", "S-1-5-80-1272828037-3321607953-1682131387-4084423848-3273467238": "WacomPen", "S-1-5-80-145391760-3682396335-1395736941-2543690743-1822485816": "WANARP", "S-1-5-80-3957613141-1606606214-622769385-3049525404-2510868034": "Wanarpv6", "S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505": "wbengine", "S-1-5-80-1577343513-2244782562-3500840712-2807016722-4230555396": "WbioSrvc", "S-1-5-80-1555863574-1012459212-3842453055-37978308-1142448422": "wcncsvc", "S-1-5-80-4064017820-1559943312-846267769-2219870576-1957141527": "WcsPlugInService", "S-1-5-80-3405261312-3324525412-773550320-3159108954-1126011555": "Wd", "S-1-5-80-2731089040-2526960094-3333867314-868407530-1311763772": "Wdf01000", "S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420": "WdiServiceHost", "S-1-5-80-3524758515-3090971750-345616940-2322499744-3530715838": "WdiSystemHost", "S-1-5-80-324959683-3395802011-921526492-919036580-1730255754": "WebClient", "S-1-5-80-4059739203-877974739-1245631912-527174227-2996563517": "Wecsvc", "S-1-5-80-3594706986-2537596223-181334840-1741483385-1351671666": "wercplsupport", "S-1-5-80-3299868208-4286319593-1091140620-3583751967-1732444380": "WerSvc", "S-1-5-80-2019001281-2253379323-945087313-3738653069-3773415333": "WfpLwf", "S-1-5-80-4016954646-3779912912-520790876-2627662839-2216516612": "WIMMount", "S-1-5-80-1367312344-4235937835-3348187091-2947416599-1643272376": "win32dd", "S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736": "WinDefend", "S-1-5-80-3760743496-293058752-544796799-945139227-648175845": "Windows Workflow Foundation 3.0.0.0", "S-1-5-80-2455429942-3131183193-3617688776-595395669-3772047725": "WinHttpAutoProxySvc", "S-1-5-80-3750560858-172214265-3889451188-1914796615-4100997547": "Winmgmt", "S-1-5-80-569256582-2953403351-2909559716-1301513147-412116970": "WinRM", "S-1-5-80-3758380775-581010763-2947690711-3499621892-3054972477": "Winsock", "S-1-5-80-197470898-1564017914-2276667423-138762734-2890991316": "WinSock2", "S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142": "Wlansvc", "S-1-5-80-404760553-4074834012-3606039051-2170089041-3496108291": "WmiAcpi", "S-1-5-80-1672893355-2301755825-1450106782-2724904875-1401714515": "WmiApRpl", "S-1-5-80-1851371743-411767070-3743290205-1090512353-603110601": "wmiApSrv", "S-1-5-80-2375682873-768044350-3534595160-1005545032-2873800392": "WMPNetworkSvc", "S-1-5-80-2153317275-3787551921-2333987345-3394040919-509713777": "WPCSvc", "S-1-5-80-113310567-2163499630-2787090463-221477905-209227094": "WPDBusEnum", "S-1-5-80-1339864866-2803517768-580965624-1158720225-1206284216": "ws2ifsl", "S-1-5-80-3232712927-1625117661-2590453128-1738570065-3637376297": "wscsvc", "S-1-5-80-117416528-2204451360-1913602512-1355018040-1234992034": "WSearch", "S-1-5-80-1961591210-2878639619-2091680054-2529124376-3572759234": "WSearchIdxPi", "S-1-5-80-1014140700-3308905587-3330345912-272242898-93311788": "wuauserv", "S-1-5-80-69171120-2364612362-2758615892-3595098197-2063739924": "WudfPf", "S-1-5-80-1839061227-813336325-324579571-4216704371-1399658985": "WUDFRd", "S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709": "wudfsvc", "S-1-5-80-3981856537-581775623-1136376035-2066872258-409572886": "WwanSvc", "S-1-5-80-2933569122-2468899862-1495779727-289297006-142656920": "xmlprov" }, "sids re":[ ["S-1-5-[0-9-]+-500$", "Administrator"], ["S-1-5-[0-9-]+-501$", "Guest"], ["S-1-5-[0-9-]+-502$", "KRBTGT"], ["S-1-5-[0-9-]+-512$", "Domain Admins"], ["S-1-5-[0-9-]+-513$", "Domain Users"], ["S-1-5-[0-9-]+-514$", "Domain Guests"], ["S-1-5-[0-9-]+-515$", "Domain Computers"], ["S-1-5-[0-9-]+-516$", "Domain Controllers"], ["S-1-5-[0-9-]+-517$", "Cert Publishers"], ["S-1-5-[0-9-]+-520$", "Group Policy Creator Owners"], ["S-1-5-[0-9-]+-533$", "RAS and IAS Servers"], ["S-1-5-5-[0-9]+-[0-9]+", "Logon Session"], ["S-1-5-21-[0-9-]+-518$", "Schema Admins"], ["S-1-5-21-[0-9-]+-519$", "Enterprise Admins"], ["S-1-5-21-[0-9-]+-553$", "RAS Servers"], ["S-1-5-21-[0-9-]+-498$", "Enterprise Read-Only Domain Controllers"], ["S-1-5-21-[0-9-]+-521$", "Read-Only Domain Controllers"], ["S-1-5-21-[0-9-]+-522$", "Cloneable Domain Controllers"], ["S-1-5-21-[0-9-]+-525$", "Protected Users"], ["S-1-5-21-[0-9-]+-553$", "Remote Access Services (RAS)"] ], "privileges":{ "2": ["SeCreateTokenPrivilege", "Create a token object"], "3": ["SeAssignPrimaryTokenPrivilege", "Replace a process-level token"], "4": ["SeLockMemoryPrivilege", "Lock pages in memory"], "5": ["SeIncreaseQuotaPrivilege", "Increase quotas"], "6": ["SeMachineAccountPrivilege", "Add workstations to the domain"], "7": ["SeTcbPrivilege", "Act as part of the operating system"], "8": ["SeSecurityPrivilege", "Manage auditing and security log"], "9": ["SeTakeOwnershipPrivilege", "Take ownership of files/objects"], "10": ["SeLoadDriverPrivilege", "Load and unload device drivers"], "11": ["SeSystemProfilePrivilege", "Profile system performance"], "12": ["SeSystemtimePrivilege", "Change the system time"], "13": ["SeProfileSingleProcessPrivilege", "Profile a single process"], "14": ["SeIncreaseBasePriorityPrivilege", "Increase scheduling priority"], "15": ["SeCreatePagefilePrivilege", "Create a pagefile"], "16": ["SeCreatePermanentPrivilege", "Create permanent shared objects"], "17": ["SeBackupPrivilege", "Backup files and directories"], "18": ["SeRestorePrivilege", "Restore files and directories"], "19": ["SeShutdownPrivilege", "Shut down the system"], "20": ["SeDebugPrivilege", "Debug programs"], "21": ["SeAuditPrivilege", "Generate security audits"], "22": ["SeSystemEnvironmentPrivilege", "Edit firmware environment values"], "23": ["SeChangeNotifyPrivilege", "Receive notifications of changes to files or directories"], "24": ["SeRemoteShutdownPrivilege", "Force shutdown from a remote system"], "25": ["SeUndockPrivilege", "Remove computer from docking station"], "26": ["SeSyncAgentPrivilege", "Synch directory service data"], "27": ["SeEnableDelegationPrivilege", "Enable user accounts to be trusted for delegation"], "28": ["SeManageVolumePrivilege", "Manage the files on a volume"], "29": ["SeImpersonatePrivilege", "Impersonate a client after authentication"], "30": ["SeCreateGlobalPrivilege", "Create global objects"], "31": ["SeTrustedCredManAccessPrivilege", "Access Credential Manager as a trusted caller"], "32": ["SeRelabelPrivilege", "Modify the mandatory integrity level of an object"], "33": ["SeIncreaseWorkingSetPrivilege", "Allocate more memory for user applications"], "34": ["SeTimeZonePrivilege", "Adjust the time zone of the computer's internal clock"], "35": ["SeCreateSymbolicLinkPrivilege", "Required to create a symbolic link"], "36": ["SeDelegateSessionUserImpersonatePrivilege", "Obtain an impersonation token for another user in the same session."] } }volatility3-1.0.1/volatility3/framework/plugins/windows/ssdt.py000066400000000000000000000135201405267600400247630ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import os from typing import Any, Iterator, List, Tuple from volatility3.framework import constants, interfaces from volatility3.framework import contexts from volatility3.framework import exceptions, symbols from volatility3.framework import renderers from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.renderers import format_hints from volatility3.plugins.windows import modules class SSDT(plugins.PluginInterface): """Lists the system call table.""" _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.PluginRequirement(name = 'modules', plugin = modules.Modules, version = (1, 0, 0)), ] @classmethod def build_module_collection(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str) -> contexts.ModuleCollection: """Builds a collection of modules. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols Returns: A Module collection of available modules based on `Modules.list_modules` """ mods = modules.Modules.list_modules(context, layer_name, symbol_table) context_modules = [] for mod in mods: try: module_name_with_ext = mod.BaseDllName.get_string() except exceptions.InvalidAddressException: # there's no use for a module with no name? continue module_name = os.path.splitext(module_name_with_ext)[0] symbol_table_name = None if module_name in constants.windows.KERNEL_MODULE_NAMES: symbol_table_name = symbol_table context_module = contexts.SizedModule(context, module_name, layer_name, mod.DllBase, mod.SizeOfImage, symbol_table_name = symbol_table_name) context_modules.append(context_module) return contexts.ModuleCollection(context_modules) def _generator(self) -> Iterator[Tuple[int, Tuple[int, int, Any, Any]]]: layer_name = self.config['primary'] collection = self.build_module_collection(self.context, self.config["primary"], self.config["nt_symbols"]) kvo = self.context.layers[layer_name].config['kernel_virtual_offset'] ntkrnlmp = self.context.module(self.config["nt_symbols"], layer_name = layer_name, offset = kvo) # this is just one way to enumerate the native (NT) service table. # to do the same thing for the Win32K service table, we would need Win32K.sys symbol support ## we could also find nt!KeServiceDescriptorTable (NT) and KeServiceDescriptorTableShadow (NT, Win32K) service_table_address = ntkrnlmp.get_symbol("KiServiceTable").address service_limit_address = ntkrnlmp.get_symbol("KiServiceLimit").address service_limit = ntkrnlmp.object(object_type = "int", offset = service_limit_address) # on 32-bit systems the table indexes are 32-bits and contain pointers (unsigned) # on 64-bit systems the indexes are also 32-bits but they're offsets from the # base address of the table and can be negative, so we need a signed data type is_kernel_64 = symbols.symbol_table_is_64bit(self.context, self.config["nt_symbols"]) if is_kernel_64: array_subtype = "long" def kvo_calulator(func: int) -> int: return kvo + service_table_address + (func >> 4) find_address = kvo_calulator else: array_subtype = "unsigned long" def passthrough(func: int) -> int: return func find_address = passthrough functions = ntkrnlmp.object(object_type = "array", offset = service_table_address, subtype = ntkrnlmp.get_type(array_subtype), count = service_limit) for idx, function_obj in enumerate(functions): function = find_address(function_obj) module_symbols = collection.get_module_symbols_by_absolute_location(function) for module_name, symbol_generator in module_symbols: symbols_found = False for symbol in symbol_generator: symbols_found = True yield (0, (idx, format_hints.Hex(function), module_name, symbol.split(constants.BANG)[1])) if not symbols_found: yield (0, (idx, format_hints.Hex(function), module_name, renderers.NotAvailableValue())) def run(self) -> renderers.TreeGrid: return renderers.TreeGrid([("Index", int), ("Address", format_hints.Hex), ("Module", str), ("Symbol", str)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/windows/strings.py000066400000000000000000000144431405267600400255040ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging import re from os import path from typing import Dict, Generator, List, Set, Tuple from volatility3.framework import interfaces, renderers, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.layers import intel, resources, linear from volatility3.framework.renderers import format_hints from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) class Strings(interfaces.plugins.PluginInterface): """Reads output from the strings command and indicates which process(es) each string belongs to.""" _required_framework_version = (1, 0, 0) strings_pattern = re.compile(rb"(?:\W*)([0-9]+)(?:\W*)(\w[\w\W]+)\n?") @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.URIRequirement(name = "strings_file", description = "Strings file") ] # TODO: Make URLRequirement that can accept a file address which the framework can open def run(self): return renderers.TreeGrid([("String", str), ("Physical Address", format_hints.Hex), ("Result", str)], self._generator()) def _generator(self) -> Generator[Tuple, None, None]: """Generates results from a strings file.""" revmap = self.generate_mapping(self.config['primary']) accessor = resources.ResourceAccessor() strings_fp = accessor.open(self.config['strings_file'], "rb") strings_size = path.getsize(strings_fp.file.name) line = strings_fp.readline() last_prog = 0 while line: try: offset, string = self._parse_line(line) try: revmap_list = [name + ":" + hex(offset) for (name, offset) in revmap[offset >> 12]] except (IndexError, KeyError): revmap_list = ["FREE MEMORY"] yield (0, (str(string, 'latin-1'), format_hints.Hex(offset), ", ".join(revmap_list))) except ValueError: vollog.error("Strings file is in the wrong format") return line = strings_fp.readline() prog = strings_fp.tell() / strings_size * 100 if round(prog, 1) > last_prog: last_prog = round(prog, 1) self._progress_callback(prog, "Matching strings in memory") def _parse_line(self, line: bytes) -> Tuple[int, bytes]: """Parses a single line from a strings file. Args: line: bytes of the line of a strings file (an offset and a string) Returns: Tuple of the offset and the string found at that offset """ match = self.strings_pattern.search(line) if not match: raise ValueError("Strings file contains invalid strings line") offset, string = match.group(1, 2) return int(offset), string def generate_mapping(self, layer_name: str) -> Dict[int, Set[Tuple[str, int]]]: """Creates a reverse mapping between virtual addresses and physical addresses. Args: layer_name: the layer to map against the string lines Returns: A mapping of virtual offsets to strings and physical offsets """ layer = self._context.layers[layer_name] reverse_map = dict() # type: Dict[int, Set[Tuple[str, int]]] if isinstance(layer, intel.Intel): # We don't care about errors, we just wanted chunks that map correctly for mapval in layer.mapping(0x0, layer.maximum_address, ignore_errors = True): offset, _, mapped_offset, mapped_size, maplayer = mapval for val in range(mapped_offset, mapped_offset + mapped_size, 0x1000): cur_set = reverse_map.get(mapped_offset >> 12, set()) cur_set.add(("kernel", offset)) reverse_map[mapped_offset >> 12] = cur_set self._progress_callback((offset * 100) / layer.maximum_address, "Creating reverse kernel map") # TODO: Include kernel modules for process in pslist.PsList.list_processes(self.context, self.config['primary'], self.config['nt_symbols']): proc_id = "Unknown" try: proc_id = process.UniqueProcessId proc_layer_name = process.add_process_layer() except exceptions.InvalidAddressException as excp: vollog.debug("Process {}: invalid address {} in layer {}".format( proc_id, excp.invalid_address, excp.layer_name)) continue proc_layer = self.context.layers[proc_layer_name] if isinstance(proc_layer, linear.LinearlyMappedLayer): for mapval in proc_layer.mapping(0x0, proc_layer.maximum_address, ignore_errors = True): mapped_offset, _, offset, mapped_size, maplayer = mapval for val in range(mapped_offset, mapped_offset + mapped_size, 0x1000): cur_set = reverse_map.get(mapped_offset >> 12, set()) cur_set.add(("Process {}".format(process.UniqueProcessId), offset)) reverse_map[mapped_offset >> 12] = cur_set # FIXME: make the progress for all processes, rather than per-process self._progress_callback((offset * 100) / layer.maximum_address, "Creating mapping for task {}".format(process.UniqueProcessId)) return reverse_map volatility3-1.0.1/volatility3/framework/plugins/windows/svcscan.py000066400000000000000000000214771405267600400254600ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import List from volatility3.framework import interfaces, renderers, constants, symbols, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.layers import scanners from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows import versions from volatility3.framework.symbols.windows.extensions import services from volatility3.plugins.windows import poolscanner, vadyarascan, pslist vollog = logging.getLogger(__name__) class SvcScan(interfaces.plugins.PluginInterface): """Scans for windows services.""" _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.PluginRequirement(name = 'poolscanner', plugin = poolscanner.PoolScanner, version = (1, 0, 0)), requirements.PluginRequirement(name = 'vadyarascan', plugin = vadyarascan.VadYaraScan, version = (1, 0, 0)) ] @staticmethod def get_record_tuple(service_record: interfaces.objects.ObjectInterface): return (format_hints.Hex(service_record.vol.offset), service_record.Order, service_record.get_pid(), service_record.Start.description, service_record.State.description, service_record.get_type(), service_record.get_name(), service_record.get_display(), service_record.get_binary()) @staticmethod def create_service_table(context: interfaces.context.ContextInterface, symbol_table: str, config_path: str) -> str: """Constructs a symbol table containing the symbols for services depending upon the operating system in use. Args: context: The context to retrieve required elements (layers, symbol tables) from symbol_table: The name of the table containing the kernel symbols config_path: The configuration path for any settings required by the new table Returns: A symbol table containing the symbols necessary for services """ native_types = context.symbol_space[symbol_table].natives is_64bit = symbols.symbol_table_is_64bit(context, symbol_table) if versions.is_windows_xp(context = context, symbol_table = symbol_table) and not is_64bit: symbol_filename = "services-xp-x86" elif versions.is_xp_or_2003(context = context, symbol_table = symbol_table) and is_64bit: symbol_filename = "services-xp-2003-x64" elif versions.is_win10_16299_or_later(context = context, symbol_table = symbol_table) and is_64bit: symbol_filename = "services-win10-16299-x64" elif versions.is_win10_16299_or_later(context = context, symbol_table = symbol_table) and not is_64bit: symbol_filename = "services-win10-16299-x86" elif versions.is_win10_up_to_15063(context = context, symbol_table = symbol_table) and is_64bit: symbol_filename = "services-win8-x64" elif versions.is_win10_up_to_15063(context = context, symbol_table = symbol_table) and not is_64bit: symbol_filename = "services-win8-x86" elif versions.is_win10_15063(context = context, symbol_table = symbol_table) and is_64bit: symbol_filename = "services-win10-15063-x64" elif versions.is_win10_15063(context = context, symbol_table = symbol_table) and not is_64bit: symbol_filename = "services-win10-15063-x86" elif versions.is_windows_8_or_later(context = context, symbol_table = symbol_table) and is_64bit: symbol_filename = "services-win8-x64" elif versions.is_windows_8_or_later(context = context, symbol_table = symbol_table) and not is_64bit: symbol_filename = "services-win8-x86" elif versions.is_vista_or_later(context = context, symbol_table = symbol_table) and is_64bit: symbol_filename = "services-vista-x64" elif versions.is_vista_or_later(context = context, symbol_table = symbol_table) and not is_64bit: symbol_filename = "services-vista-x86" else: raise NotImplementedError("This version of Windows is not supported!") return intermed.IntermediateSymbolTable.create(context, config_path, "windows", symbol_filename, class_types = services.class_types, native_types = native_types) def _generator(self): service_table_name = self.create_service_table(self.context, self.config["nt_symbols"], self.config_path) relative_tag_offset = self.context.symbol_space.get_type(service_table_name + constants.BANG + "_SERVICE_RECORD").relative_child_offset("Tag") filter_func = pslist.PsList.create_name_filter(["services.exe"]) is_vista_or_later = versions.is_vista_or_later(context = self.context, symbol_table = self.config["nt_symbols"]) if is_vista_or_later: service_tag = b"serH" else: service_tag = b"sErv" seen = [] for task in pslist.PsList.list_processes(context = self.context, layer_name = self.config['primary'], symbol_table = self.config['nt_symbols'], filter_func = filter_func): proc_id = "Unknown" try: proc_id = task.UniqueProcessId proc_layer_name = task.add_process_layer() except exceptions.InvalidAddressException as excp: vollog.debug("Process {}: invalid address {} in layer {}".format(proc_id, excp.invalid_address, excp.layer_name)) continue layer = self.context.layers[proc_layer_name] for offset in layer.scan(context = self.context, scanner = scanners.BytesScanner(needle = service_tag), sections = vadyarascan.VadYaraScan.get_vad_maps(task)): if not is_vista_or_later: service_record = self.context.object(service_table_name + constants.BANG + "_SERVICE_RECORD", offset = offset - relative_tag_offset, layer_name = proc_layer_name) if not service_record.is_valid(): continue yield (0, self.get_record_tuple(service_record)) else: service_header = self.context.object(service_table_name + constants.BANG + "_SERVICE_HEADER", offset = offset, layer_name = proc_layer_name) if not service_header.is_valid(): continue # since we walk the s-list backwards, if we've seen # an object, then we've also seen all objects that # exist before it, thus we can break at that time. for service_record in service_header.ServiceRecord.traverse(): if service_record in seen: break seen.append(service_record) yield (0, self.get_record_tuple(service_record)) def run(self): return renderers.TreeGrid([ ('Offset', format_hints.Hex), ('Order', int), ('Pid', int), ('Start', str), ('State', str), ('Type', str), ('Name', str), ('Display', str), ('Binary', str), ], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/windows/symlinkscan.py000066400000000000000000000062231405267600400263430ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import datetime from typing import Iterable from volatility3.framework import renderers, exceptions, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.plugins import timeliner from volatility3.plugins.windows import poolscanner class SymlinkScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Scans for links present in a particular windows memory image.""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), ] @classmethod def scan_symlinks(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str) -> \ Iterable[interfaces.objects.ObjectInterface]: """Scans for links using the poolscanner module and constraints. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols Returns: A list of symlink objects found by scanning memory for the Symlink pool signatures """ constraints = poolscanner.PoolScanner.builtin_constraints(symbol_table, [b'Sym\xe2', b'Symb']) for result in poolscanner.PoolScanner.generate_pool_scan(context, layer_name, symbol_table, constraints): _constraint, mem_object, _header = result yield mem_object def _generator(self): for link in self.scan_symlinks(self.context, self.config['primary'], self.config['nt_symbols']): try: from_name = link.get_link_name() except (ValueError, exceptions.InvalidAddressException): continue try: to_name = link.LinkTarget.String except exceptions.InvalidAddressException: continue yield (0, (format_hints.Hex(link.vol.offset), link.get_create_time(), from_name, to_name)) def generate_timeline(self): for row in self._generator(): _depth, row_data = row description = "Symlink: {} -> {}".format(row_data[2], row_data[3]) yield (description, timeliner.TimeLinerType.CREATED, row_data[1]) def run(self): return renderers.TreeGrid([ ("Offset", format_hints.Hex), ("CreateTime", datetime.datetime), ("From Name", str), ("To Name", str), ], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/windows/vadinfo.py000066400000000000000000000243531405267600400254420ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import Callable, List, Generator, Iterable, Type, Optional from volatility3.framework import renderers, interfaces, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility from volatility3.framework.renderers import format_hints from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) # these are from WinNT.h winnt_protections = { "PAGE_NOACCESS": 0x01, "PAGE_READONLY": 0x02, "PAGE_READWRITE": 0x04, "PAGE_WRITECOPY": 0x08, "PAGE_EXECUTE": 0x10, "PAGE_EXECUTE_READ": 0x20, "PAGE_EXECUTE_READWRITE": 0x40, "PAGE_EXECUTE_WRITECOPY": 0x80, "PAGE_GUARD": 0x100, "PAGE_NOCACHE": 0x200, "PAGE_WRITECOMBINE": 0x400, "PAGE_TARGETS_INVALID": 0x40000000, } class VadInfo(interfaces.plugins.PluginInterface): """Lists process memory ranges.""" _required_framework_version = (1, 0, 0) _version = (2, 0, 0) MAXSIZE_DEFAULT = 0 def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self._protect_values = None @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # Since we're calling the plugin, make sure we have the plugin's requirements return [requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), # TODO: Convert this to a ListRequirement so that people can filter on sets of ranges requirements.IntRequirement(name = 'address', description = "Process virtual memory address to include " \ "(all other address ranges are excluded). This must be " \ "a base address, not an address within the desired range.", optional = True), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, optional = True), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.BooleanRequirement(name = 'dump', description = "Extract listed memory ranges", default = False, optional = True), requirements.IntRequirement(name = 'maxsize', description = "Maximum size for dumped VAD sections " \ "(all the bigger sections will be ignored)", default = cls.MAXSIZE_DEFAULT, optional = True), ] @classmethod def protect_values(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str) -> Iterable[int]: """Look up the array of memory protection constants from the memory sample. These don't change often, but if they do in the future, then finding them dynamically versus hard-coding here will ensure we parse them properly. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols """ kvo = context.layers[layer_name].config["kernel_virtual_offset"] ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo) addr = ntkrnlmp.get_symbol("MmProtectToValue").address values = ntkrnlmp.object(object_type = "array", offset = addr, subtype = ntkrnlmp.get_type("int"), count = 32) return values # type: ignore @classmethod def list_vads(cls, proc: interfaces.objects.ObjectInterface, filter_func: Callable[[interfaces.objects.ObjectInterface], bool] = lambda _: False) -> \ Generator[interfaces.objects.ObjectInterface, None, None]: """Lists the Virtual Address Descriptors of a specific process. Args: proc: _EPROCESS object from which to list the VADs filter_func: Function to take a virtual address descriptor value and return True if it should be filtered out Returns: A list of virtual address descriptors based on the process and filtered based on the filter function """ for vad in proc.get_vad_root().traverse(): if not filter_func(vad): yield vad @classmethod def vad_dump(cls, context: interfaces.context.ContextInterface, proc: interfaces.objects.ObjectInterface, vad: interfaces.objects.ObjectInterface, open_method: Type[interfaces.plugins.FileHandlerInterface], maxsize: int = MAXSIZE_DEFAULT) -> Optional[interfaces.plugins.FileHandlerInterface]: """Extracts the complete data for Vad as a FileInterface. Args: context: The context to retrieve required elements (layers, symbol tables) from proc: an _EPROCESS instance vad: The suspected VAD to extract (ObjectInterface) open_method: class to provide context manager for opening the file maxsize: Max size of VAD section (default MAXSIZE_DEFAULT) Returns: An open FileInterface object containing the complete data for the process or None in the case of failure """ try: vad_start = vad.get_start() vad_end = vad.get_end() except AttributeError: vollog.debug("Unable to find the starting/ending VPN member") return if maxsize > 0 and (vad_end - vad_start) > maxsize: vollog.debug("Skip VAD dump {0:#x}-{1:#x} due to maxsize limit".format(vad_start, vad_end)) return proc_id = "Unknown" try: proc_id = proc.UniqueProcessId proc_layer_name = proc.add_process_layer() except exceptions.InvalidAddressException as excp: vollog.debug("Process {}: invalid address {} in layer {}".format(proc_id, excp.invalid_address, excp.layer_name)) return None proc_layer = context.layers[proc_layer_name] file_name = "pid.{0}.vad.{1:#x}-{2:#x}.dmp".format(proc_id, vad_start, vad_end) try: file_handle = open_method(file_name) chunk_size = 1024 * 1024 * 10 offset = vad_start while offset < vad_end: to_read = min(chunk_size, vad_end - offset) data = proc_layer.read(offset, to_read, pad = True) if not data: break file_handle.write(data) offset += to_read except Exception as excp: vollog.debug("Unable to dump VAD {}: {}".format(file_name, excp)) return return file_handle def _generator(self, procs): def passthrough(_: interfaces.objects.ObjectInterface) -> bool: return False filter_func = passthrough if self.config.get('address', None) is not None: def filter_function(x: interfaces.objects.ObjectInterface) -> bool: return x.get_start() not in [self.config['address']] filter_func = filter_function for proc in procs: process_name = utility.array_to_string(proc.ImageFileName) for vad in self.list_vads(proc, filter_func = filter_func): file_output = "Disabled" if self.config['dump']: file_handle = self.vad_dump(self.context, proc, vad, self.open, self.config['maxsize']) file_output = "Error outputting file" if file_handle: file_handle.close() file_output = file_handle.preferred_filename yield (0, (proc.UniqueProcessId, process_name, format_hints.Hex(vad.vol.offset), format_hints.Hex(vad.get_start()), format_hints.Hex(vad.get_end()), vad.get_tag(), vad.get_protection( self.protect_values(self.context, self.config['primary'], self.config['nt_symbols']), winnt_protections), vad.get_commit_charge(), vad.get_private_memory(), format_hints.Hex(vad.get_parent()), vad.get_file_name(), file_output)) def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), ("Offset", format_hints.Hex), ("Start VPN", format_hints.Hex), ("End VPN", format_hints.Hex), ("Tag", str), ("Protection", str), ("CommitCharge", int), ("PrivateMemory", int), ("Parent", format_hints.Hex), ("File", str), ("File output", str)], self._generator( pslist.PsList.list_processes(context = self.context, layer_name = self.config['primary'], symbol_table = self.config['nt_symbols'], filter_func = filter_func))) volatility3-1.0.1/volatility3/framework/plugins/windows/vadyarascan.py000066400000000000000000000106261405267600400263060ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import Iterable, List, Tuple from volatility3.framework import interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.plugins import yarascan from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) class VadYaraScan(interfaces.plugins.PluginInterface): """Scans all the Virtual Address Descriptor memory maps using yara.""" _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = "Memory layer for the kernel", architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.BooleanRequirement(name = "wide", description = "Match wide (unicode) strings", default = False, optional = True), requirements.StringRequirement(name = "yara_rules", description = "Yara rules (as a string)", optional = True), requirements.URIRequirement(name = "yara_file", description = "Yara rules (as a file)", optional = True), requirements.IntRequirement(name = "max_size", default = 0x40000000, description = "Set the maximum size (default is 1GB)", optional = True), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.VersionRequirement(name = 'yarascanner', component = yarascan.YaraScanner, version = (2, 0, 0)), requirements.ListRequirement(name = 'pid', element_type = int, description = "Process IDs to include (all other processes are excluded)", optional = True) ] def _generator(self): rules = yarascan.YaraScan.process_yara_options(dict(self.config)) filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) for task in pslist.PsList.list_processes(context = self.context, layer_name = self.config['primary'], symbol_table = self.config['nt_symbols'], filter_func = filter_func): layer_name = task.add_process_layer() layer = self.context.layers[layer_name] for offset, rule_name, name, value in layer.scan(context = self.context, scanner = yarascan.YaraScanner(rules = rules), sections = self.get_vad_maps(task)): yield 0, (format_hints.Hex(offset), task.UniqueProcessId, rule_name, name, value) @staticmethod def get_vad_maps(task: interfaces.objects.ObjectInterface) -> Iterable[Tuple[int, int]]: """Creates a map of start/end addresses within a virtual address descriptor tree. Args: task: The EPROCESS object of which to traverse the vad tree Returns: An iterable of tuples containing start and end addresses for each descriptor """ vad_root = task.get_vad_root() for vad in vad_root.traverse(): end = vad.get_end() start = vad.get_start() yield (start, end - start) def run(self): return renderers.TreeGrid([('Offset', format_hints.Hex), ('Pid', int), ('Rule', str), ('Component', str), ('Value', bytes)], self._generator()) volatility3-1.0.1/volatility3/framework/plugins/windows/verinfo.py000066400000000000000000000201031405267600400254510ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import io import logging from typing import Generator, List, Tuple from volatility3.framework import exceptions, renderers, constants, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows.extensions import pe from volatility3.plugins.windows import pslist, modules, dlllist vollog = logging.getLogger(__name__) try: import pefile except ImportError: vollog.info("Python pefile module not found, plugin (and dependent plugins) not available") raise class VerInfo(interfaces.plugins.PluginInterface): """Lists version information from PE files.""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: ## TODO: we might add a regex option on the name later, but otherwise we're good ## TODO: and we don't want any CLI options from pslist, modules, or moddump return [ requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.PluginRequirement(name = 'modules', plugin = modules.Modules, version = (1, 0, 0)), requirements.VersionRequirement(name = 'dlllist', component = dlllist.DllList, version = (2, 0, 0)), requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), ] @classmethod def get_version_information(cls, context: interfaces.context.ContextInterface, pe_table_name: str, layer_name: str, base_address: int) -> Tuple[int, int, int, int]: """Get File and Product version information from PE files. Args: context: volatility context on which to operate pe_table_name: name of the PE table layer_name: name of the layer containing the PE file base_address: base address of the PE (where MZ is found) """ if layer_name is None: raise TypeError("Layer must be a string not None") pe_data = io.BytesIO() dos_header = context.object(pe_table_name + constants.BANG + "_IMAGE_DOS_HEADER", offset = base_address, layer_name = layer_name) for offset, data in dos_header.reconstruct(): pe_data.seek(offset) pe_data.write(data) pe = pefile.PE(data = pe_data.getvalue(), fast_load = True) pe.parse_data_directories([pefile.DIRECTORY_ENTRY["IMAGE_DIRECTORY_ENTRY_RESOURCE"]]) if isinstance(pe.VS_FIXEDFILEINFO, list): # pefile >= 2018.8.8 (estimated) version_struct = pe.VS_FIXEDFILEINFO[0] else: # pefile <= 2017.11.5 (estimated) version_struct = pe.VS_FIXEDFILEINFO major = version_struct.ProductVersionMS >> 16 minor = version_struct.ProductVersionMS & 0xFFFF product = version_struct.ProductVersionLS >> 16 build = version_struct.ProductVersionLS & 0xFFFF pe_data.close() return major, minor, product, build def _generator(self, procs: Generator[interfaces.objects.ObjectInterface, None, None], mods: Generator[interfaces.objects.ObjectInterface, None, None], session_layers: Generator[str, None, None]): """Generates a list of PE file version info for processes, dlls, and modules. Args: procs: of processes mods: of modules session_layers: of layers in the session to be checked """ pe_table_name = intermed.IntermediateSymbolTable.create(self.context, self.config_path, "windows", "pe", class_types = pe.class_types) for mod in mods: try: BaseDllName = mod.BaseDllName.get_string() except exceptions.InvalidAddressException: BaseDllName = renderers.UnreadableValue() session_layer_name = modules.Modules.find_session_layer(self.context, session_layers, mod.DllBase) try: (major, minor, product, build) = self.get_version_information(self._context, pe_table_name, session_layer_name, mod.DllBase) except (exceptions.InvalidAddressException, TypeError, AttributeError): (major, minor, product, build) = [renderers.UnreadableValue()] * 4 # the pid and process are not applicable for kernel modules yield (0, (renderers.NotApplicableValue(), renderers.NotApplicableValue(), format_hints.Hex(mod.DllBase), BaseDllName, major, minor, product, build)) # now go through the process and dll lists for proc in procs: proc_id = "Unknown" try: proc_id = proc.UniqueProcessId proc_layer_name = proc.add_process_layer() except exceptions.InvalidAddressException as excp: vollog.debug("Process {}: invalid address {} in layer {}".format(proc_id, excp.invalid_address, excp.layer_name)) continue for entry in proc.load_order_modules(): try: BaseDllName = entry.BaseDllName.get_string() except exceptions.InvalidAddressException: BaseDllName = renderers.UnreadableValue() try: DllBase = format_hints.Hex(entry.DllBase) except exceptions.InvalidAddressException: DllBase = renderers.UnreadableValue() try: (major, minor, product, build) = self.get_version_information(self._context, pe_table_name, proc_layer_name, entry.DllBase) except (exceptions.InvalidAddressException, ValueError, AttributeError): (major, minor, product, build) = [renderers.UnreadableValue()] * 4 yield (0, (proc.UniqueProcessId, proc.ImageFileName.cast("string", max_length = proc.ImageFileName.vol.count, errors = "replace"), DllBase, BaseDllName, major, minor, product, build)) def run(self): procs = pslist.PsList.list_processes(self.context, self.config["primary"], self.config["nt_symbols"]) mods = modules.Modules.list_modules(self.context, self.config["primary"], self.config["nt_symbols"]) # populate the session layers for kernel modules session_layers = modules.Modules.get_session_layers(self.context, self.config['primary'], self.config['nt_symbols']) return renderers.TreeGrid([("PID", int), ("Process", str), ("Base", format_hints.Hex), ("Name", str), ("Major", int), ("Minor", int), ("Product", int), ("Build", int)], self._generator(procs, mods, session_layers)) volatility3-1.0.1/volatility3/framework/plugins/windows/virtmap.py000066400000000000000000000136441405267600400254770ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import List, Tuple, Dict, Generator from volatility3.framework import interfaces, renderers, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.layers import intel from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) class VirtMap(interfaces.plugins.PluginInterface): """Lists virtual mapped sections.""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") ] def _generator(self, map): for entry in sorted(map): for (start, end) in map[entry]: yield (0, (entry, format_hints.Hex(start), format_hints.Hex(end))) @classmethod def determine_map(cls, module: interfaces.context.ModuleInterface) -> \ Dict[str, List[Tuple[int, int]]]: """Returns the virtual map from a windows kernel module.""" layer = module.context.layers[module.layer_name] if not isinstance(layer, intel.Intel): raise result = {} # type: Dict[str, List[Tuple[int, int]]] system_va_type = module.get_enumeration('_MI_SYSTEM_VA_TYPE') large_page_size = (layer.page_size ** 2) // module.get_type("_MMPTE").size if module.has_symbol('MiVisibleState'): symbol = module.get_symbol('MiVisibleState') visible_state = module.object(object_type = 'pointer', offset = symbol.address, subtype = module.get_type('_MI_VISIBLE_STATE')).dereference() if hasattr(visible_state, 'SystemVaRegions'): for i in range(visible_state.SystemVaRegions.count): lookup = system_va_type.lookup(i) region_range = result.get(lookup, []) region_range.append( (visible_state.SystemVaRegions[i].BaseAddress, visible_state.SystemVaRegions[i].NumberOfBytes)) result[lookup] = region_range elif hasattr(visible_state, 'SystemVaType'): system_range_start = module.object(object_type = "pointer", offset = module.get_symbol("MmSystemRangeStart").address) result = cls._enumerate_system_va_type(large_page_size, system_range_start, module, visible_state.SystemVaType) else: raise exceptions.SymbolError(None, module.name, "Required structures not found") elif module.has_symbol('MiSystemVaType'): system_range_start = module.object(object_type = "pointer", offset = module.get_symbol("MmSystemRangeStart").address) symbol = module.get_symbol('MiSystemVaType') array_count = (0xFFFFFFFF + 1 - system_range_start) // large_page_size type_array = module.object(object_type = 'array', offset = symbol.address, count = array_count, subtype = module.get_type('char')) result = cls._enumerate_system_va_type(large_page_size, system_range_start, module, type_array) else: raise exceptions.SymbolError(None, module.name, "Required structures not found") return result @classmethod def _enumerate_system_va_type(cls, large_page_size: int, system_range_start: int, module: interfaces.context.ModuleInterface, type_array: interfaces.objects.ObjectInterface) -> Dict[str, List[Tuple[int, int]]]: result = {} # type: Dict[str, List[Tuple[int, int]]] system_va_type = module.get_enumeration('_MI_SYSTEM_VA_TYPE') start = system_range_start prev_entry = -1 cur_size = large_page_size for entry in type_array: entry = system_va_type.lookup(entry) if entry != prev_entry: region_range = result.get(entry, []) region_range.append((start, cur_size)) result[entry] = region_range start = start + cur_size cur_size = large_page_size else: cur_size += large_page_size prev_entry = entry return result @classmethod def scannable_sections(cls, module: interfaces.context.ModuleInterface) -> Generator[Tuple[int, int], None, None]: mapping = cls.determine_map(module) for entry in mapping: if 'Unused' not in entry: for value in mapping[entry]: yield value def run(self): layer = self.context.layers[self.config['primary']] module = self.context.module(self.config['nt_symbols'], layer_name = layer.name, offset = layer.config['kernel_virtual_offset']) return renderers.TreeGrid([("Region", str), ("Start offset", format_hints.Hex), ("End offset", format_hints.Hex)], self._generator(self.determine_map(module = module))) volatility3-1.0.1/volatility3/framework/plugins/yarascan.py000066400000000000000000000103241405267600400241140ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import Iterable, Tuple, List, Dict, Any from volatility3.framework import interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.layers import resources from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) try: import yara except ImportError: vollog.info("Python Yara module not found, plugin (and dependent plugins) not available") raise class YaraScanner(interfaces.layers.ScannerInterface): _version = (2, 0, 0) # yara.Rules isn't exposed, so we can't type this properly def __init__(self, rules) -> None: super().__init__() self._rules = rules def __call__(self, data: bytes, data_offset: int) -> Iterable[Tuple[int, str, str, bytes]]: for match in self._rules.match(data = data): for offset, name, value in match.strings: yield (offset + data_offset, match.rule, name, value) class YaraScan(plugins.PluginInterface): """Scans kernel memory using yara rules (string or file).""" _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = "Memory layer for the kernel", architectures = ["Intel32", "Intel64"]), requirements.BooleanRequirement(name = "insensitive", description = "Makes the search case insensitive", default = False, optional = True), requirements.BooleanRequirement(name = "wide", description = "Match wide (unicode) strings", default = False, optional = True), requirements.StringRequirement(name = "yara_rules", description = "Yara rules (as a string)", optional = True), requirements.URIRequirement(name = "yara_file", description = "Yara rules (as a file)", optional = True), requirements.IntRequirement(name = "max_size", default = 0x40000000, description = "Set the maximum size (default is 1GB)", optional = True) ] @classmethod def process_yara_options(cls, config: Dict[str, Any]): rules = None if config.get('yara_rules', None) is not None: rule = config['yara_rules'] if rule[0] not in ["{", "/"]: rule = '"{}"'.format(rule) if config.get('case', False): rule += " nocase" if config.get('wide', False): rule += " wide ascii" rules = yara.compile(sources = {'n': 'rule r1 {{strings: $a = {} condition: $a}}'.format(rule)}) elif config.get('yara_file', None) is not None: rules = yara.compile(file = resources.ResourceAccessor().open(config['yara_file'], "rb")) else: vollog.error("No yara rules, nor yara rules file were specified") return rules def _generator(self): rules = self.process_yara_options(dict(self.config)) layer = self.context.layers[self.config['primary']] for offset, rule_name, name, value in layer.scan(context = self.context, scanner = YaraScanner(rules = rules)): yield 0, (format_hints.Hex(offset), rule_name, name, value) def run(self): return renderers.TreeGrid([('Offset', format_hints.Hex), ('Rule', str), ('Component', str), ('Value', bytes)], self._generator()) volatility3-1.0.1/volatility3/framework/renderers/000077500000000000000000000000001405267600400222515ustar00rootroot00000000000000volatility3-1.0.1/volatility3/framework/renderers/__init__.py000066400000000000000000000410001405267600400243550ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """Renderers. Renderers display the unified output format in some manner (be it text or file or graphical output """ import collections import datetime import logging from typing import Any, Callable, Iterable, List, Optional, Sequence, Tuple, TypeVar, Union from volatility3.framework import interfaces from volatility3.framework.interfaces import renderers vollog = logging.getLogger(__name__) class UnreadableValue(interfaces.renderers.BaseAbsentValue): """Class that represents values which are empty because the data cannot be read.""" class UnparsableValue(interfaces.renderers.BaseAbsentValue): """Class that represents values which are empty because the data cannot be interpreted correctly.""" class NotApplicableValue(interfaces.renderers.BaseAbsentValue): """Class that represents values which are empty because they don't make sense for this node.""" class NotAvailableValue(interfaces.renderers.BaseAbsentValue): """Class that represents values which cannot be provided now (but might in a future run) This might occur when information packed with volatility (such as symbol information) is not available, but a future version or a different run may later have that information available (ie, it could be applicable, but we can't get it and it's not because it's unreadable or unparsable). Unreadable and Unparsable should be used in preference, and only if neither fits should this be used. """ class TreeNode(interfaces.renderers.TreeNode): """Class representing a particular node in a tree grid.""" def __init__(self, path: str, treegrid: 'TreeGrid', parent: Optional['TreeNode'], values: List[interfaces.renderers.BaseTypes]) -> None: if not isinstance(treegrid, TreeGrid): raise TypeError("Treegrid must be an instance of TreeGrid") self._treegrid = treegrid self._parent = parent self._path = path self._validate_values(values) self._values = treegrid.RowStructure(*values) # type: ignore def __repr__(self) -> str: return "".format(self.path, self._values) def __getitem__(self, item: Union[int, slice]) -> Any: return self._treegrid.children(self).__getitem__(item) def __len__(self) -> int: return len(self._treegrid.children(self)) def _validate_values(self, values: List[interfaces.renderers.BaseTypes]) -> None: """A function for raising exceptions if a given set of values is invalid according to the column properties.""" if not (isinstance(values, collections.abc.Sequence) and len(values) == len(self._treegrid.columns)): raise TypeError( "Values must be a list of objects made up of simple types and number the same as the columns") for index in range(len(self._treegrid.columns)): column = self._treegrid.columns[index] val = values[index] if not isinstance(val, (column.type, interfaces.renderers.BaseAbsentValue)): raise TypeError( "Values item with index {} is the wrong type for column {} (got {} but expected {})".format( index, column.name, type(val), column.type)) # TODO: Consider how to deal with timezone naive/aware datetimes (and alert plugin uses to be precise) # if isinstance(val, datetime.datetime): # tznaive = val.tzinfo is None or val.tzinfo.utcoffset(val) is None @property def values(self) -> Sequence[interfaces.renderers.BaseTypes]: """Returns the list of values from the particular node, based on column index.""" return self._values @property def path(self) -> str: """Returns a path identifying string. This should be seen as opaque by external classes, Parsing of path locations based on this string are not guaranteed to remain stable. """ return self._path @property def parent(self) -> Optional['TreeNode']: """Returns the parent node of this node or None.""" return self._parent @property def path_depth(self) -> int: """Return the path depth of the current node.""" return len(self.path.split(TreeGrid.path_sep)) def path_changed(self, path: str, added: bool = False) -> None: """Updates the path based on the addition or removal of a node higher up in the tree. This should only be called by the containing TreeGrid and expects to only be called for affected nodes. """ components = self._path.split(TreeGrid.path_sep) changed = path.split(TreeGrid.path_sep) changed_index = len(changed) - 1 if int(components[changed_index]) >= int(changed[-1]): components[changed_index] = str(int(components[changed_index]) + (1 if added else -1)) self._path = TreeGrid.path_sep.join(components) def RowStructureConstructor(names: List[str]): return collections.namedtuple("RowStructure", [TreeGrid.sanitize_name(name) for name in names]) class TreeGrid(interfaces.renderers.TreeGrid): """Class providing the interface for a TreeGrid (which contains TreeNodes) The structure of a TreeGrid is designed to maintain the structure of the tree in a single object. For this reason each TreeNode does not hold its children, they are managed by the top level object. This leaves the Nodes as simple data carries and prevents them being used to manipulate the tree as a whole. This is a data structure, and is not expected to be modified much once created. Carrying the children under the parent makes recursion easier, but then every node is its own little tree and must have all the supporting tree functions. It also allows for a node to be present in several different trees, and to create cycles. """ path_sep = "|" def __init__(self, columns: List[Tuple[str, interfaces.renderers.BaseTypes]], generator: Optional[Iterable[Tuple[int, Tuple]]]) -> None: """Constructs a TreeGrid object using a specific set of columns. The TreeGrid itself is a root element, that can have children but no values. The TreeGrid does *not* contain any information about formatting, these are up to the renderers and plugins. Args: columns: A list of column tuples made up of (name, type). generator: An iterable containing row for a tree grid, each row contains a indent level followed by the values for each column in order. """ self._populated = False self._row_count = 0 self._children = [] # type: List[interfaces.renderers.TreeNode] converted_columns = [] # type: List[interfaces.renderers.Column] if len(columns) < 1: raise ValueError("Columns must be a list containing at least one column") for (name, column_type) in columns: is_simple_type = issubclass(column_type, self.base_types) if not is_simple_type: raise TypeError("Column {}'s type is not a simple type: {}".format(name, column_type.__class__.__name__)) converted_columns.append(interfaces.renderers.Column(name, column_type)) self.RowStructure = RowStructureConstructor([column.name for column in converted_columns]) self._columns = converted_columns if generator is None: generator = [] generator = iter(generator) self._generator = generator @staticmethod def sanitize_name(text: str) -> str: output = "" for letter in text.lower(): if letter != ' ': output += (letter if letter in 'abcdefghiljklmnopqrstuvwxyz_0123456789' else '_') return output def populate(self, function: interfaces.renderers.VisitorSignature = None, initial_accumulator: Any = None, fail_on_errors: bool = True) -> Optional[Exception]: """Populates the tree by consuming the TreeGrid's construction generator Func is called on every node, so can be used to create output on demand. This is equivalent to a one-time visit. Args: function: The visitor to be called on each row of the treegrid initial_accumulator: The initial value for an accumulator passed to the visitor to allow it to maintain state fail_on_errors: A boolean defining whether exceptions should be caught or bubble up """ accumulator = initial_accumulator if function is None: def function(_x: interfaces.renderers.TreeNode, _y: Any) -> Any: return None if not self.populated: try: prev_nodes = [] # type: List[interfaces.renderers.TreeNode] for (level, item) in self._generator: parent_index = min(len(prev_nodes), level) parent = prev_nodes[parent_index - 1] if parent_index > 0 else None treenode = self._append(parent, item) prev_nodes = prev_nodes[0:parent_index] + [treenode] if function is not None: accumulator = function(treenode, accumulator) self._row_count += 1 except Exception as excp: if fail_on_errors: raise vollog.debug("Exception during population: {}".format(excp)) self._populated = True return excp self._populated = True return None @property def populated(self) -> bool: """Indicates that population has completed and the tree may now be manipulated separately.""" return self._populated @property def columns(self) -> List[interfaces.renderers.Column]: """Returns the available columns and their ordering and types.""" return self._columns @property def row_count(self) -> int: """Returns the number of rows populated.""" return self._row_count def children(self, node: Optional[interfaces.renderers.TreeNode]) -> List[interfaces.renderers.TreeNode]: """Returns the subnodes of a particular node in order.""" return [node for node, _ in self._find_children(node)] def _find_children(self, node: Optional[interfaces.renderers.TreeNode]) -> Any: """Returns the children list associated with a particular node. Returns None if the node does not exist """ children = self._children try: if node is not None: for path_component in node.path.split(self.path_sep): _, children = children[int(path_component)] except IndexError: return [] return children def values(self, node): """Returns the values for a particular node. The values returned are mutable, """ if node is None: raise TypeError("Node must be a valid node within the TreeGrid") return node.values def _append(self, parent: Optional[interfaces.renderers.TreeNode], values: Any) -> TreeNode: """Adds a new node at the top level if parent is None, or under the parent node otherwise, after all other children.""" children = self.children(parent) return self._insert(parent, len(children), values) def _insert(self, parent: Optional[interfaces.renderers.TreeNode], position: int, values: Any) -> TreeNode: """Inserts an element into the tree at a specific position.""" parent_path = "" children = self._find_children(parent) if parent is not None: parent_path = parent.path + self.path_sep newpath = parent_path + str(position) tree_item = TreeNode(newpath, self, parent, values) for node, _ in children[position:]: self.visit(node, lambda child, _: child.path_changed(newpath, True), None) children.insert(position, (tree_item, [])) return tree_item def is_ancestor(self, node, descendant): """Returns true if descendent is a child, grandchild, etc of node.""" return descendant.path.startswith(node.path) def max_depth(self): """Returns the maximum depth of the tree.""" return self.visit(None, lambda n, a: max(a, self.path_depth(n)), 0) _T = TypeVar("_T") def visit(self, node: Optional[interfaces.renderers.TreeNode], function: Callable[[interfaces.renderers.TreeNode, _T], _T], initial_accumulator: _T, sort_key: Optional[interfaces.renderers.ColumnSortKey] = None): """Visits all the nodes in a tree, calling function on each one. function should have the signature function(node, accumulator) and return new_accumulator If accumulators are not needed, the function must still accept a second parameter. The order of that the nodes are visited is always depth first, however, the order children are traversed can be set based on a sort_key function which should accept a node's values and return something that can be sorted to receive the desired order (similar to the sort/sorted key). We use the private _find_children function so that we don't have to re-traverse the tree for every node we descend further down """ if not self.populated: self.populate() # Find_nodes is path dependent, whereas _visit is not # So in case the function modifies the node's path, find the nodes first children = self._find_children(node) accumulator = initial_accumulator # We split visit into two, so that we don't have to keep calling find_children to traverse the tree if node is not None: accumulator = function(node, initial_accumulator) if children is not None: if sort_key is not None: sort_key_not_none = sort_key # Only necessary because of mypy children = sorted(children, key = lambda x: sort_key_not_none(x[0].values)) if not sort_key.ascending: children = reversed(children) accumulator = self._visit(children, function, accumulator, sort_key) return accumulator def _visit(self, list_of_children: List[interfaces.renderers.TreeNode], function: Callable, accumulator: _T, sort_key: Optional[interfaces.renderers.ColumnSortKey] = None) -> _T: """Visits all the nodes in a tree, calling function on each one.""" if list_of_children is not None: for n, children in list_of_children: accumulator = function(n, accumulator) if sort_key is not None: sort_key_not_none = sort_key # Only necessary because of mypy children = sorted(children, key = lambda x: sort_key_not_none(x[0].values)) if not sort_key.ascending: children = reversed(children) accumulator = self._visit(children, function, accumulator, sort_key) return accumulator class ColumnSortKey(interfaces.renderers.ColumnSortKey): def __init__(self, treegrid: TreeGrid, column_name: str, ascending: bool = True) -> None: _index = None self._type = None self.ascending = ascending for i in range(len(treegrid.columns)): column = treegrid.columns[i] if column.name.lower() == column_name.lower(): _index = i self._type = column.type if _index is None: raise ValueError("Column not found in TreeGrid columns: {}".format(column_name)) self._index = _index def __call__(self, values: List[Any]) -> Any: """The key function passed as the sort key.""" value = values[self._index] if isinstance(value, interfaces.renderers.BaseAbsentValue): if self._type == datetime.datetime: value = datetime.datetime.min elif self._type in [int, float]: value = -1 elif self._type == bool: value = False elif self._type in [str, renderers.Disassembly]: value = "-" elif self._type == bytes: value = b"" return value volatility3-1.0.1/volatility3/framework/renderers/conversion.py000066400000000000000000000076041405267600400250170ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import datetime import ipaddress import socket import struct from typing import Union from volatility3.framework import interfaces, renderers def wintime_to_datetime(wintime: int) -> Union[interfaces.renderers.BaseAbsentValue, datetime.datetime]: unix_time = wintime // 10000000 if unix_time == 0: return renderers.NotApplicableValue() unix_time = unix_time - 11644473600 try: return datetime.datetime.utcfromtimestamp(unix_time) # Windows sometimes throws OSErrors rather than ValueErrors when it can't convert a value except (ValueError, OSError): return renderers.UnparsableValue() def unixtime_to_datetime(unixtime: int) -> Union[interfaces.renderers.BaseAbsentValue, datetime.datetime]: ret = renderers.UnparsableValue() # type: Union[interfaces.renderers.BaseAbsentValue, datetime.datetime] if unixtime > 0: try: ret = datetime.datetime.utcfromtimestamp(unixtime) except ValueError: pass return ret def round(addr: int, align: int, up: bool = False) -> int: """Round an address up or down based on an alignment. Args: addr: the address align: the alignment value up: Whether to round up or not Returns: The aligned address """ if addr % align == 0: return addr else: if up: return (addr + (align - (addr % align))) return (addr - (addr % align)) # For vol3 devs: # # convert_ipv4 && convert_ipv6 are slightly modified versions of their # counterparts from vol2: # # https://github.com/volatilityfoundation/volatility/blob/master/volatility/utils.py#L84 # # Furthermore, vol2 used as overlay for ip addresses that made the conversion string based: # # https://github.com/volatilityfoundation/volatility/blob/master/volatility/plugins/overlays/basic.py#L156 # # by using struct.pack with the given format string on data that was then gathered through .v(): # # https://github.com/volatilityfoundation/volatility/blob/aa6b960c1077e447bda9d64df507ec02f8fcc958/volatility/obj.py#L439 # # .v() for IP addresses would do obj_vm.read(), which returned a string, and struct.pack was called on it. # # This doesn't translate very well to vol3, since vol3 does have overlays so the plugins instead are retrieving the raw integers # from memory. That is why convert_ip4 takes a 32 bit integer as its input and convert_ipv6 takes an array of shorts. # This code has only been tested on Mac so far, but since the modified functions cleanly replace evaluation of data that used to # be done by the overlays that plugins for every OS used, then I don't expect issues when vol3 linux and windows plugins use them def convert_ipv4(ip_as_integer): return str(ipaddress.IPv4Address(struct.pack("> 8) | ((port_as_integer & 0xff) << 8) def convert_network_four_tuple(family, four_tuple): """Converts the connection four_tuple: (source ip, source port, dest ip, dest port) into their string equivalents. IP addresses are expected as a tuple of unsigned shorts Ports are converted to proper endianess as well """ if family == socket.AF_INET: ret = (convert_ipv4(four_tuple[0]), convert_port(four_tuple[1]), convert_ipv4(four_tuple[2]), convert_port(four_tuple[3])) elif family == socket.AF_INET6: ret = (convert_ipv6(four_tuple[0]), convert_port(four_tuple[1]), convert_ipv6(four_tuple[2]), convert_port(four_tuple[3])) else: ret = None return ret volatility3-1.0.1/volatility3/framework/renderers/format_hints.py000066400000000000000000000041631405267600400253240ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """The official list of format hints that text renderers and plugins can rely upon existing within the framework. These hints allow a plugin to indicate how they would like data from a particular column to be represented. Text renderers should attempt to honour all hints provided in this module where possible """ from typing import Type class Bin(int): """A class to indicate that the integer value should be represented as a binary value.""" class Hex(int): """A class to indicate that the integer value should be represented as a hexidecimal value.""" class HexBytes(bytes): """A class to indicate that the bytes should be display in an extended format showing hexadecimal and ascii printable display.""" class MultiTypeData(bytes): """The contents are supposed to be a string, but may contain binary data.""" def __new__(cls: Type['MultiTypeData'], original: int, encoding: str = 'utf-16-le', split_nulls: bool = False, show_hex: bool = False) -> 'MultiTypeData': if isinstance(original, int): original = str(original).encode(encoding) return super().__new__(cls, original) def __init__(self, original: bytes, encoding: str = 'utf-16-le', split_nulls: bool = False, show_hex: bool = False) -> None: self.converted_int = False # type: bool if isinstance(original, int): self.converted_int = True self.encoding = encoding self.split_nulls = split_nulls self.show_hex = show_hex bytes.__init__(original) def __eq__(self, other): return super(self) == super(other) and \ self.converted_int == other.converted_int and \ self.encoding == other.encoding and \ self.split_nulls == other.split_nulls and \ self.show_hex == other.show_hex volatility3-1.0.1/volatility3/framework/symbols/000077500000000000000000000000001405267600400217505ustar00rootroot00000000000000volatility3-1.0.1/volatility3/framework/symbols/__init__.py000066400000000000000000000274501405267600400240710ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import collections import collections.abc import enum import logging from typing import Any, Dict, Iterable, Iterator, TypeVar, List from volatility3.framework import constants, exceptions, interfaces, objects vollog = logging.getLogger(__name__) SymbolSpaceReturnType = TypeVar("SymbolSpaceReturnType", interfaces.objects.Template, interfaces.symbols.SymbolInterface, Dict[str, Any]) class SymbolType(enum.Enum): TYPE = 1 SYMBOL = 2 ENUM = 3 class SymbolSpace(interfaces.symbols.SymbolSpaceInterface): """Handles an ordered collection of SymbolTables. This collection is ordered so that resolution of symbols can proceed down through the ranks if a namespace isn't specified. """ def __init__(self) -> None: super().__init__() self._dict = collections.OrderedDict() # type: Dict[str, interfaces.symbols.BaseSymbolTableInterface] # Permanently cache all resolved symbols self._resolved = {} # type: Dict[str, interfaces.objects.Template] self._resolved_symbols = {} # type: Dict[str, interfaces.objects.Template] def clear_symbol_cache(self, table_name: str = None) -> None: """Clears the symbol cache for the specified table name. If no table name is specified, the caches of all symbol tables are cleared.""" table_list = list() # type: List[interfaces.symbols.BaseSymbolTableInterface] if table_name is None: table_list = list(self._dict.values()) else: table_list.append(self._dict[table_name]) for table in table_list: table.clear_symbol_cache() def free_table_name(self, prefix: str = "layer") -> str: """Returns an unused table name to ensure no collision occurs when inserting a symbol table.""" count = 1 while prefix + str(count) in self: count += 1 return prefix + str(count) ### Symbol functions def get_symbols_by_type(self, type_name: str) -> Iterable[str]: """Returns all symbols based on the type of the symbol.""" for table in self._dict: for symbol_name in self._dict[table].get_symbols_by_type(type_name): yield table + constants.BANG + symbol_name def get_symbols_by_location(self, offset: int, size: int = 0, table_name: str = None) -> Iterable[str]: """Returns all symbols that exist at a specific relative address.""" table_list = self._dict.values() # type: Iterable[interfaces.symbols.BaseSymbolTableInterface] if table_name is not None: if table_name in self._dict: table_list = [self._dict[table_name]] else: table_list = [] for table in table_list: for symbol_name in table.get_symbols_by_location(offset = offset, size = size): yield table.name + constants.BANG + symbol_name ### Space functions def __len__(self) -> int: """Returns the number of tables within the space.""" return len(self._dict) def __getitem__(self, i: str) -> Any: """Returns a specific table from the space.""" return self._dict[i] def __iter__(self) -> Iterator[str]: """Iterates through all available tables in the symbol space.""" return iter(self._dict) def append(self, value: interfaces.symbols.BaseSymbolTableInterface) -> None: """Adds a symbol_list to the end of the space.""" if not isinstance(value, interfaces.symbols.BaseSymbolTableInterface): raise TypeError(value) if value.name in self._dict: self.remove(value.name) self._dict[value.name] = value def remove(self, key: str) -> None: """Removes a named symbol_list from the space.""" # Reset the resolved list, since we're removing some symbols self._resolved = {} del self._dict[key] ### Resolution functions class UnresolvedTemplate(objects.templates.ReferenceTemplate): """Class to highlight when missing symbols are present. This class is identical to a reference template, but differentiable by its classname. It will output a debug log to indicate when it has been instantiated and with what name. This class is designed to be output ONLY as part of the SymbolSpace resolution system. Individual SymbolTables that cannot resolve a symbol should still return a SymbolError to indicate this failure in resolution. """ def __init__(self, type_name: str, **kwargs) -> None: vollog.debug("Unresolved reference: {}".format(type_name)) super().__init__(type_name = type_name, **kwargs) def _weak_resolve(self, resolve_type: SymbolType, name: str) -> SymbolSpaceReturnType: """Takes a symbol name and resolves it with ReferentialTemplates.""" if resolve_type == SymbolType.TYPE: get_function = 'get_type' elif resolve_type == SymbolType.SYMBOL: get_function = 'get_symbol' elif resolve_type == SymbolType.ENUM: get_function = 'get_enumeration' else: raise TypeError("Weak_resolve called without a proper SymbolType") name_array = name.split(constants.BANG) if len(name_array) == 2: table_name = name_array[0] component_name = name_array[1] try: return getattr(self._dict[table_name], get_function)(component_name) except KeyError as e: raise exceptions.SymbolError(component_name, table_name, 'Type {} references missing Type/Symbol/Enum: {}'.format(name, e)) raise exceptions.SymbolError(name, None, "Malformed name: {}".format(name)) def _iterative_resolve(self, traverse_list): """Iteratively resolves a type, populating linked child ReferenceTemplates with their properly resolved counterparts.""" replacements = set() # Whole Symbols that still need traversing while traverse_list: template_traverse_list, traverse_list = [self._resolved[traverse_list[0]]], traverse_list[1:] # Traverse a single symbol looking for any ReferenceTemplate objects while template_traverse_list: traverser, template_traverse_list = template_traverse_list[0], template_traverse_list[1:] for child in traverser.children: if isinstance(child, objects.templates.ReferenceTemplate): # If we haven't seen it before, subresolve it and also add it # to the "symbols that still need traversing" list if child.vol.type_name not in self._resolved: traverse_list.append(child.vol.type_name) try: self._resolved[child.vol.type_name] = self._weak_resolve( SymbolType.TYPE, child.vol.type_name) except exceptions.SymbolError: self._resolved[child.vol.type_name] = self.UnresolvedTemplate(child.vol.type_name) # Stash the replacement replacements.add((traverser, child)) elif child.children: template_traverse_list.append(child) for (parent, child) in replacements: parent.replace_child(child, self._resolved[child.vol.type_name]) def get_type(self, type_name: str) -> interfaces.objects.Template: """Takes a symbol name and resolves it. This method ensures that all referenced templates (including self-referential templates) are satisfied as ObjectTemplates """ # Traverse down any resolutions if type_name not in self._resolved: self._resolved[type_name] = self._weak_resolve(SymbolType.TYPE, type_name) # type: ignore self._iterative_resolve([type_name]) if isinstance(self._resolved[type_name], objects.templates.ReferenceTemplate): table_name = None index = type_name.find(constants.BANG) if index > 0: table_name, type_name = type_name[:index], type_name[index + 1:] raise exceptions.SymbolError(type_name, table_name, "Unresolvable symbol requested: {}".format(type_name)) return self._resolved[type_name] def get_symbol(self, symbol_name: str) -> interfaces.symbols.SymbolInterface: """Look-up a symbol name across all the contained symbol spaces.""" retval = self._weak_resolve(SymbolType.SYMBOL, symbol_name) if symbol_name not in self._resolved_symbols and retval.type is not None: self._resolved_symbols[symbol_name] = self._subresolve(retval.type) if not isinstance(retval, interfaces.symbols.SymbolInterface): table_name = None index = symbol_name.find(constants.BANG) if index > 0: table_name, symbol_name = symbol_name[:index], symbol_name[index + 1:] raise exceptions.SymbolError(symbol_name, table_name, "Unresolvable Symbol: {}".format(symbol_name)) return retval def _subresolve(self, object_template: interfaces.objects.Template) -> interfaces.objects.Template: """Ensure an ObjectTemplate doesn't contain any ReferenceTemplates""" for child in object_template.children: if isinstance(child, objects.templates.ReferenceTemplate): new_child = self.get_type(child.vol.type_name) else: new_child = self._subresolve(child) object_template.replace_child(old_child = child, new_child = new_child) return object_template def get_enumeration(self, enum_name: str) -> interfaces.objects.Template: """Look-up a set of enumeration choices from a specific symbol table.""" retval = self._weak_resolve(SymbolType.ENUM, enum_name) if not isinstance(retval, interfaces.objects.Template): table_name = None index = enum_name.find(constants.BANG) if index > 0: table_name, enum_name = enum_name[:index], enum_name[index + 1:] raise exceptions.SymbolError(enum_name, table_name, "Unresolvable Enumeration: {}".format(enum_name)) return retval def _membership(self, member_type: SymbolType, name: str) -> bool: """Test for membership of a component within a table.""" name_array = name.split(constants.BANG) if len(name_array) == 2: table_name = name_array[0] component_name = name_array[1] else: return False if table_name not in self: return False table = self[table_name] if member_type == SymbolType.TYPE: return component_name in table.types elif member_type == SymbolType.SYMBOL: return component_name in table.symbols elif member_type == SymbolType.ENUM: return component_name in table.enumerations return False def has_type(self, name: str) -> bool: return self._membership(SymbolType.TYPE, name) def has_symbol(self, name: str) -> bool: return self._membership(SymbolType.SYMBOL, name) def has_enumeration(self, name: str) -> bool: return self._membership(SymbolType.ENUM, name) def symbol_table_is_64bit(context: interfaces.context.ContextInterface, symbol_table_name: str) -> bool: """Returns a boolean as to whether a particular symbol table within a context is 64-bit or not.""" return context.symbol_space.get_type(symbol_table_name + constants.BANG + "pointer").size == 8 volatility3-1.0.1/volatility3/framework/symbols/generic/000077500000000000000000000000001405267600400233645ustar00rootroot00000000000000volatility3-1.0.1/volatility3/framework/symbols/generic/__init__.py000066400000000000000000000045331405267600400255020ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import random import string from typing import Union from volatility3.framework import objects, interfaces class GenericIntelProcess(objects.StructType): def _add_process_layer(self, context: interfaces.context.ContextInterface, dtb: Union[int, interfaces.objects.ObjectInterface], config_prefix: str = None, preferred_name: str = None) -> str: """Constructs a new layer based on the process's DirectoryTableBase.""" if config_prefix is None: # TODO: Ensure collisions can't happen by verifying the config_prefix is empty random_prefix = ''.join(random.SystemRandom().choice(string.ascii_uppercase + string.digits) for _ in range(8)) config_prefix = interfaces.configuration.path_join("temporary", "_" + random_prefix) # Figure out a suitable name we can use for the new layer if preferred_name is None: preferred_name = context.layers.free_layer_name(prefix = self.vol.layer_name + "_Process") else: if preferred_name in context.layers: preferred_name = context.layers.free_layer_name(prefix = preferred_name) # Copy the parent's config and then make suitable changes parent_layer = context.layers[self.vol.layer_name] parent_config = parent_layer.build_configuration() # It's an intel layer, because we hardwire the "memory_layer" config option # FIXME: this could be for other architectures if we don't hardwire this/these values parent_config['memory_layer'] = parent_layer.config['memory_layer'] parent_config['page_map_offset'] = dtb # Set the new configuration and construct the layer config_path = interfaces.configuration.path_join(config_prefix, preferred_name) context.config.splice(config_path, parent_config) new_layer = parent_layer.__class__(context, config_path = config_path, name = preferred_name) # Add the constructed layer and return the name context.layers.add_layer(new_layer) return preferred_name volatility3-1.0.1/volatility3/framework/symbols/generic/qemu.json000066400000000000000000000036561405267600400252400ustar00rootroot00000000000000{ "symbols": { }, "user_types": { "qevm_header": { "fields": { "magic": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "version": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "struct", "size": 8 }, "qevm_htab": { "fields": { "index": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "n_valid": { "offset": 4, "type": { "kind": "base", "name": "unsigned short" } }, "n_invalid": { "offset": 6, "type": { "kind": "base", "name": "unsigned short" } } }, "kind": "struct", "size": 8 } }, "enums": { }, "base_types": { "unsigned char": { "endian": "big", "kind": "char", "signed": false, "size": 1 }, "unsigned short": { "endian": "big", "kind": "int", "signed": false, "size": 2 }, "long": { "endian": "big", "kind": "int", "signed": true, "size": 4 }, "char": { "endian": "big", "kind": "char", "signed": true, "size": 1 }, "unsigned long": { "endian": "big", "kind": "int", "signed": false, "size": 4 }, "long long": { "endian": "big", "kind": "int", "signed": true, "size": 8 }, "unsigned long long": { "endian": "big", "kind": "int", "signed": false, "size": 8 } }, "metadata": { "producer": { "version": "0.0.1", "name": "ikelos-by-hand", "datetime": "2020-01-07T22:59:47" }, "format": "6.1.0" } } volatility3-1.0.1/volatility3/framework/symbols/intermed.py000066400000000000000000001035221405267600400241340ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import base64 import codecs import copy import json import logging import os import pathlib import zipfile from abc import ABCMeta from typing import Any, Dict, Generator, Iterable, List, Optional, Type, Tuple, Mapping from volatility3.framework.layers import resources from volatility3 import schemas, symbols from volatility3.framework import class_subclasses, constants, exceptions, interfaces, objects from volatility3.framework.configuration import requirements from volatility3.framework.symbols import native, metadata vollog = logging.getLogger(__name__) # ## TODO # # All symbol tables should take a label to an object template # # Templates for subtypes etc should be looked up recursively just like anything else # We therefore need a way to unroll rolled-up types # Generate mangled names on the fly (prohibits external calling) # # Symbol list could be a dict with knowledge of its parent? # Class split is arbitrary, it's an extension for developers # Object template should contain both class and initial parameters # # # *** Resolution should not happen in the resolve function # It should only happen on access of contained types *** # # Recursive objects can be fixed by having caching the objects # (however, they have to be built first!) # # Single hop resolution is probably the solution # Could probably deal with it by having a property that caches # for container types # def _construct_delegate_function(name: str, is_property: bool = False) -> Any: def _delegate_function(self, *args, **kwargs): if is_property: return getattr(self._delegate, name) return getattr(self._delegate, name)(*args, **kwargs) if is_property: return property(_delegate_function) return _delegate_function class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): """The IntermediateSymbolTable class reads a JSON file and conducts common tasks such as validation, construction by looking up a JSON file from the available files and ensuring the appropriate version of the schema and proxy are chosen. The JSON format itself is made up of various groups (symbols, user_types, base_types, enums and metadata) * Symbols link a name to a particular offset relative to the start of a section of memory * Base types define the simplest primitive data types, these can make more complex structure * User types define the more complex types by specifying members at a relative offset from the start of the type * Enums can specify a list of names and values and a type inside which the numeric encoding will fit * Metadata defines information about the originating file These are documented in JSONSchema JSON files located in volatility3/schemas. """ def __init__(self, context: interfaces.context.ContextInterface, config_path: str, name: str, isf_url: str, native_types: interfaces.symbols.NativeTableInterface = None, table_mapping: Optional[Dict[str, str]] = None, validate: bool = True, class_types: Optional[Mapping[str, Type[interfaces.objects.ObjectInterface]]] = None, symbol_shift: int = 0, symbol_mask: int = 0) -> None: """Instantiates a SymbolTable based on an IntermediateSymbolFormat JSON file. This is validated against the appropriate schema. The validation can be disabled by passing validate = False, but this should almost never be done. Args: context: The volatility context for the symbol table config_path: The configuration path for the symbol table name: The name for the symbol table (this is used in symbols e.g. table!symbol ) isf_url: The URL pointing to the ISF file location native_types: The NativeSymbolTable that contains the native types for this symbol table table_mapping: A dictionary linking names referenced in the file with symbol tables in the context validate: Determines whether the ISF file will be validated against the appropriate schema class_types: A dictionary of type names and classes that override StructType when they are instantiated symbol_shift: An offset by which to alter all returned symbols for this table symbol_mask: An address mask used for all returned symbol offsets from this table (a mask of 0 disables masking) """ # Check there are no obvious errors # Open the file and test the version self._versions = dict([(x.version, x) for x in class_subclasses(ISFormatTable)]) fp = resources.ResourceAccessor().open(isf_url) reader = codecs.getreader("utf-8") json_object = json.load(reader(fp)) # type: ignore fp.close() # Validation is expensive, but we cache to store the hashes of successfully validated json objects if validate and not schemas.validate(json_object): raise exceptions.SymbolSpaceError("File does not pass version validation: {}".format(isf_url)) metadata = json_object.get('metadata', None) # Determine the delegate or throw an exception self._delegate = self._closest_version(metadata.get('format', "0.0.0"), self._versions)(context, config_path, name, json_object, native_types, table_mapping) if self._delegate.version < constants.ISF_MINIMUM_SUPPORTED: raise RuntimeError("ISF version {} is no longer supported: {}".format(metadata.get('format', "0.0.0"), isf_url)) elif self._delegate.version < constants.ISF_MINIMUM_DEPRECATED: vollog.warning("ISF version {} has been deprecated: {}".format(metadata.get('format', "0.0.0"), isf_url)) # Inherit super().__init__(context, config_path, name, native_types or self._delegate.natives, table_mapping = table_mapping, class_types = class_types) # Since we've been created with parameters, ensure our config is populated likewise self.config['isf_url'] = isf_url self.config['symbol_shift'] = symbol_shift self.config['symbol_mask'] = symbol_mask @staticmethod def _closest_version(version: str, versions: Dict[Tuple[int, int, int], Type['ISFormatTable']]) \ -> Type['ISFormatTable']: """Determines the highest suitable handler for specified version format. An interface version such as Major.Minor.Patch means that Major of the provider must be equal to that of the consumer, and the provider (the JSON in this instance) must have a greater minor (indicating that only additive changes have been made) than the consumer (in this case, the file reader). """ major, minor, patch = [int(x) for x in version.split(".")] supported_versions = [x for x in versions if x[0] == major and x[1] >= minor] if not supported_versions: raise ValueError( "No Intermediate Format interface versions support file interface version: {}".format(version)) return versions[max(supported_versions)] symbols = _construct_delegate_function('symbols', True) types = _construct_delegate_function('types', True) enumerations = _construct_delegate_function('enumerations', True) metadata = _construct_delegate_function('metadata', True) clear_symbol_cache = _construct_delegate_function('clear_symbol_cache') get_type = _construct_delegate_function('get_type') get_symbol = _construct_delegate_function('get_symbol') get_enumeration = _construct_delegate_function('get_enumeration') get_type_class = _construct_delegate_function('get_type_class') set_type_class = _construct_delegate_function('set_type_class') del_type_class = _construct_delegate_function('del_type_class') @classmethod def file_symbol_url(cls, sub_path: str, filename: Optional[str] = None) -> Generator[str, None, None]: """Returns an iterator of appropriate file-scheme symbol URLs that can be opened by a ResourceAccessor class. Filter reduces the number of results returned to only those URLs containing that string """ # Check user-modifiable files first, then compressed ones extensions = constants.ISF_EXTENSIONS if filename is None: filename = "*" zip_match = filename else: # For zipfiles, the path separator is always "/", so we need to change the path zip_match = "/".join(os.path.split(filename)) # Check user symbol directory first, then fallback to the framework's library to allow for overloading vollog.log(constants.LOGLEVEL_VVVV, "Searching for symbols in {}".format(", ".join(symbols.__path__))) for path in symbols.__path__: if not os.path.isabs(path): path = os.path.abspath(os.path.join(__file__, path)) for extension in extensions: # Hopefully these will not be large lists, otherwise this might be slow try: for found in pathlib.Path(path).joinpath(sub_path).resolve().rglob(filename + extension): yield found.as_uri() except FileNotFoundError: # If there's no linux symbols, don't cry about it pass # Finally try looking in zip files zip_path = os.path.join(path, sub_path + ".zip") if os.path.exists(zip_path): # We have a zipfile, so run through it and look for sub files that match the filename with zipfile.ZipFile(zip_path) as zfile: for name in zfile.namelist(): for extension in extensions: # By ending with an extension (and therefore, not /), we should not return any directories if name.endswith(zip_match + extension) or (zip_match == "*" and name.endswith(extension)): yield "jar:file:" + str(pathlib.Path(zip_path)) + "!" + name @classmethod def create(cls, context: interfaces.context.ContextInterface, config_path: str, sub_path: str, filename: str, native_types: Optional[interfaces.symbols.NativeTableInterface] = None, table_mapping: Optional[Dict[str, str]] = None, class_types: Optional[Mapping[str, Type[interfaces.objects.ObjectInterface]]] = None, symbol_shift: int = 0, symbol_mask: int = 0) -> str: """Takes a context and loads an intermediate symbol table based on a filename. Args: context: The context that the current plugin is being run within config_path: The configuration path for reading/storing configuration information this symbol table may use sub_path: The path under a suitable symbol path (defaults to volatility3/symbols and volatility3/framework/symbols) to check filename: Basename of the file to find under the sub_path native_types: Set of native types, defaults to native types read from the intermediate symbol format file table_mapping: a dictionary of table names mentioned within the ISF file, and the tables within the context which they map to symbol_shift: An offset by which to alter all returned symbols for this table symbol_mask: An address mask used for all returned symbol offsets from this table (a mask of 0 disables masking) Returns: the name of the added symbol table """ urls = list(cls.file_symbol_url(sub_path, filename)) if not urls: raise FileNotFoundError("No symbol files found at provided filename: {}", filename) table_name = context.symbol_space.free_table_name(filename) table = cls(context = context, config_path = config_path, name = table_name, isf_url = urls[0], native_types = native_types, table_mapping = table_mapping, class_types = class_types, symbol_shift = symbol_shift, symbol_mask = symbol_mask) context.symbol_space.append(table) return table_name @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return super().get_requirements() + [ requirements.StringRequirement( "isf_url", description = "JSON file containing the symbols encoded in the Intermediate Symbol Format"), ] class ISFormatTable(interfaces.symbols.SymbolTableInterface, metaclass = ABCMeta): """Provide a base class to identify all subclasses.""" version = (0, 0, 0) def __init__(self, context: interfaces.context.ContextInterface, config_path: str, name: str, json_object: Any, native_types: interfaces.symbols.NativeTableInterface = None, table_mapping: Optional[Dict[str, str]] = None) -> None: self._json_object = json_object self._validate_json() self.name = name nt = native_types or self._get_natives() if nt is None: raise TypeError("Native table not provided") nt.name = name + "_natives" super().__init__(context, config_path, name, nt, table_mapping = table_mapping) self._overrides = {} # type: Dict[str, Type[interfaces.objects.ObjectInterface]] self._symbol_cache = {} # type: Dict[str, interfaces.symbols.SymbolInterface] def _get_natives(self) -> Optional[interfaces.symbols.NativeTableInterface]: """Determines the appropriate native_types to use from the JSON data.""" # TODO: Consider how to generate the natives entirely from the ISF classes = {"x64": native.x64NativeTable, "x86": native.x86NativeTable} for nc in sorted(classes): native_class = classes[nc] for base_type in self._json_object['base_types']: try: if self._json_object['base_types'][base_type]['length'] != native_class.get_type(base_type).size: break except TypeError: # TODO: determine whether we should give voids a size - We don't give voids a length, whereas microsoft seemingly do pass else: vollog.debug("Choosing appropriate natives for symbol library: {}".format(nc)) return native_class.natives return None # TODO: Check the format and make use of the other metadata def _validate_json(self) -> None: if ('user_types' not in self._json_object or 'base_types' not in self._json_object or 'metadata' not in self._json_object or 'symbols' not in self._json_object or 'enums' not in self._json_object): raise exceptions.SymbolSpaceError("Malformed JSON file provided") @property def metadata(self) -> Optional[interfaces.symbols.MetadataInterface]: """Returns a metadata object containing information about the symbol table.""" return None def clear_symbol_cache(self) -> None: """Clears the symbol cache of the symbol table.""" self._symbol_cache.clear() class Version1Format(ISFormatTable): """Class for storing intermediate debugging data as objects and classes.""" version = (0, 0, 1) def get_symbol(self, name: str) -> interfaces.symbols.SymbolInterface: """Returns the location offset given by the symbol name.""" # TODO: Add the ability to add/remove/change symbols after creation # note that this should invalidate/update the cache if self._symbol_cache.get(name, None): return self._symbol_cache[name] symbol = self._json_object['symbols'].get(name, None) if not symbol: raise exceptions.SymbolError(name, self.name, "Unknown symbol: {}".format(name)) address = symbol['address'] + self.config.get('symbol_shift', 0) if self.config.get('symbol_mask', 0): address = address & self.config['symbol_mask'] self._symbol_cache[name] = interfaces.symbols.SymbolInterface(name = name, address = address) return self._symbol_cache[name] @property def symbols(self) -> Iterable[str]: """Returns an iterator of the symbol names.""" return list(self._json_object.get('symbols', {})) @property def enumerations(self) -> Iterable[str]: """Returns an iterator of the available enumerations.""" return list(self._json_object.get('enums', {})) @property def types(self) -> Iterable[str]: """Returns an iterator of the symbol type names.""" return list(self._json_object.get('user_types', {})) + list(self.natives.types) def get_type_class(self, name: str) -> Type[interfaces.objects.ObjectInterface]: return self._overrides.get(name, objects.AggregateType) def set_type_class(self, name: str, clazz: Type[interfaces.objects.ObjectInterface]) -> None: if name not in self.types: raise ValueError("Symbol type not in {} SymbolTable: {}".format(self.name, name)) self._overrides[name] = clazz def del_type_class(self, name: str) -> None: if name in self._overrides: del self._overrides[name] def _interdict_to_template(self, dictionary: Dict[str, Any]) -> interfaces.objects.Template: """Converts an intermediate format dict into an object template.""" if not dictionary: raise exceptions.SymbolSpaceError("Invalid intermediate dictionary: {}".format(dictionary)) type_name = dictionary['kind'] if type_name == 'base': type_name = dictionary['name'] if type_name in self.natives.types: # The symbol is a native type native_template = self.natives.get_type(self.name + constants.BANG + type_name) # Add specific additional parameters, etc update = {} if type_name == 'array': update['count'] = dictionary['count'] update['subtype'] = self._interdict_to_template(dictionary['subtype']) elif type_name == 'pointer': if dictionary.get('base', None): base_type = self.natives.get_type(self.name + constants.BANG + dictionary['base']) update['data_format'] = base_type.vol['data_format'] update['subtype'] = self._interdict_to_template(dictionary['subtype']) elif type_name == 'enum': update = self._lookup_enum(dictionary['name']) elif type_name == 'bitfield': update = { 'start_bit': dictionary['bit_position'], 'end_bit': dictionary['bit_position'] + dictionary['bit_length'] } update['base_type'] = self._interdict_to_template(dictionary['type']) # We do *not* call native_template.clone(), since it slows everything down a lot # We require that the native.get_type method always returns a newly constructed python object native_template.update_vol(**update) return native_template # Otherwise if dictionary['kind'] not in objects.AggregateTypes.values(): raise exceptions.SymbolSpaceError("Unknown Intermediate format: {}".format(dictionary)) reference_name = dictionary['name'] if constants.BANG not in reference_name: reference_name = self.name + constants.BANG + reference_name else: reference_parts = reference_name.split(constants.BANG) reference_name = (self.table_mapping.get(reference_parts[0], reference_parts[0]) + constants.BANG + constants.BANG.join(reference_parts[1:])) return objects.templates.ReferenceTemplate(type_name = reference_name) def _lookup_enum(self, name: str) -> Dict[str, Any]: """Looks up an enumeration and returns a dictionary of __init__ parameters for an Enum.""" lookup = self._json_object['enums'].get(name, None) if not lookup: raise exceptions.SymbolSpaceError("Unknown enumeration: {}".format(name)) result = {"choices": copy.deepcopy(lookup['constants']), "base_type": self.natives.get_type(lookup['base'])} return result def get_enumeration(self, enum_name: str) -> interfaces.objects.Template: """Resolves an individual enumeration.""" if constants.BANG in enum_name: raise exceptions.SymbolError(enum_name, self.name, "Enumeration for a different table requested: {}".format(enum_name)) if enum_name not in self._json_object['enums']: # Fall back to the natives table raise exceptions.SymbolError(enum_name, self.name, "Enumeration not found in {} table: {}".format(self.name, enum_name)) curdict = self._json_object['enums'][enum_name] base_type = self.natives.get_type(curdict['base']) # The size isn't actually used, the base-type defines it. return objects.templates.ObjectTemplate(type_name = self.name + constants.BANG + enum_name, object_class = objects.Enumeration, base_type = base_type, choices = curdict['constants']) def get_type(self, type_name: str) -> interfaces.objects.Template: """Resolves an individual symbol.""" if constants.BANG in type_name: index = type_name.find(constants.BANG) table_name, type_name = type_name[:index], type_name[index + 1:] raise exceptions.SymbolError( type_name, table_name, "Symbol for a different table requested: {}".format(table_name + constants.BANG + type_name)) if type_name not in self._json_object['user_types']: # Fall back to the natives table return self.natives.get_type(self.name + constants.BANG + type_name) curdict = self._json_object['user_types'][type_name] members = {} for member_name in curdict['fields']: interdict = curdict['fields'][member_name] member = (interdict['offset'], self._interdict_to_template(interdict['type'])) members[member_name] = member object_class = self.get_type_class(type_name) if object_class == objects.AggregateType: for clazz in objects.AggregateTypes: if objects.AggregateTypes[clazz] == curdict['kind']: object_class = clazz return objects.templates.ObjectTemplate(type_name = self.name + constants.BANG + type_name, object_class = object_class, size = curdict['length'], members = members) class Version2Format(Version1Format): """Class for storing intermediate debugging data as objects and classes.""" version = (2, 0, 0) def _get_natives(self) -> Optional[interfaces.symbols.NativeTableInterface]: """Determines the appropriate native_types to use from the JSON data.""" classes = {"x64": native.x64NativeTable, "x86": native.x86NativeTable} for nc in sorted(classes): native_class = classes[nc] for base_type in self._json_object['base_types']: try: if self._json_object['base_types'][base_type]['size'] != native_class.get_type(base_type).size: break except TypeError: # TODO: determine whether we should give voids a size - We don't give voids a length, whereas microsoft seemingly do pass else: vollog.debug("Choosing appropriate natives for symbol library: {}".format(nc)) return native_class.natives return None def get_type(self, type_name: str) -> interfaces.objects.Template: """Resolves an individual symbol.""" if constants.BANG in type_name: index = type_name.find(constants.BANG) table_name, type_name = type_name[:index], type_name[index + 1:] raise exceptions.SymbolError( type_name, table_name, "Symbol for a different table requested: {}".format(table_name + constants.BANG + type_name)) if type_name not in self._json_object['user_types']: # Fall back to the natives table if type_name in self.natives.types: return self.natives.get_type(self.name + constants.BANG + type_name) else: raise exceptions.SymbolError(type_name, self.name, "Unknown symbol: {}".format(type_name)) curdict = self._json_object['user_types'][type_name] members = {} for member_name in curdict['fields']: interdict = curdict['fields'][member_name] member = (interdict['offset'], self._interdict_to_template(interdict['type'])) members[member_name] = member object_class = self.get_type_class(type_name) if object_class == objects.AggregateType: for clazz in objects.AggregateTypes: if objects.AggregateTypes[clazz] == curdict['kind']: object_class = clazz return objects.templates.ObjectTemplate(type_name = self.name + constants.BANG + type_name, object_class = object_class, size = curdict['size'], members = members) class Version3Format(Version2Format): """Class for storing intermediate debugging data as objects and classes.""" version = (2, 1, 0) def get_symbol(self, name: str) -> interfaces.symbols.SymbolInterface: """Returns the symbol given by the symbol name.""" if self._symbol_cache.get(name, None): return self._symbol_cache[name] symbol = self._json_object['symbols'].get(name, None) if not symbol: raise exceptions.SymbolError(name, self.name, "Unknown symbol: {}".format(name)) symbol_type = None if 'type' in symbol: symbol_type = self._interdict_to_template(symbol['type']) # Mask the addresses if necessary address = symbol['address'] + self.config.get('symbol_shift', 0) if self.config.get('symbol_mask', 0): address = address & self.config['symbol_mask'] self._symbol_cache[name] = interfaces.symbols.SymbolInterface(name = name, address = address, type = symbol_type) return self._symbol_cache[name] class Version4Format(Version3Format): """Class for storing intermediate debugging data as objects and classes.""" version = (4, 0, 0) format_mapping = { 'int': objects.Integer, 'float': objects.Float, 'void': objects.Integer, 'bool': objects.Boolean, 'char': objects.Char } def _get_natives(self) -> Optional[interfaces.symbols.NativeTableInterface]: """Determines the appropriate native_types to use from the JSON data.""" native_dict = {} base_types = self._json_object['base_types'] for base_type in base_types: # Void are ignored because voids are not a volatility primitive, they are a specific Volatility object if base_type != 'void': current = base_types[base_type] # TODO: Fix up the typing of this, it bugs out because of the tuple assignment if current['kind'] not in self.format_mapping: raise ValueError("Unsupported base kind") format_val = (current['size'], current['endian'], current['signed']) object_type = self.format_mapping[current['kind']] if base_type == 'pointer': object_type = objects.Pointer native_dict[base_type] = (object_type, format_val) return native.NativeTable(name = "native", native_dictionary = native_dict) class Version5Format(Version4Format): """Class for storing intermediate debugging data as objects and classes.""" version = (4, 1, 0) def get_symbol(self, name: str) -> interfaces.symbols.SymbolInterface: """Returns the symbol given by the symbol name.""" if self._symbol_cache.get(name, None): return self._symbol_cache[name] symbol = self._json_object['symbols'].get(name, None) if not symbol: raise exceptions.SymbolError(name, self.name, "Unknown symbol: {}".format(name)) symbol_type = None if 'type' in symbol: symbol_type = self._interdict_to_template(symbol['type']) symbol_constant_data = None if 'constant_data' in symbol: symbol_constant_data = base64.b64decode(symbol.get('constant_data')) # Mask the addresses if necessary address = symbol['address'] + self.config.get('symbol_shift', 0) if self.config.get('symbol_mask', 0): address = address & self.config['symbol_mask'] self._symbol_cache[name] = interfaces.symbols.SymbolInterface(name = name, address = address, type = symbol_type, constant_data = symbol_constant_data) return self._symbol_cache[name] class Version6Format(Version5Format): """Class for storing intermediate debugging data as objects and classes.""" version = (6, 0, 0) @property def metadata(self) -> Optional[interfaces.symbols.MetadataInterface]: """Returns a MetadataInterface object.""" if self._json_object.get('metadata', {}).get('windows'): return metadata.WindowsMetadata(self._json_object['metadata']['windows']) if self._json_object.get('metadata', {}).get('linux'): return metadata.LinuxMetadata(self._json_object['metadata']['linux']) return None class Version7Format(Version6Format): """Class for storing intermediate debugging data as objects and classes.""" version = (6, 1, 0) class Version8Format(Version7Format): """Class for storing intermediate debugging data as objects and classes.""" version = (6, 2, 0) def _process_fields(self, fields: Dict[str, Dict[str, Any]]) -> Dict[Any, Tuple[int, interfaces.objects.Template]]: """For each type field, it walks its tree of subtypes, reducing the hierarchy to just one level. It creates a tuple of offset and object templates for each field. """ members = {} for new_offset, member_name, member_value in self._reduce_fields(fields): member = (new_offset, self._interdict_to_template(member_value['type'])) members[member_name] = member return members def _reduce_fields(self, fields: Dict[str, Dict[str, Any]], parent_offset: int = 0) -> Generator[Tuple[int, str, Dict], None, None]: """Reduce the fields bringing them one level up. It supports anonymous types such as structs or unions in any level of depth.""" for member_name, member_value in fields.items(): new_offset = parent_offset + member_value.get('offset', 0) if member_value.get('anonymous', False) and isinstance(member_value, dict): # Gets the subtype from the json ISF and recursively reduce its fields subtype = self._json_object['user_types'].get(member_value['type']['name'], {}) yield from self._reduce_fields(subtype['fields'], new_offset) else: yield new_offset, member_name, member_value def get_type(self, type_name: str) -> interfaces.objects.Template: """Resolves an individual symbol.""" index = type_name.find(constants.BANG) if index != -1: table_name, type_name = type_name[:index], type_name[index + 1:] raise exceptions.SymbolError( type_name, table_name, "Symbol for a different table requested: {}".format(table_name + constants.BANG + type_name)) type_definition = self._json_object['user_types'].get(type_name) if type_definition is None: # Fall back to the natives table return self.natives.get_type(self.name + constants.BANG + type_name) members = self._process_fields(type_definition['fields']) object_class = self.get_type_class(type_name) if object_class == objects.AggregateType: for clazz in objects.AggregateTypes: if objects.AggregateTypes[clazz] == type_definition['kind']: object_class = clazz return objects.templates.ObjectTemplate(type_name = self.name + constants.BANG + type_name, object_class = object_class, size = type_definition['size'], members = members) volatility3-1.0.1/volatility3/framework/symbols/linux/000077500000000000000000000000001405267600400231075ustar00rootroot00000000000000volatility3-1.0.1/volatility3/framework/symbols/linux/__init__.py000066400000000000000000000223711405267600400252250ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from typing import List, Tuple, Iterator from volatility3.framework import exceptions, constants, interfaces, objects, contexts from volatility3.framework.objects import utility from volatility3.framework.symbols import intermed from volatility3.framework.symbols.linux import extensions from volatility3.framework.objects import utility class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): provides = {"type": "interface"} def __init__(self, *args, **kwargs) -> None: super().__init__(*args, **kwargs) # Set-up Linux specific types self.set_type_class('file', extensions.struct_file) self.set_type_class('list_head', extensions.list_head) self.set_type_class('mm_struct', extensions.mm_struct) self.set_type_class('super_block', extensions.super_block) self.set_type_class('task_struct', extensions.task_struct) self.set_type_class('vm_area_struct', extensions.vm_area_struct) self.set_type_class('qstr', extensions.qstr) self.set_type_class('dentry', extensions.dentry) self.set_type_class('fs_struct', extensions.fs_struct) self.set_type_class('files_struct', extensions.files_struct) self.set_type_class('vfsmount', extensions.vfsmount) self.set_type_class('kobject', extensions.kobject) if 'module' in self.types: self.set_type_class('module', extensions.module) if 'mount' in self.types: self.set_type_class('mount', extensions.mount) class LinuxUtilities(interfaces.configuration.VersionableInterface): """Class with multiple useful linux functions.""" _version = (1, 0, 0) # based on __d_path from the Linux kernel @classmethod def _do_get_path(cls, rdentry, rmnt, dentry, vfsmnt) -> str: ret_path = [] # type: List[str] while dentry != rdentry or vfsmnt != rmnt: dname = dentry.path() if dname == "": break ret_path.insert(0, dname.strip('/')) if dentry == vfsmnt.get_mnt_root() or dentry == dentry.d_parent: if vfsmnt.get_mnt_parent() == vfsmnt: break dentry = vfsmnt.get_mnt_mountpoint() vfsmnt = vfsmnt.get_mnt_parent() continue parent = dentry.d_parent dentry = parent # if we did not gather any valid dentrys in the path, then the entire file is # either 1) smeared out of memory or 2) de-allocated and corresponding structures overwritten # we return an empty string in this case to avoid confusion with something like a handle to the root # directory (e.g., "/") if not ret_path: return "" ret_val = '/'.join([str(p) for p in ret_path if p != ""]) if ret_val.startswith(("socket:", "pipe:")): if ret_val.find("]") == -1: try: inode = dentry.d_inode ino = inode.i_ino except exceptions.InvalidAddressException: ino = 0 ret_val = ret_val[:-1] + ":[{0}]".format(ino) else: ret_val = ret_val.replace("/", "") elif ret_val != "inotify": ret_val = '/' + ret_val return ret_val # method used by 'older' kernels # TODO: lookup when dentry_operations->d_name was merged into the mainline kernel for exact version @classmethod def _get_path_file(cls, task, filp) -> str: rdentry = task.fs.get_root_dentry() rmnt = task.fs.get_root_mnt() dentry = filp.get_dentry() vfsmnt = filp.get_vfsmnt() return LinuxUtilities._do_get_path(rdentry, rmnt, dentry, vfsmnt) @classmethod def _get_new_sock_pipe_path(cls, context, task, filp) -> str: dentry = filp.get_dentry() sym_addr = dentry.d_op.d_dname symbol_table_arr = sym_addr.vol.type_name.split("!") symbol_table = None if len(symbol_table_arr) == 2: symbol_table = symbol_table_arr[0] symbs = list(context.symbol_space.get_symbols_by_location(sym_addr, table_name = symbol_table)) if len(symbs) == 1: sym = symbs[0].split(constants.BANG)[1] if sym == "sockfs_dname": pre_name = "socket" elif sym == "anon_inodefs_dname": pre_name = "anon_inode" elif sym == "pipefs_dname": pre_name = "pipe" elif sym == "simple_dname": pre_name = cls._get_path_file(task, filp) else: pre_name = "".format(sym) ret = "{0}:[{1:d}]".format(pre_name, dentry.d_inode.i_ino) else: ret = " {0:x}".format(sym_addr) return ret # a 'file' structure doesn't have enough information to properly restore its full path # we need the root mount information from task_struct to determine this @classmethod def path_for_file(cls, context, task, filp) -> str: try: dentry = filp.get_dentry() except exceptions.InvalidAddressException: return "" if dentry == 0: return "" dname_is_valid = False # TODO COMPARE THIS IN LSOF OUTPUT TO VOL2 try: if dentry.d_op and dentry.d_op.has_member("d_dname") and dentry.d_op.d_dname: dname_is_valid = True except exceptions.InvalidAddressException: dname_is_valid = False if dname_is_valid: ret = LinuxUtilities._get_new_sock_pipe_path(context, task, filp) else: ret = LinuxUtilities._get_path_file(task, filp) return ret @classmethod def files_descriptors_for_process(cls, context: interfaces.context.ContextInterface, symbol_table: str, task: interfaces.objects.ObjectInterface): fd_table = task.files.get_fds() if fd_table == 0: return max_fds = task.files.get_max_fds() # corruption check if max_fds > 500000: return file_type = symbol_table + constants.BANG + 'file' fds = objects.utility.array_of_pointers(fd_table, count = max_fds, subtype = file_type, context = context) for (fd_num, filp) in enumerate(fds): if filp != 0: full_path = LinuxUtilities.path_for_file(context, task, filp) yield fd_num, filp, full_path @classmethod def mask_mods_list(cls, context: interfaces.context.ContextInterface, layer_name: str, mods: Iterator[interfaces.objects.ObjectInterface]) -> List[Tuple[str, int, int]]: """ A helper function to mask the starting and end address of kernel modules """ mask = context.layers[layer_name].address_mask return [(utility.array_to_string(mod.name), mod.get_module_base() & mask, (mod.get_module_base() & mask) + mod.get_core_size()) for mod in mods] @classmethod def generate_kernel_handler_info( cls, context: interfaces.context.ContextInterface, layer_name: str, kernel_name: str, mods_list: Iterator[interfaces.objects.ObjectInterface]) -> List[Tuple[str, int, int]]: """ A helper function that gets the beginning and end address of the kernel module """ kernel = contexts.Module(context, kernel_name, layer_name, 0) mask = context.layers[layer_name].address_mask start_addr = kernel.object_from_symbol("_text") start_addr = start_addr.vol.offset & mask end_addr = kernel.object_from_symbol("_etext") end_addr = end_addr.vol.offset & mask return [(constants.linux.KERNEL_NAME, start_addr, end_addr)] + \ LinuxUtilities.mask_mods_list(context, layer_name, mods_list) @classmethod def lookup_module_address(cls, context: interfaces.context.ContextInterface, handlers: List[Tuple[str, int, int]], target_address: int): """ Searches between the start and end address of the kernel module using target_address. Returns the module and symbol name of the address provided. """ mod_name = "UNKNOWN" symbol_name = "N/A" for name, start, end in handlers: if start <= target_address <= end: mod_name = name if name == constants.linux.KERNEL_NAME: symbols = list(context.symbol_space.get_symbols_by_location(target_address)) if len(symbols): symbol_name = symbols[0].split(constants.BANG)[1] if constants.BANG in symbols[0] else \ symbols[0] break return mod_name, symbol_name @classmethod def walk_internal_list(cls, vmlinux, struct_name, list_member, list_start): while list_start: list_struct = vmlinux.object(object_type = struct_name, offset = list_start.vol.offset) yield list_struct list_start = getattr(list_struct, list_member) volatility3-1.0.1/volatility3/framework/symbols/linux/bash.py000066400000000000000000000007761405267600400244100ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from volatility3.framework.symbols import intermed from volatility3.framework.symbols.linux.extensions import bash class BashIntermedSymbols(intermed.IntermediateSymbolTable): def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self.set_type_class('hist_entry', bash.hist_entry) volatility3-1.0.1/volatility3/framework/symbols/linux/bash32.json000066400000000000000000000040611405267600400250650ustar00rootroot00000000000000{ "symbols": {}, "enums": {}, "base_types": { "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "user_types": { "hist_entry": { "fields": { "timestamp": { "type": { "subtype": { "count": 1024, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" }, "kind": "pointer" }, "offset": 4 }, "line": { "type": { "subtype": { "count": 1024, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" }, "kind": "pointer" }, "offset": 0 }, "data": { "type": { "subtype": { "kind": "struct", "name": "void" }, "kind": "pointer" }, "offset": 8 } }, "kind": "struct", "size": 12 } }, "metadata": { "producer": { "version": "0.0.1", "name": "/mnt/hgfs/volshared/vtypes_to_json.py", "datetime": "2018-12-03T09:57:47.343730" }, "format": "4.1.0" } } volatility3-1.0.1/volatility3/framework/symbols/linux/bash64.json000066400000000000000000000040621405267600400250730ustar00rootroot00000000000000{ "symbols": {}, "enums": {}, "base_types": { "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 8, "signed": false, "endian": "little" } }, "user_types": { "hist_entry": { "fields": { "timestamp": { "type": { "subtype": { "count": 1024, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" }, "kind": "pointer" }, "offset": 8 }, "line": { "type": { "subtype": { "count": 1024, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" }, "kind": "pointer" }, "offset": 0 }, "data": { "type": { "subtype": { "kind": "struct", "name": "void" }, "kind": "pointer" }, "offset": 16 } }, "kind": "struct", "size": 24 } }, "metadata": { "producer": { "version": "0.0.1", "name": "/mnt/hgfs/volshared/vtypes_to_json.py", "datetime": "2018-12-03T09:55:34.880766" }, "format": "4.1.0" } } volatility3-1.0.1/volatility3/framework/symbols/linux/elf.json000066400000000000000000000473061405267600400245620ustar00rootroot00000000000000{ "symbols": { }, "user_types": { "Elf": { "fields": { "e_ident": { "offset": 0, "type": { "count": 16, "kind": "array", "subtype": { "kind": "base", "name": "unsigned char" } } } }, "kind": "struct", "size": 16 }, "Elf64_Ehdr": { "fields": { "e_ident": { "offset": 0, "type": { "count": 16, "kind": "array", "subtype": { "kind": "base", "name": "unsigned char" } } }, "e_type": { "offset": 16, "type": { "kind": "enum", "name": "EtypeEnum" } }, "e_machine": { "offset": 18, "type": { "kind": "base", "name": "unsigned short" } }, "e_version": { "offset": 20, "type": { "kind": "base", "name": "unsigned long" } }, "e_entry": { "offset": 24, "type": { "kind": "base", "name": "unsigned long long" } }, "e_phoff": { "offset": 32, "type": { "kind": "base", "name": "unsigned long long" } }, "e_shoff": { "offset": 40, "type": { "kind": "base", "name": "unsigned long long" } }, "e_flags": { "offset": 48, "type": { "kind": "base", "name": "unsigned long" } }, "e_ehsize": { "offset": 52, "type": { "kind": "base", "name": "unsigned short" } }, "e_phentsize": { "offset": 54, "type": { "kind": "base", "name": "unsigned short" } }, "e_phnum": { "offset": 56, "type": { "kind": "base", "name": "unsigned short" } }, "e_shentsize": { "offset": 58, "type": { "kind": "base", "name": "unsigned short" } }, "e_shnum": { "offset": 60, "type": { "kind": "base", "name": "unsigned short" } }, "e_shstrndx": { "offset": 62, "type": { "kind": "base", "name": "unsigned short" } } }, "kind": "struct", "size": 64 }, "Elf64_Shdr": { "fields": { "sh_name": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "sh_type": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "sh_flags": { "offset": 8, "type": { "kind": "base", "name": "unsigned long long" } }, "sh_addr": { "offset": 16, "type": { "kind": "base", "name": "unsigned long long" } }, "sh_offset": { "offset": 24, "type": { "kind": "base", "name": "unsigned long long" } }, "sh_size": { "offset": 32, "type": { "kind": "base", "name": "unsigned long long" } }, "sh_link": { "offset": 40, "type": { "kind": "base", "name": "unsigned long" } }, "sh_info": { "offset": 44, "type": { "kind": "base", "name": "unsigned long" } }, "sh_addralign": { "offset": 48, "type": { "kind": "base", "name": "unsigned long long" } }, "sh_entsize": { "offset": 56, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "struct", "size": 64 }, "Elf64_Phdr": { "fields": { "p_type": { "offset": 0, "type": { "kind": "enum", "name": "PtypeEnum" } }, "p_flags": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "p_offset": { "offset": 8, "type": { "kind": "base", "name": "unsigned long long" } }, "p_vaddr": { "offset": 16, "type": { "kind": "base", "name": "unsigned long long" } }, "p_paddr": { "offset": 24, "type": { "kind": "base", "name": "unsigned long long" } }, "p_filesz": { "offset": 32, "type": { "kind": "base", "name": "unsigned long long" } }, "p_memsz": { "offset": 40, "type": { "kind": "base", "name": "unsigned long long" } }, "p_align": { "offset": 48, "type": { "kind": "base", "name": "unsigned long long" } } }, "kind": "struct", "size": 56 }, "Elf64_Dyn": { "fields": { "d_tag": { "offset": 0, "type": { "kind": "base", "name": "long long" } }, "d_ptr": { "offset": 8, "type": { "kind": "base", "name": "unsigned long long" } } }, "kind": "struct", "size": 16 }, "Elf64_Note": { "fields": { "n_namesz": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "n_descsz": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "n_type": { "offset": 8, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "struct", "size": 12 }, "Elf64_Sym": { "fields": { "st_name": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "st_info": { "offset": 4, "type": { "kind": "base", "name": "unsigned char" } }, "st_other": { "offset": 5, "type": { "kind": "base", "name": "unsigned char" } }, "st_shndx": { "offset": 6, "type": { "kind": "base", "name": "unsigned short" } }, "st_value": { "offset": 8, "type": { "kind": "base", "name": "unsigned long long" } }, "st_size": { "offset": 16, "type": { "kind": "base", "name": "unsigned long long" } } }, "kind": "struct", "size": 24 }, "Elf64_LinkMap": { "fields": { "l_addr": { "offset": 0, "type": { "kind": "base", "name": "unsigned long long" } }, "l_name": { "offset": 8, "type": { "kind": "base", "name": "unsigned long long" } }, "l_ld": { "offset": 16, "type": { "kind": "base", "name": "unsigned long long" } }, "l_next": { "offset": 24, "type": { "kind": "base", "name": "unsigned long long" } }, "l_prev": { "offset": 32, "type": { "kind": "base", "name": "unsigned long long" } } }, "kind": "struct", "size": 40 }, "Elf64_Rel": { "fields": { "r_offset": { "offset": 0, "type": { "kind": "base", "name": "unsigned long long" } }, "r_info": { "offset": 8, "type": { "kind": "base", "name": "unsigned long long" } } }, "kind": "struct", "size": 16 }, "Elf64_Rela": { "fields": { "r_offset": { "offset": 0, "type": { "kind": "base", "name": "unsigned long long" } }, "r_info": { "offset": 8, "type": { "kind": "base", "name": "unsigned long long" } }, "r_addend": { "offset": 16, "type": { "kind": "base", "name": "long long" } } }, "kind": "struct", "size": 24 }, "Elf32_Ehdr": { "fields": { "e_ident": { "offset": 0, "type": { "count": 16, "kind": "array", "subtype": { "kind": "base", "name": "unsigned char" } } }, "e_type": { "offset": 16, "type": { "kind": "enum", "name": "EtypeEnum" } }, "e_machine": { "offset": 18, "type": { "kind": "base", "name": "unsigned short" } }, "e_version": { "offset": 20, "type": { "kind": "base", "name": "unsigned long" } }, "e_entry": { "offset": 24, "type": { "kind": "base", "name": "unsigned long" } }, "e_phoff": { "offset": 28, "type": { "kind": "base", "name": "unsigned long" } }, "e_shoff": { "offset": 32, "type": { "kind": "base", "name": "unsigned long" } }, "e_flags": { "offset": 36, "type": { "kind": "base", "name": "unsigned long" } }, "e_ehsize": { "offset": 40, "type": { "kind": "base", "name": "unsigned short" } }, "e_phentsize": { "offset": 42, "type": { "kind": "base", "name": "unsigned short" } }, "e_phnum": { "offset": 44, "type": { "kind": "base", "name": "unsigned short" } }, "e_shentsize": { "offset": 46, "type": { "kind": "base", "name": "unsigned short" } }, "e_shnum": { "offset": 48, "type": { "kind": "base", "name": "unsigned short" } }, "e_shstrndx": { "offset": 50, "type": { "kind": "base", "name": "unsigned short" } } }, "kind": "struct", "size": 52 }, "Elf32_Shdr": { "fields": { "sh_name": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "sh_type": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "sh_flags": { "offset": 8, "type": { "kind": "base", "name": "unsigned long" } }, "sh_addr": { "offset": 12, "type": { "kind": "base", "name": "unsigned long" } }, "sh_offset": { "offset": 16, "type": { "kind": "base", "name": "unsigned long" } }, "sh_size": { "offset": 20, "type": { "kind": "base", "name": "unsigned long" } }, "sh_link": { "offset": 24, "type": { "kind": "base", "name": "unsigned long" } }, "sh_info": { "offset": 28, "type": { "kind": "base", "name": "unsigned long" } }, "sh_addralign": { "offset": 32, "type": { "kind": "base", "name": "unsigned long" } }, "sh_entsize": { "offset": 36, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "struct", "size": 40 }, "Elf32_Phdr": { "fields": { "p_type": { "offset": 0, "type": { "kind": "enum", "name": "PtypeEnum" } }, "p_offset": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "p_vaddr": { "offset": 8, "type": { "kind": "base", "name": "unsigned long" } }, "p_paddr": { "offset": 12, "type": { "kind": "base", "name": "unsigned long" } }, "p_filesz": { "offset": 16, "type": { "kind": "base", "name": "unsigned long" } }, "p_memsz": { "offset": 20, "type": { "kind": "base", "name": "unsigned long" } }, "p_flags": { "offset": 24, "type": { "kind": "base", "name": "unsigned long" } }, "p_align": { "offset": 28, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "struct", "size": 32 }, "Elf32_Dyn": { "fields": { "d_tag": { "offset": 0, "type": { "kind": "base", "name": "long" } }, "d_ptr": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "struct", "size": 8 }, "Elf32_Note": { "fields": { "n_namesz": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "n_descsz": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "n_type": { "offset": 8, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "struct", "size": 12 }, "Elf32_Sym": { "fields": { "st_name": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "st_value": { "offset": 4, "type": { "kind": "base", "name": "unsigned long long" } }, "st_size": { "offset": 8, "type": { "kind": "base", "name": "unsigned long long" } }, "st_info": { "offset": 12, "type": { "kind": "base", "name": "unsigned char" } }, "st_other": { "offset": 13, "type": { "kind": "base", "name": "unsigned char" } }, "st_shndx": { "offset": 14, "type": { "kind": "base", "name": "unsigned short" } } }, "kind": "struct", "size": 16 }, "Elf32_LinkMap": { "fields": { "l_addr": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "l_name": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "l_ld": { "offset": 8, "type": { "kind": "base", "name": "unsigned long" } }, "l_next": { "offset": 12, "type": { "kind": "base", "name": "unsigned long" } }, "l_prev": { "offset": 16, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "struct", "size": 20 }, "Elf32_Rel": { "fields": { "r_offset": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "r_info": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "struct", "size": 8 }, "Elf32_Rela": { "fields": { "r_offset": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "r_info": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "r_addend": { "offset": 8, "type": { "kind": "base", "name": "long" } } }, "kind": "struct", "size": 12 } }, "enums": { "EtypeEnum": { "base": "unsigned short", "constants": { "ET_NONE": 0, "ET_REL": 1, "ET_EXEC": 2, "ET_DYN": 3, "ET_CORE": 4, "ET_LOPROC": 65280, "ET_HIPROC": 65535 }, "size": 2 }, "PtypeEnum": { "base": "unsigned long", "constants": { "PT_NULL": 0, "PT_LOAD": 1, "PT_DYNAMIC": 2, "PT_INTERP": 3, "PT_NOTE": 4, "PT_SHLIB": 5, "PT_PHDR": 6, "PT_TLS": 7, "PT_LOOS": 1610612736, "PT_HIOS": 1879048191, "PT_LOWPROC": 1879048192, "PT_HIPROC": 2147483647 }, "size": 4 } }, "base_types": { "unsigned char": { "endian": "little", "kind": "char", "signed": false, "size": 1 }, "unsigned short": { "endian": "little", "kind": "int", "signed": false, "size": 2 }, "long": { "endian": "little", "kind": "int", "signed": true, "size": 4 }, "char": { "endian": "little", "kind": "char", "signed": true, "size": 1 }, "unsigned long": { "endian": "little", "kind": "int", "signed": false, "size": 4 }, "long long": { "endian": "little", "kind": "int", "signed": true, "size": 8 }, "unsigned long long": { "endian": "little", "kind": "int", "signed": false, "size": 8 } }, "metadata": { "producer": { "version": "0.0.1", "name": "ikelos-by-hand", "datetime": "2019-10-21T22:52:00" }, "format": "6.1.0" } } volatility3-1.0.1/volatility3/framework/symbols/linux/extensions/000077500000000000000000000000001405267600400253065ustar00rootroot00000000000000volatility3-1.0.1/volatility3/framework/symbols/linux/extensions/__init__.py000066400000000000000000000420661405267600400274270ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import collections.abc import logging from typing import Generator, Iterable, Iterator, Optional, Tuple from volatility3.framework import constants from volatility3.framework import exceptions, objects, interfaces, symbols from volatility3.framework.layers import linear from volatility3.framework.objects import utility from volatility3.framework.symbols import generic, linux from volatility3.framework.symbols import intermed from volatility3.framework.symbols.linux.extensions import elf vollog = logging.getLogger(__name__) # Keep these in a basic module, to prevent import cycles when symbol providers require them class module(generic.GenericIntelProcess): def get_module_base(self): if self.has_member("core_layout"): return self.core_layout.base else: return self.module_core def get_init_size(self): if self.has_member("init_layout"): return self.init_layout.size elif self.has_member("init_size"): return self.init_size raise AttributeError("module -> get_init_size: Unable to determine .init section size of module") def get_core_size(self): if self.has_member("core_layout"): return self.core_layout.size elif self.has_member("core_size"): return self.core_size raise AttributeError("module -> get_core_size: Unable to determine core size of module") def get_module_core(self): if self.has_member("core_layout"): return self.core_layout.base elif self.has_member("module_core"): return self.module_core raise AttributeError("module -> get_module_core: Unable to get module core") def get_module_init(self): if self.has_member("init_layout"): return self.init_layout.base elif self.has_member("module_init"): return self.module_init raise AttributeError("module -> get_module_core: Unable to get module init") def get_name(self): """ Get the name of the module as a string """ return utility.array_to_string(self.name) def _get_sect_count(self, grp): """ Try to determine the number of valid sections """ arr = self._context.object( self.get_symbol_table().name + constants.BANG + "array", layer_name = self.vol.layer_name, offset = grp.attrs, subtype = self._context.symbol_space.get_type(self.get_symbol_table().name + constants.BANG + "pointer"), count = 25) idx = 0 while arr[idx]: idx = idx + 1 return idx def get_sections(self): """ Get sections of the module """ if self.sect_attrs.has_member("nsections"): num_sects = self.sect_attrs.nsections else: num_sects = self._get_sect_count(self.sect_attrs.grp) arr = self._context.object(self.get_symbol_table().name + constants.BANG + "array", layer_name = self.vol.layer_name, offset = self.sect_attrs.attrs.vol.offset, subtype = self._context.symbol_space.get_type(self.get_symbol_table().name + constants.BANG + 'module_sect_attr'), count = num_sects) for attr in arr: yield attr def get_symbols(self): if symbols.symbol_table_is_64bit(self._context, self.get_symbol_table().name): prefix = "Elf64_" else: prefix = "Elf32_" elf_table_name = intermed.IntermediateSymbolTable.create(self.context, self.config_path, "linux", "elf", native_types = None, class_types = extensions.elf.class_types) syms = self._context.object( self.get_symbol_table().name + constants.BANG + "array", layer_name = self.vol.layer_name, offset = self.section_symtab, subtype = self._context.symbol_space.get_type(elf_table_name + constants.BANG + prefix + "Sym"), count = self.num_symtab + 1) if self.section_strtab: for sym in syms: sym.set_cached_strtab(self.section_strtab) yield sym def get_symbol(self, wanted_sym_name): """ Get value for a given symbol name """ for sym in self.get_symbols(): sym_name = sym.get_name() sym_addr = sym.st_value if wanted_sym_name == sym_name: return sym_addr @property def section_symtab(self): if self.has_member("kallsyms"): return self.kallsyms.symtab elif self.has_member("symtab"): return self.symtab raise AttributeError("module -> symtab: Unable to get symtab") @property def num_symtab(self): if self.has_member("kallsyms"): return int(self.kallsyms.num_symtab) elif self.has_member("num_symtab"): return int(self.num_symtab) raise AttributeError("module -> num_symtab: Unable to determine number of symbols") @property def section_strtab(self): # Newer kernels if self.has_member("kallsyms"): return self.kallsyms.strtab # Older kernels elif self.has_member("strtab"): return self.strtab raise AttributeError("module -> strtab: Unable to get strtab") class task_struct(generic.GenericIntelProcess): def add_process_layer(self, config_prefix: str = None, preferred_name: str = None) -> Optional[str]: """Constructs a new layer based on the process's DTB. Returns the name of the Layer or None. """ parent_layer = self._context.layers[self.vol.layer_name] try: pgd = self.mm.pgd except exceptions.InvalidAddressException: return None if not isinstance(parent_layer, linear.LinearlyMappedLayer): raise TypeError("Parent layer is not a translation layer, unable to construct process layer") dtb, layer_name = parent_layer.translate(pgd) if not dtb: return None if preferred_name is None: preferred_name = self.vol.layer_name + "_Process{}".format(self.pid) # Add the constructed layer and return the name return self._add_process_layer(self._context, dtb, config_prefix, preferred_name) def get_process_memory_sections(self, heap_only: bool = False) -> Generator[Tuple[int, int], None, None]: """Returns a list of sections based on the memory manager's view of this task's virtual memory.""" for vma in self.mm.get_mmap_iter(): start = int(vma.vm_start) end = int(vma.vm_end) if heap_only and not (start <= self.mm.brk and end >= self.mm.start_brk): continue else: # FIXME: Check if this actually needs to be printed out or not vollog.info("adding vma: {:x} {:x} | {:x} {:x}".format(start, self.mm.brk, end, self.mm.start_brk)) yield (start, end - start) class fs_struct(objects.StructType): def get_root_dentry(self): # < 2.6.26 if self.has_member("rootmnt"): return self.root elif self.root.has_member("dentry"): return self.root.dentry raise AttributeError("Unable to find the root dentry") def get_root_mnt(self): # < 2.6.26 if self.has_member("rootmnt"): return self.rootmnt elif self.root.has_member("mnt"): return self.root.mnt raise AttributeError("Unable to find the root mount") class mm_struct(objects.StructType): def get_mmap_iter(self) -> Iterable[interfaces.objects.ObjectInterface]: """Returns an iterator for the mmap list member of an mm_struct.""" if not self.mmap: return yield self.mmap seen = {self.mmap.vol.offset} link = self.mmap.vm_next while link != 0 and link.vol.offset not in seen: yield link seen.add(link.vol.offset) link = link.vm_next class super_block(objects.StructType): # include/linux/kdev_t.h MINORBITS = 20 @property def major(self) -> int: return self.s_dev >> self.MINORBITS @property def minor(self) -> int: return self.s_dev & ((1 << self.MINORBITS) - 1) class vm_area_struct(objects.StructType): perm_flags = { 0x00000001: "r", 0x00000002: "w", 0x00000004: "x", } extended_flags = { 0x00000001: "VM_READ", 0x00000002: "VM_WRITE", 0x00000004: "VM_EXEC", 0x00000008: "VM_SHARED", 0x00000010: "VM_MAYREAD", 0x00000020: "VM_MAYWRITE", 0x00000040: "VM_MAYEXEC", 0x00000080: "VM_MAYSHARE", 0x00000100: "VM_GROWSDOWN", 0x00000200: "VM_NOHUGEPAGE", 0x00000400: "VM_PFNMAP", 0x00000800: "VM_DENYWRITE", 0x00001000: "VM_EXECUTABLE", 0x00002000: "VM_LOCKED", 0x00004000: "VM_IO", 0x00008000: "VM_SEQ_READ", 0x00010000: "VM_RAND_READ", 0x00020000: "VM_DONTCOPY", 0x00040000: "VM_DONTEXPAND", 0x00080000: "VM_RESERVED", 0x00100000: "VM_ACCOUNT", 0x00200000: "VM_NORESERVE", 0x00400000: "VM_HUGETLB", 0x00800000: "VM_NONLINEAR", 0x01000000: "VM_MAPPED_COP__VM_HUGEPAGE", 0x02000000: "VM_INSERTPAGE", 0x04000000: "VM_ALWAYSDUMP", 0x08000000: "VM_CAN_NONLINEAR", 0x10000000: "VM_MIXEDMAP", 0x20000000: "VM_SAO", 0x40000000: "VM_PFN_AT_MMAP", 0x80000000: "VM_MERGEABLE", } def _parse_flags(self, vm_flags, parse_flags) -> str: """Returns an string representation of the flags in a vm_area_struct.""" retval = "" for mask, char in parse_flags.items(): if (vm_flags & mask) == mask: retval = retval + char else: retval = retval + '-' return retval # only parse the rwx bits def get_protection(self) -> str: return self._parse_flags(self.vm_flags & 0b1111, vm_area_struct.perm_flags) # used by malfind def get_flags(self) -> str: return self._parse_flags(self.vm_flags, self.extended_flags) def get_page_offset(self) -> int: if self.vm_file == 0: return 0 return self.vm_pgoff << constants.linux.PAGE_SHIFT def get_name(self, context, task): if self.vm_file != 0: fname = linux.LinuxUtilities.path_for_file(context, task, self.vm_file) elif self.vm_start <= task.mm.start_brk and self.vm_end >= task.mm.brk: fname = "[heap]" elif self.vm_start <= task.mm.start_stack and self.vm_end >= task.mm.start_stack: fname = "[stack]" elif self.vm_mm.context.has_member("vdso") and self.vm_start == self.vm_mm.context.vdso: fname = "[vdso]" else: fname = "Anonymous Mapping" return fname # used by malfind def is_suspicious(self): ret = False flags_str = self.get_protection() if flags_str == "rwx": ret = True elif flags_str == "r-x" and self.vm_file.dereference().vol.offset == 0: ret = True return ret class qstr(objects.StructType): def name_as_str(self) -> str: if self.has_member("len"): str_length = self.len + 1 # Maximum length should include null terminator else: str_length = 255 try: ret = objects.utility.pointer_to_string(self.name, str_length) except (exceptions.InvalidAddressException, ValueError): ret = "" return ret class dentry(objects.StructType): def path(self) -> str: return self.d_name.name_as_str() class struct_file(objects.StructType): def get_dentry(self) -> interfaces.objects.ObjectInterface: if self.has_member("f_dentry"): return self.f_dentry elif self.has_member("f_path"): return self.f_path.dentry else: raise AttributeError("Unable to find file -> dentry") def get_vfsmnt(self) -> interfaces.objects.ObjectInterface: if self.has_member("f_vfsmnt"): return self.f_vfsmnt elif self.has_member("f_path"): return self.f_path.mnt else: raise AttributeError("Unable to find file -> vfs mount") class list_head(objects.StructType, collections.abc.Iterable): def to_list(self, symbol_type: str, member: str, forward: bool = True, sentinel: bool = True, layer: Optional[str] = None) -> Iterator[interfaces.objects.ObjectInterface]: """Returns an iterator of the entries in the list.""" layer = layer or self.vol.layer_name relative_offset = self._context.symbol_space.get_type(symbol_type).relative_child_offset(member) direction = 'prev' if forward: direction = 'next' try: link = getattr(self, direction).dereference() except exceptions.InvalidAddressException: return if not sentinel: yield self._context.object(symbol_type, layer, offset = self.vol.offset - relative_offset) seen = {self.vol.offset} while link.vol.offset not in seen: obj = self._context.object(symbol_type, layer, offset = link.vol.offset - relative_offset) yield obj seen.add(link.vol.offset) try: link = getattr(link, direction).dereference() except exceptions.InvalidAddressException: break def __iter__(self) -> Iterator[interfaces.objects.ObjectInterface]: return self.to_list(self.vol.parent.vol.type_name, self.vol.member_name) class files_struct(objects.StructType): def get_fds(self) -> interfaces.objects.ObjectInterface: if self.has_member("fdt"): return self.fdt.fd.dereference() elif self.has_member("fd"): return self.fd.dereference() else: raise AttributeError("Unable to find files -> file descriptors") def get_max_fds(self) -> interfaces.objects.ObjectInterface: if self.has_member("fdt"): return self.fdt.max_fds elif self.has_member("max_fds"): return self.max_fds else: raise AttributeError("Unable to find files -> maximum file descriptors") class mount(objects.StructType): def get_mnt_sb(self): if self.has_member("mnt"): return self.mnt.mnt_sb elif self.has_member("mnt_sb"): return self.mnt_sb else: raise AttributeError("Unable to find mount -> super block") def get_mnt_root(self): if self.has_member("mnt"): return self.mnt.mnt_root elif self.has_member("mnt_root"): return self.mnt_root else: raise AttributeError("Unable to find mount -> mount root") def get_mnt_flags(self): if self.has_member("mnt"): return self.mnt.mnt_flags elif self.has_member("mnt_flags"): return self.mnt_flags else: raise AttributeError("Unable to find mount -> mount flags") def get_mnt_parent(self): return self.mnt_parent def get_mnt_mountpoint(self): return self.mnt_mountpoint class vfsmount(objects.StructType): def is_valid(self): return self.get_mnt_sb() != 0 and \ self.get_mnt_root() != 0 and \ self.get_mnt_parent() != 0 def _get_real_mnt(self): table_name = self.vol.type_name.split(constants.BANG)[0] mount_struct = "{0}{1}mount".format(table_name, constants.BANG) offset = self._context.symbol_space.get_type(mount_struct).relative_child_offset("mnt") return self._context.object(mount_struct, self.vol.layer_name, offset = self.vol.offset - offset) def get_mnt_parent(self): if self.has_member("mnt_parent"): return self.mnt_parent else: return self._get_real_mnt().mnt_parent def get_mnt_mountpoint(self): if self.has_member("mnt_mountpoint"): return self.mnt_mountpoint else: return self._get_real_mnt().mnt_mountpoint def get_mnt_root(self): return self.mnt_root class kobject(objects.StructType): def reference_count(self): refcnt = self.kref.refcount if self.has_member("counter"): ret = refcnt.counter else: ret = refcnt.refs.counter return ret volatility3-1.0.1/volatility3/framework/symbols/linux/extensions/bash.py000066400000000000000000000034151405267600400266000ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from volatility3.framework import exceptions from volatility3.framework import objects from volatility3.framework.objects import utility from volatility3.framework.renderers import conversion class hist_entry(objects.StructType): def is_valid(self): try: cmd = self.get_command() ts = utility.array_to_string(self.timestamp.dereference()) except exceptions.InvalidAddressException: return False if not cmd or len(cmd) == 0: return False if not ts or len(ts) == 0: return False # At this point in time, the epoc integer size will # never be less than 10 characters, and the stamp is # always preceded by a pound/hash character. if len(ts) < 10 or str(ts)[0] != "#": return False # The final check is to make sure the entire string # is composed of numbers. Try to convert to an int. try: int(str(ts)[1:]) except ValueError: return False return True def get_time_as_integer(self): # Get the string and remove the leading "#" from the timestamp time_string = utility.array_to_string(self.timestamp.dereference())[1:] # Convert the string into an integer (number of seconds) return int(time_string) def get_time_object(self): nsecs = self.get_time_as_integer() # Build a timestamp object from the integer return conversion.unixtime_to_datetime(nsecs) def get_command(self): return utility.array_to_string(self.line.dereference()) volatility3-1.0.1/volatility3/framework/symbols/linux/extensions/elf.py000066400000000000000000000223471405267600400264360ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from typing import Dict, Tuple from volatility3.framework import constants from volatility3.framework import objects, interfaces class elf(objects.StructType): ''' Class used to create elf objects. It overrides the typename to `Elf32_` or `Elf64_`, depending on the corresponding value on e_ident ''' def __init__(self, context: interfaces.context.ContextInterface, type_name: str, object_info: interfaces.objects.ObjectInformation, size: int, members: Dict[str, Tuple[int, interfaces.objects.Template]]) -> None: super().__init__(context = context, type_name = type_name, object_info = object_info, size = size, members = members) layer_name = self.vol.layer_name symbol_table_name = self.get_symbol_table_name() # We read the MAGIC: (0x0 to 0x4) 0x7f 0x45 0x4c 0x46 magic = self._context.object(symbol_table_name + constants.BANG + "unsigned long", layer_name = layer_name, offset = object_info.offset) # Check validity if magic != 0x464c457f: return None # We need to read the EI_CLASS (0x4 offset) ei_class = self._context.object(symbol_table_name + constants.BANG + "unsigned char", layer_name = layer_name, offset = object_info.offset + 0x4) if ei_class == 1: self._type_prefix = "Elf32_" elif ei_class == 2: self._type_prefix = "Elf64_" else: raise ValueError("Unsupported ei_class value {}".format(ei_class)) # Construct the full header self._hdr = self._context.object(symbol_table_name + constants.BANG + self._type_prefix + "Ehdr", layer_name = layer_name, offset = object_info.offset) self._offset = object_info.offset self._cached_symtab = None self._cached_strtab = None def is_valid(self): ''' Determine whether it is a valid object ''' return self._type_prefix is not None and self._hdr is not None def __getattr__(self, name): # Just redirect to the corresponding header if name[0:2] == "e_" and name in dir(self._hdr): return self._hdr.__getattr__(name) else: return self.__getattribute__(name) def __dir__(self): return self._hdr.__dir__() + [ "get_program_headers", "is_valid", "get_section_headers", "get_symbols", "__dir__" ] def get_program_headers(self): program_headers = self._context.object( self.get_symbol_table_name() + constants.BANG + "array", layer_name = self.vol.layer_name, offset = self._offset + self.e_phoff, subtype = self._context.symbol_space.get_type(self.get_symbol_table_name() + constants.BANG + self._type_prefix + "Phdr"), count = self.e_phnum) for prog_header in program_headers: prog_header.parent_e_type = self.e_type prog_header.parent_offset = self._offset prog_header.type_prefix = self._type_prefix yield prog_header def get_section_headers(self): section_headers = self._context.object( self.get_symbol_table_name() + constants.BANG + "array", layer_name = self.vol.layer_name, offset = self._offset + self.e_shoff, subtype = self._context.symbol_space.get_type(self.get_symbol_table_name() + constants.BANG + self._type_prefix + "Shdr"), count = self.e_shnum) return section_headers def _find_symbols(self): dt_strtab = None dt_symtab = None dt_strent = None for phdr in self.get_program_headers(): try: # Find PT_DYNAMIC segment if str(phdr.p_type.description) != 'PT_DYNAMIC': continue except ValueError: # If the p_type value is outside the ones declared in the enumeration, an # exception is raised return None # This section contains pointers to the strtab, symtab, and strent sections for dsec in phdr.dynamic_sections(): if dsec.d_tag == 5: dt_strtab = dsec.d_ptr elif dsec.d_tag == 6: dt_symtab = dsec.d_ptr elif dsec.d_tag == 11: # Size of the symtab symbol entry dt_strent = dsec.d_ptr break if dt_strtab is None or dt_symtab is None or dt_strent is None: return None self._cached_symtab = dt_symtab self._cached_strtab = dt_strtab # Calculate number of symbol entries assuming that strtab follows symtab if dt_symtab < dt_strtab: self._cached_numsyms = (dt_strtab - dt_symtab) // dt_strent else: self._cached_numsyms = 1024 def get_symbols(self): if self._cached_symtab is None: self._find_symbols() if self._cached_symtab is None: return symtab_arr = self._context.object( self.get_symbol_table_name() + constants.BANG + "array", layer_name = self.vol.layer_name, offset = self._cached_symtab, subtype = self._context.symbol_space.get_type(self.get_symbol_table_name() + constants.BANG + self._type_prefix + "Sym"), count = self._cached_numsyms) for sym in symtab_arr: sym.cached_strtab = self._cached_strtab yield sym class elf_sym(objects.StructType): """ An elf symbol entry""" def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self._cached_strtab = None @property def cached_strtab(self): return self._cached_strtab @cached_strtab.setter def cached_strtab(self, cached_strtab): self._cached_strtab = cached_strtab def get_name(self): addr = self._cached_strtab + self.st_name # Just get the first 255 characters, it should be enough for a symbol name name_bytes = self._context.layers[self.vol.layer_name].read(addr, 255, pad = True) if name_bytes: idx = name_bytes.find(b"\x00") if idx != -1: name_bytes = name_bytes[:idx] return name_bytes.decode('utf-8', errors = 'ignore') else: # If we cannot read the name from the address space, # we return None. return None class elf_phdr(objects.StructType): """ An elf program header """ def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self._parent_e_type = None self._parent_offset = None self._type_prefix = None @property def parent_e_type(self): return self._parent_e_type @parent_e_type.setter def parent_e_type(self, e_type): self._parent_e_type = e_type @property def parent_offset(self): return self._parent_offset @parent_offset.setter def parent_offset(self, offset): self._parent_offset = offset @property def type_prefix(self): return self._type_prefix @type_prefix.setter def type_prefix(self, prefix): self._type_prefix = prefix def get_vaddr(self): offset = self.__getattr__("p_vaddr") if self._parent_e_type == 3: # ET_DYN offset = self._parent_offset + offset return offset def dynamic_sections(self): # sanity check try: if str(self.p_type.description) != 'PT_DYNAMIC': return None except ValueError: # If the value is outside the ones declared in the enumeration, an # exception is raised return None # the buffer of array starts at elf_base + our virtual address ( offset ) arr_start = self.get_vaddr() symbol_table_name = self.get_symbol_table_name() rtsize = self._context.symbol_space.get_type(symbol_table_name + \ constants.BANG + \ self._type_prefix + "Dyn").size for i in range(256): # use the real size idx = i * rtsize dyn = self._context.object(symbol_table_name + constants.BANG + self._type_prefix + "Dyn", layer_name = self.vol.layer_name, offset = arr_start + idx) yield dyn if dyn.d_tag == 0: break class_types = {'Elf': elf, 'Elf64_Phdr': elf_phdr, 'Elf32_Phdr': elf_phdr, 'Elf32_Sym': elf_sym, 'Elf64_Sym': elf_sym} volatility3-1.0.1/volatility3/framework/symbols/mac/000077500000000000000000000000001405267600400225105ustar00rootroot00000000000000volatility3-1.0.1/volatility3/framework/symbols/mac/__init__.py000066400000000000000000000174611405267600400246320ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from typing import Iterator, Any, Iterable, List, Tuple, Set from volatility3.framework import interfaces, objects, exceptions, constants from volatility3.framework.symbols import intermed from volatility3.framework.symbols.mac import extensions class MacKernelIntermedSymbols(intermed.IntermediateSymbolTable): provides = {"type": "interface"} def __init__(self, *args, **kwargs) -> None: super().__init__(*args, **kwargs) self.set_type_class('proc', extensions.proc) self.set_type_class('fileglob', extensions.fileglob) self.set_type_class('vnode', extensions.vnode) self.set_type_class('vm_map_entry', extensions.vm_map_entry) self.set_type_class('vm_map_object', extensions.vm_map_object) self.set_type_class('socket', extensions.socket) self.set_type_class('inpcb', extensions.inpcb) self.set_type_class('queue_entry', extensions.queue_entry) self.set_type_class('ifnet', extensions.ifnet) self.set_type_class('sockaddr_dl', extensions.sockaddr_dl) self.set_type_class('sockaddr', extensions.sockaddr) self.set_type_class('sysctl_oid', extensions.sysctl_oid) self.set_type_class('kauth_scope', extensions.kauth_scope) class MacUtilities(interfaces.configuration.VersionableInterface): """Class with multiple useful mac functions.""" """ Version History: 1.1.0 -> added walk_list_head API 1.2.0 -> added walk_slist API """ _version = (1, 2, 0) @classmethod def mask_mods_list(cls, context: interfaces.context.ContextInterface, layer_name: str, mods: Iterator[Any]) -> List[Tuple[interfaces.objects.ObjectInterface, Any, Any]]: """ A helper function to mask the starting and end address of kernel modules """ mask = context.layers[layer_name].address_mask return [(objects.utility.array_to_string(mod.name), mod.address & mask, (mod.address & mask) + mod.size) for mod in mods] @classmethod def generate_kernel_handler_info( cls, context: interfaces.context.ContextInterface, layer_name: str, kernel, # ikelos - how to type this?? mods_list: Iterator[Any]): try: start_addr = kernel.object_from_symbol("vm_kernel_stext") except exceptions.SymbolError: start_addr = kernel.object_from_symbol("stext") try: end_addr = kernel.object_from_symbol("vm_kernel_etext") except exceptions.SymbolError: end_addr = kernel.object_from_symbol("etext") mask = context.layers[layer_name].address_mask start_addr = start_addr & mask end_addr = end_addr & mask return [("__kernel__", start_addr, end_addr)] + \ MacUtilities.mask_mods_list(context, layer_name, mods_list) @classmethod def lookup_module_address(cls, context: interfaces.context.ContextInterface, handlers: Iterator[Any], target_address): mod_name = "UNKNOWN" symbol_name = "N/A" for name, start, end in handlers: if start <= target_address <= end: mod_name = name if name == "__kernel__": symbols = list(context.symbol_space.get_symbols_by_location(target_address)) if len(symbols) > 0: symbol_name = str(symbols[0].split(constants.BANG)[1]) if constants.BANG in symbols[0] else \ str(symbols[0]) break return mod_name, symbol_name @classmethod def files_descriptors_for_process(cls, context: interfaces.context.ContextInterface, symbol_table_name: str, task: interfaces.objects.ObjectInterface): """Creates a generator for the file descriptors of a process Args: symbol_table_name: The name of the symbol table associated with the process context: task: The process structure to enumerate file descriptors from Return: A 3 element tuple is yielded for each file descriptor: 1) The file's object 2) The path referenced by the descriptor. The path is either empty, the full path of the file in the file system, or the formatted name for sockets, pipes, etc. 3) The file descriptor number """ try: num_fds = task.p_fd.fd_lastfile except exceptions.InvalidAddressException: num_fds = 1024 try: nfiles = task.p_fd.fd_nfiles except exceptions.InvalidAddressException: nfiles = 1024 if nfiles > num_fds: num_fds = nfiles if num_fds > 4096: num_fds = 1024 file_type = symbol_table_name + constants.BANG + 'fileproc' try: table_addr = task.p_fd.fd_ofiles.dereference() except exceptions.InvalidAddressException: return fds = objects.utility.array_of_pointers(table_addr, count = num_fds, subtype = file_type, context = context) for fd_num, f in enumerate(fds): if f != 0: try: ftype = f.f_fglob.get_fg_type() except exceptions.InvalidAddressException: continue if ftype == 'VNODE': vnode = f.f_fglob.fg_data.dereference().cast("vnode") path = vnode.full_path() elif ftype: path = "<{}>".format(ftype.lower()) yield f, path, fd_num @classmethod def _walk_iterable(cls, queue: interfaces.objects.ObjectInterface, list_head_member: str, list_next_member: str, next_member: str, max_elements: int = 4096) -> Iterable[interfaces.objects.ObjectInterface]: seen = set() # type: Set[int] try: current = queue.member(attr = list_head_member) except exceptions.InvalidAddressException: return while current: if current.vol.offset in seen: break seen.add(current.vol.offset) if len(seen) == max_elements: break if current.is_readable(): yield current try: current = current.member(attr = next_member).member(attr = list_next_member) except exceptions.InvalidAddressException: break @classmethod def walk_tailq(cls, queue: interfaces.objects.ObjectInterface, next_member: str, max_elements: int = 4096) -> Iterable[interfaces.objects.ObjectInterface]: for element in cls._walk_iterable(queue, "tqh_first", "tqe_next", next_member, max_elements): yield element @classmethod def walk_list_head(cls, queue: interfaces.objects.ObjectInterface, next_member: str, max_elements: int = 4096) -> Iterable[interfaces.objects.ObjectInterface]: for element in cls._walk_iterable(queue, "lh_first", "le_next", next_member, max_elements): yield element @classmethod def walk_slist(cls, queue: interfaces.objects.ObjectInterface, next_member: str, max_elements: int = 4096) -> Iterable[interfaces.objects.ObjectInterface]: for element in cls._walk_iterable(queue, "slh_first", "sle_next", next_member, max_elements): yield element volatility3-1.0.1/volatility3/framework/symbols/mac/extensions/000077500000000000000000000000001405267600400247075ustar00rootroot00000000000000volatility3-1.0.1/volatility3/framework/symbols/mac/extensions/__init__.py000066400000000000000000000400431405267600400270210ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from typing import Generator, Iterable, Optional, Set, Tuple from volatility3.framework import constants, objects, renderers from volatility3.framework import exceptions, interfaces from volatility3.framework.objects import utility from volatility3.framework.renderers import conversion from volatility3.framework.symbols import generic class proc(generic.GenericIntelProcess): def get_task(self): return self.task.dereference().cast("task") def add_process_layer(self, config_prefix: str = None, preferred_name: str = None) -> Optional[str]: """Constructs a new layer based on the process's DTB. Returns the name of the Layer or None. """ parent_layer = self._context.layers[self.vol.layer_name] if not isinstance(parent_layer, interfaces.layers.TranslationLayerInterface): raise TypeError("Parent layer is not a translation layer, unable to construct process layer") try: dtb = self.get_task().map.pmap.pm_cr3 except exceptions.InvalidAddressException: return None if preferred_name is None: preferred_name = self.vol.layer_name + "_Process{}".format(self.p_pid) # Add the constructed layer and return the name return self._add_process_layer(self._context, dtb, config_prefix, preferred_name) def get_map_iter(self) -> Iterable[interfaces.objects.ObjectInterface]: try: task = self.get_task() except exceptions.InvalidAddressException: return try: current_map = task.map.hdr.links.next except exceptions.InvalidAddressException: return seen = set() # type: Set[int] for i in range(task.map.hdr.nentries): if not current_map or current_map.vol.offset in seen: break yield current_map seen.add(current_map.vol.offset) current_map = current_map.links.next ###### # ikelos: this breaks with multi threading on, but works with it disabled # with multi threading on, it throws that same error about v4 pickle stuff that linux originally did # the fix for linux was to call int() so that we were not returning vol objects. # I call int() on these and the code works nearly 1-1 with the linux one so I am very confused ###### def get_process_memory_sections(self, context: interfaces.context.ContextInterface, config_prefix: str, rw_no_file: bool = False) -> \ Generator[Tuple[int, int], None, None]: """Returns a list of sections based on the memory manager's view of this task's virtual memory.""" for vma in self.get_map_iter(): start = int(vma.links.start) end = int(vma.links.end) if rw_no_file: if vma.get_perms() != "rw" or vma.get_path(context, config_prefix) != "": if vma.get_special_path() != "[heap]": continue yield (start, end - start) class fileglob(objects.StructType): def get_fg_type(self): ret = None if self.has_member("fg_type"): ret = self.fg_type elif self.fg_ops != 0: try: ret = self.fg_ops.fo_type except exceptions.InvalidAddressException: pass if ret: ret = str(ret.description).replace("DTYPE_", "") return ret class vm_map_object(objects.StructType): def get_map_object(self): if self.has_member("vm_object"): return self.vm_object elif self.has_member("vmo_object"): return self.vmo_object raise AttributeError("vm_map_object -> get_object") class vnode(objects.StructType): def _do_calc_path(self, ret, vnodeobj, vname): if vnodeobj is None: return if vname: ret.append(utility.pointer_to_string(vname, 255)) if int(vnodeobj.v_flag) & 0x000001 != 0 and int(vnodeobj.v_mount) != 0: if int(vnodeobj.v_mount.mnt_vnodecovered) != 0: self._do_calc_path(ret, vnodeobj.v_mount.mnt_vnodecovered, vnodeobj.v_mount.mnt_vnodecovered.v_name) else: try: parent = vnodeobj.v_parent parent_name = parent.v_name except exceptions.InvalidAddressException: return self._do_calc_path(ret, parent, parent_name) def full_path(self): if self.v_flag & 0x000001 != 0 and self.v_mount != 0 and self.v_mount.mnt_flag & 0x00004000 != 0: ret = b"/" else: elements = [] files = [] self._do_calc_path(elements, self, self.v_name) elements.reverse() for e in elements: files.append(e.encode("utf-8")) ret = b"/".join(files) if ret: ret = b"/" + ret return ret.decode("utf-8") class vm_map_entry(objects.StructType): def is_suspicious(self, context, config_prefix): """Flags memory regions that are mapped rwx or that map an executable not back from a file on disk.""" ret = False perms = self.get_perms() if perms == "rwx": ret = True elif perms == "r-x" and self.get_path(context, config_prefix) == "": ret = True return ret def get_perms(self): permask = "rwx" perms = "" for (ctr, i) in enumerate([1, 3, 5]): if (self.protection & i) == i: perms = perms + permask[ctr] else: perms = perms + "-" return perms def get_range_alias(self): if self.has_member("alias"): ret = int(self.alias) else: ret = int(self.vme_offset) & 0xfff return ret def get_special_path(self): check = self.get_range_alias() if 0 < check < 10: ret = "[heap]" elif check == 30: ret = "[stack]" else: ret = "" return ret def get_path(self, context, config_prefix): node = self.get_vnode(context, config_prefix) if type(node) == str and node == "sub_map": ret = node elif node: path = [] while node: v_name = utility.pointer_to_string(node.v_name, 255) path.append(v_name) node = node.v_parent path.reverse() ret = "/" + "/".join(path) else: ret = "" return ret def get_object(self): if self.has_member("vme_object"): return self.vme_object elif self.has_member("object"): return self.object raise AttributeError("vm_map_entry -> get_object: Unable to determine object") def get_offset(self): if self.has_member("vme_offset"): return self.vme_offset elif self.has_member("offset"): return self.offset raise AttributeError("vm_map_entry -> get_offset: Unable to determine offset") def get_vnode(self, context, config_prefix): if self.is_sub_map == 1: return "sub_map" # based on find_vnode_object vnode_object = self.get_object().get_map_object() found_end = False while not found_end: try: tmp_vnode_object = vnode_object.shadow.dereference() except exceptions.InvalidAddressException: break if tmp_vnode_object.vol.offset == 0: found_end = True else: vnode_object = tmp_vnode_object try: ops = vnode_object.pager.mo_pager_ops.dereference() except exceptions.InvalidAddressException: return None found = False for sym in context.symbol_space.get_symbols_by_location(ops.vol.offset): if sym.split(constants.BANG)[1] in ["vnode_pager_ops", "_vnode_pager_ops"]: found = True break if found: vpager = context.object(config_prefix + constants.BANG + "vnode_pager", layer_name = vnode_object.vol.native_layer_name, offset = vnode_object.pager) ret = vpager.vnode_handle else: ret = None return ret class socket(objects.StructType): def get_inpcb(self): try: ret = self.so_pcb.dereference().cast("inpcb") except exceptions.InvalidAddressException: ret = None return ret def get_family(self): return self.so_proto.pr_domain.dom_family def get_protocol_as_string(self): proto = self.so_proto.pr_protocol if proto == 6: ret = "TCP" elif proto == 17: ret = "UDP" else: ret = "" return ret def get_state(self): ret = "" if self.so_proto.pr_protocol == 6: inpcb = self.get_inpcb() if inpcb is not None: ret = inpcb.get_tcp_state() return ret def get_connection_info(self): inpcb = self.get_inpcb() if inpcb is None: ret = None elif self.get_family() == 2: ret = inpcb.get_ipv4_info() else: ret = inpcb.get_ipv6_info() return ret def get_converted_connection_info(self): vals = self.get_connection_info() if vals: ret = conversion.convert_network_four_tuple(self.get_family(), vals) else: ret = None return ret class inpcb(objects.StructType): def get_tcp_state(self): tcp_states = ("CLOSED", "LISTEN", "SYN_SENT", "SYN_RECV", "ESTABLISHED", "CLOSE_WAIT", "FIN_WAIT1", "CLOSING", "LAST_ACK", "FIN_WAIT2", "TIME_WAIT") try: tcpcb = self.inp_ppcb.dereference().cast("tcpcb") except exceptions.InvalidAddressException: return "" state_type = tcpcb.t_state if state_type and state_type < len(tcp_states): state = tcp_states[state_type] else: state = "" return state def get_ipv4_info(self): try: lip = self.inp_dependladdr.inp46_local.ia46_addr4.s_addr except exceptions.InvalidAddressException: return None lport = self.inp_lport try: rip = self.inp_dependfaddr.inp46_foreign.ia46_addr4.s_addr except exceptions.InvalidAddressException: return None rport = self.inp_fport return [lip, lport, rip, rport] def get_ipv6_info(self): try: lip = self.inp_dependladdr.inp6_local.member(attr = '__u6_addr').member(attr = '__u6_addr32') except exceptions.InvalidAddressException: return None lport = self.inp_lport try: rip = self.inp_dependfaddr.inp6_foreign.member(attr = '__u6_addr').member(attr = '__u6_addr32') except exceptions.InvalidAddressException: return None rport = self.inp_fport return [lip, lport, rip, rport] class queue_entry(objects.StructType): def walk_list(self, list_head: interfaces.objects.ObjectInterface, member_name: str, type_name: str, max_size: int = 4096) -> Iterable[interfaces.objects.ObjectInterface]: """ Walks a queue in a smear-aware and smear-resistant manner smear is detected by: - the max_size parameter sets an upper bound - each seen entry is only allowed once attempts to work around smear: - the list is walked in both directions to help find as many elements as possible Args: list_head - the head of the list member_name - the name of the embedded list member type_name - the type of each element in the list max_size - the maximum amount of elements that will be returned Returns: Each instance of the queue cast as "type_name" type """ yielded = 0 seen = set() for attr in ['next', 'prev']: try: n = getattr(self, attr).dereference().cast(type_name) while n is not None and n.vol.offset != list_head: if n.vol.offset in seen: break yield n seen.add(n.vol.offset) yielded = yielded + 1 if yielded == max_size: return n = getattr(n.member(attr = member_name), attr).dereference().cast(type_name) except exceptions.InvalidAddressException: pass class ifnet(objects.StructType): def sockaddr_dl(self): if self.has_member("if_lladdr"): try: val = self.if_lladdr.ifa_addr.dereference().cast("sockaddr_dl") except exceptions.InvalidAddressException: val = None else: try: val = self.if_addrhead.tqh_first.ifa_addr.dereference().cast("sockaddr_dl") except exceptions.InvalidAddressException: val = None return val # this is used for MAC addresses class sockaddr_dl(objects.StructType): def __str__(self): ret = "" if self.sdl_alen > 14: return ret for i in range(self.sdl_alen): try: e = self.sdl_data[self.sdl_nlen + i] except IndexError: break e = e.cast("unsigned char") ret = ret + "{:02X}:".format(e) if ret and ret[-1] == ":": ret = ret[:-1] return ret class sockaddr(objects.StructType): def get_address(self): ip = "" family = self.sa_family if family == 2: # AF_INET addr_in = self.cast("sockaddr_in") ip = conversion.convert_ipv4(addr_in.sin_addr.s_addr) elif family == 30: # AF_INET6 addr_in6 = self.cast("sockaddr_in6") ip = conversion.convert_ipv6(addr_in6.sin6_addr.member(attr = "__u6_addr").member(attr = "__u6_addr32")) elif family == 18: # AF_LINK addr_dl = self.cast("sockaddr_dl") ip = str(addr_dl) return ip class sysctl_oid(objects.StructType): def get_perms(self) -> str: """ Returns the actions allowed on the node Args: None Returns: A combination of: R - readable W - writeable L - self handles locking """ ret = "" checks = [0x80000000, 0x40000000, 0x00800000] perms = ["R", "W", "L"] for (i, c) in enumerate(checks): if c & self.oid_kind: ret = ret + perms[i] else: ret = ret + "-" return ret def get_ctltype(self) -> str: """ Returns the type of the sysctl node Args: None Returns: One of: CTLTYPE_NODE CTLTYPE_INT CTLTYPE_STRING CTLTYPE_QUAD CTLTYPE_OPAQUE an empty string for nodes not in the above types Based on sysctl_sysctl_debug_dump_node """ types = {1: 'CTLTYPE_NODE', 2: 'CTLTYPE_INT', 3: 'CTLTYPE_STRING', 4: 'CTLTYPE_QUAD', 5: 'CTLTYPE_OPAQUE'} ctltype = self.oid_kind & 0xf if 0 < ctltype < 6: ret = types[ctltype] else: ret = "" return ret class kauth_scope(objects.StructType): def get_listeners(self): for listener in self.ks_listeners: if listener != 0 and listener.kll_callback != 0: yield listener volatility3-1.0.1/volatility3/framework/symbols/metadata.py000066400000000000000000000026601405267600400241060ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from typing import Optional, Tuple from volatility3.framework import interfaces class WindowsMetadata(interfaces.symbols.MetadataInterface): """Class to handle the metadata from a Windows symbol table.""" @property def pe_version(self) -> Optional[Tuple]: build = self._json_data.get('pe', {}).get('build', None) revision = self._json_data.get('pe', {}).get('revision', None) minor = self._json_data.get('pe', {}).get('minor', None) major = self._json_data.get('pe', {}).get('major', None) if revision is None or minor is None or major is None: return None if build is None: return major, minor, revision return major, minor, revision, build @property def pe_version_string(self) -> Optional[str]: if self.pe_version is None: return None return ".".join(self.pe_version) @property def pdb_guid(self) -> Optional[str]: return self._json_data.get('pdb', {}).get('GUID', None) @property def pdb_age(self) -> Optional[int]: return self._json_data.get('pdb', {}).get('age', None) class LinuxMetadata(interfaces.symbols.MetadataInterface): """Class to handle the etadata from a Linux symbol table.""" volatility3-1.0.1/volatility3/framework/symbols/native.py000066400000000000000000000116001405267600400236060ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import copy from typing import Any, Dict, Iterable, Optional, Type from volatility3.framework import constants, interfaces, objects class NativeTable(interfaces.symbols.NativeTableInterface): """Symbol List that handles Native types.""" # FIXME: typing the native_dictionary as Tuple[interfaces.objects.ObjectInterface, str] throws many errors def __init__(self, name: str, native_dictionary: Dict[str, Any]) -> None: super().__init__(name, self) self._native_dictionary = copy.deepcopy(native_dictionary) self._overrides = {} # type: Dict[str, interfaces.objects.ObjectInterface] for native_type in self._native_dictionary: native_class, _native_struct = self._native_dictionary[native_type] self._overrides[native_type] = native_class # Create this once early, because it may get used a lot self._types = set(self._native_dictionary).union( {'enum', 'array', 'bitfield', 'void', 'string', 'bytes', 'function'}) def get_type_class(self, name: str) -> Type[interfaces.objects.ObjectInterface]: ntype, _ = self._native_dictionary.get(name, (objects.Integer, None)) return ntype @property def types(self) -> Iterable[str]: """Returns an iterator of the symbol type names.""" return self._types def get_type(self, type_name: str) -> interfaces.objects.Template: """Resolves a symbol name into an object template. This always construct a new python object, rather than using a cached value otherwise changes made later may affect the cached copy. Calling clone after every native type construction was extremely slow. """ # NOTE: These need updating whenever the object init signatures change prefix = "" if constants.BANG in type_name: name_split = type_name.split(constants.BANG) if len(name_split) > 2: raise ValueError("SymbolName cannot contain multiple {} separators".format(constants.BANG)) table_name, type_name = name_split prefix = table_name + constants.BANG additional = {} # type: Dict[str, Any] obj = None # type: Optional[Type[interfaces.objects.ObjectInterface]] if type_name == 'void' or type_name == 'function': obj = objects.Void elif type_name == 'array': obj = objects.Array additional = {"count": 0, "subtype": self.get_type('void')} elif type_name == 'enum': obj = objects.Enumeration additional = {"base_type": self.get_type('void'), "choices": {}} elif type_name == 'bitfield': obj = objects.BitField additional = {"start_bit": 0, "end_bit": 0, "base_type": self.get_type('void')} elif type_name == 'string': obj = objects.String additional = {"max_length": 0} elif type_name == 'bytes': obj = objects.Bytes additional = {"length": 0} if obj is not None: return objects.templates.ObjectTemplate(obj, type_name = prefix + type_name, **additional) _native_type, native_format = self._native_dictionary[type_name] if type_name == 'pointer': additional = {'subtype': self.get_type('void')} return objects.templates.ObjectTemplate( self.get_type_class(type_name), # pylint: disable=W0142 type_name = prefix + type_name, data_format = objects.DataFormatInfo(*native_format), **additional) std_ctypes = { 'int': (objects.Integer, (4, "little", True)), 'long': (objects.Integer, (4, "little", True)), 'unsigned long': (objects.Integer, (4, "little", False)), 'unsigned int': (objects.Integer, (4, "little", False)), 'char': (objects.Integer, (1, "little", True)), 'byte': (objects.Bytes, (1, "little", True)), 'unsigned char': (objects.Integer, (1, "little", False)), 'unsigned short int': (objects.Integer, (2, "little", False)), 'unsigned short': (objects.Integer, (2, "little", False)), 'unsigned be short': (objects.Integer, (2, "big", False)), 'short': (objects.Integer, (2, "little", True)), 'long long': (objects.Integer, (8, "little", True)), 'unsigned long long': (objects.Integer, (8, "little", True)), 'float': (objects.Float, (4, "little", True)), 'double': (objects.Float, (8, "little", True)), 'wchar': (objects.Integer, (2, "little", False)) } native_types = std_ctypes.copy() native_types['pointer'] = (objects.Pointer, (4, "little", False)) x86NativeTable = NativeTable("native", native_types) native_types['pointer'] = (objects.Pointer, (8, "little", False)) x64NativeTable = NativeTable("native", native_types) volatility3-1.0.1/volatility3/framework/symbols/windows/000077500000000000000000000000001405267600400234425ustar00rootroot00000000000000volatility3-1.0.1/volatility3/framework/symbols/windows/__init__.py000077500000000000000000000062341405267600400255630ustar00rootroot00000000000000# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import volatility3.framework.symbols.windows.extensions.pool from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows import extensions from volatility3.framework.symbols.windows.extensions import registry, pool class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable): def __init__(self, *args, **kwargs) -> None: super().__init__(*args, **kwargs) # Set-up windows specific types self.set_type_class('_ETHREAD', extensions.ETHREAD) self.set_type_class('_KTHREAD', extensions.KTHREAD) self.set_type_class('_LIST_ENTRY', extensions.LIST_ENTRY) self.set_type_class('_EPROCESS', extensions.EPROCESS) self.set_type_class('_UNICODE_STRING', extensions.UNICODE_STRING) self.set_type_class('_EX_FAST_REF', extensions.EX_FAST_REF) self.set_type_class('_TOKEN', extensions.TOKEN) self.set_type_class('_OBJECT_HEADER', pool.OBJECT_HEADER) self.set_type_class('_FILE_OBJECT', extensions.FILE_OBJECT) self.set_type_class('_DEVICE_OBJECT', extensions.DEVICE_OBJECT) self.set_type_class('_CM_KEY_BODY', registry.CM_KEY_BODY) self.set_type_class('_CMHIVE', registry.CMHIVE) self.set_type_class('_CM_KEY_NODE', registry.CM_KEY_NODE) self.set_type_class('_CM_KEY_VALUE', registry.CM_KEY_VALUE) self.set_type_class('_HMAP_ENTRY', registry.HMAP_ENTRY) self.set_type_class('_MMVAD_SHORT', extensions.MMVAD_SHORT) self.set_type_class('_MMVAD', extensions.MMVAD) self.set_type_class('_KSYSTEM_TIME', extensions.KSYSTEM_TIME) self.set_type_class('_KMUTANT', extensions.KMUTANT) self.set_type_class('_DRIVER_OBJECT', extensions.DRIVER_OBJECT) self.set_type_class('_OBJECT_SYMBOLIC_LINK', extensions.OBJECT_SYMBOLIC_LINK) self.set_type_class('_CONTROL_AREA', extensions.CONTROL_AREA) self.set_type_class('_SHARED_CACHE_MAP', extensions.SHARED_CACHE_MAP) self.set_type_class('_VACB', extensions.VACB) self.set_type_class('_POOL_TRACKER_BIG_PAGES', pool.POOL_TRACKER_BIG_PAGES) # This doesn't exist in very specific versions of windows try: if self.get_type("_POOL_TRACKER_BIG_PAGES").has_member("PoolType"): self.set_type_class('_POOL_HEADER', pool.POOL_HEADER_VISTA) else: self.set_type_class('_POOL_HEADER', pool.POOL_HEADER) except ValueError: pass # these don't exist in windows XP try: self.set_type_class('_MMADDRESS_NODE', extensions.MMVAD_SHORT) except ValueError: pass # these were introduced starting in windows 8 try: self.set_type_class('_MM_AVL_NODE', extensions.MMVAD_SHORT) except ValueError: pass # these were introduced starting in windows 7 try: self.set_type_class('_RTL_BALANCED_NODE', extensions.MMVAD_SHORT) except ValueError: pass volatility3-1.0.1/volatility3/framework/symbols/windows/bigpools-vista-x64.json000066400000000000000000000037271405267600400277270ustar00rootroot00000000000000{ "metadata": { "producer": { "version": "0.0.1", "name": "dlassalle-by-hand", "datetime": "2020-04-30T14:30:00.000000" }, "format": "6.2.0" }, "user_types": { "_POOL_TRACKER_BIG_PAGES": { "fields": { "Va": { "offset": 0, "type": { "kind": "base", "name": "unsigned long long" } }, "Key": { "offset": 8, "type": { "kind": "base", "name": "unsigned long" } }, "PoolType": { "offset": 12, "type": { "kind": "base", "name": "unsigned long" } }, "NumberOfBytes": { "offset": 16, "type": { "kind": "base", "name": "unsigned long long" } } }, "kind": "struct", "size": 24 } }, "symbols": { }, "enums": { "_POOL_TYPE": { "base": "unsigned long", "constants": { "NonPagedPoolBase": 0, "PagedPool": 1, "NonPagedPoolBaseMustSucceed": 2, "DontUseThisType": 3, "NonPagedPoolBaseCacheAligned": 4, "PagedPoolCacheAligned": 5, "NonPagedPoolBaseCacheAlignedMustS": 6, "MaxPoolType": 7, "NonPagedPoolMustSucceedSession": 34, "DontUseThisTypeSession": 35, "NonPagedPoolSession": 32, "NonPagedPoolNx": 512, "NonPagedPoolSessionNx": 544, "NonPagedPoolNxCacheAligned": 516, "PagedPoolSession": 33, "NonPagedPoolCacheAlignedMustSSession": 38, "PagedPoolCacheAlignedSession": 37, "NonPagedPoolCacheAlignedSession": 36 }, "size": 4 } }, "base_types": { "unsigned long long": { "endian": "little", "kind": "int", "signed": false, "size": 8 }, "unsigned long": { "endian": "little", "kind": "int", "signed": false, "size": 4 } } } volatility3-1.0.1/volatility3/framework/symbols/windows/bigpools-vista-x86.json000066400000000000000000000035231405267600400277250ustar00rootroot00000000000000{ "metadata": { "producer": { "version": "0.0.1", "name": "dlassalle-by-hand", "datetime": "2020-04-30T14:30:00.000000" }, "format": "6.2.0" }, "user_types": { "_POOL_TRACKER_BIG_PAGES": { "fields": { "Va": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "Key": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "PoolType": { "offset": 8, "type": { "kind": "base", "name": "unsigned long" } }, "NumberOfBytes": { "offset": 12, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "struct", "size": 16 } }, "symbols": { }, "enums": { "_POOL_TYPE": { "base": "unsigned long", "constants": { "NonPagedPoolBase": 0, "PagedPool": 1, "NonPagedPoolBaseMustSucceed": 2, "DontUseThisType": 3, "NonPagedPoolBaseCacheAligned": 4, "PagedPoolCacheAligned": 5, "NonPagedPoolBaseCacheAlignedMustS": 6, "MaxPoolType": 7, "NonPagedPoolMustSucceedSession": 34, "DontUseThisTypeSession": 35, "NonPagedPoolSession": 32, "NonPagedPoolNx": 512, "NonPagedPoolSessionNx": 544, "NonPagedPoolNxCacheAligned": 516, "PagedPoolSession": 33, "NonPagedPoolCacheAlignedMustSSession": 38, "PagedPoolCacheAlignedSession": 37, "NonPagedPoolCacheAlignedSession": 36 }, "size": 4 } }, "base_types": { "unsigned long": { "endian": "little", "kind": "int", "signed": false, "size": 4 } } } volatility3-1.0.1/volatility3/framework/symbols/windows/bigpools-win10-x64.json000066400000000000000000000054111405267600400275270ustar00rootroot00000000000000{ "metadata": { "producer": { "version": "0.0.1", "name": "dlassalle-by-hand", "datetime": "2020-04-30T14:30:00.000000" }, "format": "6.2.0" }, "user_types": { "_POOL_TRACKER_BIG_PAGES": { "fields": { "Va": { "offset": 0, "type": { "kind": "base", "name": "unsigned long long" } }, "Key": { "offset": 8, "type": { "kind": "base", "name": "unsigned long" } }, "Pattern": { "offset": 12, "type": { "bit_length": 8, "bit_position": 0, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned long" } } }, "PoolType": { "offset": 12, "type": { "bit_length": 8, "bit_position": 8, "kind": "bitfield", "type": { "kind": "enum", "name": "_POOL_TYPE" } } }, "SlushSize": { "offset": 12, "type": { "bit_length": 12, "bit_position": 20, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned long" } } }, "NumberOfBytes": { "offset": 16, "type": { "kind": "base", "name": "unsigned long long" } } }, "kind": "struct", "size": 24 } }, "symbols": { }, "enums": { "_POOL_TYPE": { "base": "unsigned long", "constants": { "NonPagedPoolBase": 0, "PagedPool": 1, "NonPagedPoolBaseMustSucceed": 2, "DontUseThisType": 3, "NonPagedPoolBaseCacheAligned": 4, "PagedPoolCacheAligned": 5, "NonPagedPoolBaseCacheAlignedMustS": 6, "MaxPoolType": 7, "NonPagedPoolMustSucceedSession": 34, "DontUseThisTypeSession": 35, "NonPagedPoolSession": 32, "NonPagedPoolNx": 512, "NonPagedPoolSessionNx": 544, "NonPagedPoolNxCacheAligned": 516, "PagedPoolSession": 33, "NonPagedPoolCacheAlignedMustSSession": 38, "PagedPoolCacheAlignedSession": 37, "NonPagedPoolCacheAlignedSession": 36 }, "size": 4 } }, "base_types": { "unsigned long long": { "endian": "little", "kind": "int", "signed": false, "size": 8 }, "unsigned long": { "endian": "little", "kind": "int", "signed": false, "size": 4 }, "unsigned char": { "endian": "little", "kind": "char", "signed": false, "size": 1 } } } volatility3-1.0.1/volatility3/framework/symbols/windows/bigpools-win10-x86.json000066400000000000000000000050161405267600400275340ustar00rootroot00000000000000{ "metadata": { "producer": { "version": "0.0.1", "name": "dlassalle-by-hand", "datetime": "2020-04-30T14:30:00.000000" }, "format": "6.2.0" }, "user_types": { "_POOL_TRACKER_BIG_PAGES": { "fields": { "Va": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "Key": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "Pattern": { "offset": 8, "type": { "bit_length": 8, "bit_position": 0, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned long" } } }, "PoolType": { "offset": 8, "type": { "bit_length": 8, "bit_position": 8, "kind": "bitfield", "type": { "kind": "enum", "name": "_POOL_TYPE" } } }, "SlushSize": { "offset": 8, "type": { "bit_length": 12, "bit_position": 20, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned long" } } }, "NumberOfBytes": { "offset": 12, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "struct", "size": 16 } }, "symbols": { }, "enums": { "_POOL_TYPE": { "base": "unsigned long", "constants": { "NonPagedPoolBase": 0, "PagedPool": 1, "NonPagedPoolBaseMustSucceed": 2, "DontUseThisType": 3, "NonPagedPoolBaseCacheAligned": 4, "PagedPoolCacheAligned": 5, "NonPagedPoolBaseCacheAlignedMustS": 6, "MaxPoolType": 7, "NonPagedPoolMustSucceedSession": 34, "DontUseThisTypeSession": 35, "NonPagedPoolSession": 32, "NonPagedPoolNx": 512, "NonPagedPoolSessionNx": 544, "NonPagedPoolNxCacheAligned": 516, "PagedPoolSession": 33, "NonPagedPoolCacheAlignedMustSSession": 38, "PagedPoolCacheAlignedSession": 37, "NonPagedPoolCacheAlignedSession": 36 }, "size": 4 } }, "base_types": { "unsigned long": { "endian": "little", "kind": "int", "signed": false, "size": 4 } } } volatility3-1.0.1/volatility3/framework/symbols/windows/bigpools-x64.json000066400000000000000000000030321405267600400265700ustar00rootroot00000000000000{ "metadata": { "producer": { "version": "0.0.1", "name": "dlassalle-by-hand", "datetime": "2020-04-30T14:30:00.000000" }, "format": "6.2.0" }, "user_types": { "_POOL_TRACKER_BIG_PAGES": { "fields": { "Va": { "offset": 0, "type": { "kind": "base", "name": "unsigned long long" } }, "Key": { "offset": 8, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "struct", "size": 12 } }, "symbols": { }, "enums": { "_POOL_TYPE": { "base": "unsigned long", "constants": { "NonPagedPool": 0, "PagedPool": 1, "NonPagedPoolMustSucceed": 2, "DontUseThisType": 3, "NonPagedPoolCacheAligned": 4, "PagedPoolAligned": 5, "NonPagedPoolCacheAlignedMustS": 6, "MaxPoolType": 7, "NonPagedPoolMustSucceedSession": 34, "DontUseThisTypeSession": 35, "NonPagedPoolSession": 32, "PagedPoolSession": 33, "NonPagedPoolCacheAlignedMustSSession": 38, "PagedPoolCacheAlignedSession": 37, "NonPagedPoolCacheAlignedSession": 36 }, "size": 4 } }, "base_types": { "unsigned long long": { "endian": "little", "kind": "int", "signed": false, "size": 8 }, "unsigned long": { "endian": "little", "kind": "int", "signed": false, "size": 4 } } } volatility3-1.0.1/volatility3/framework/symbols/windows/bigpools-x86.json000066400000000000000000000026271405267600400266050ustar00rootroot00000000000000{ "metadata": { "producer": { "version": "0.0.1", "name": "dlassalle-by-hand", "datetime": "2020-04-30T14:30:00.000000" }, "format": "6.2.0" }, "user_types": { "_POOL_TRACKER_BIG_PAGES": { "fields": { "Va": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "Key": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "struct", "size": 8 } }, "symbols": { }, "enums": { "_POOL_TYPE": { "base": "unsigned long", "constants": { "NonPagedPool": 0, "PagedPool": 1, "NonPagedPoolMustSucceed": 2, "DontUseThisType": 3, "NonPagedPoolCacheAligned": 4, "PagedPoolAligned": 5, "NonPagedPoolCacheAlignedMustS": 6, "MaxPoolType": 7, "NonPagedPoolMustSucceedSession": 34, "DontUseThisTypeSession": 35, "NonPagedPoolSession": 32, "PagedPoolSession": 33, "NonPagedPoolCacheAlignedMustSSession": 38, "PagedPoolCacheAlignedSession": 37, "NonPagedPoolCacheAlignedSession": 36 }, "size": 4 } }, "base_types": { "unsigned long": { "endian": "little", "kind": "int", "signed": false, "size": 4 } } } volatility3-1.0.1/volatility3/framework/symbols/windows/callbacks-x64.json000066400000000000000000000100601405267600400266700ustar00rootroot00000000000000{ "symbols": {}, "enums": {}, "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 8, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "user_types": { "_GENERIC_CALLBACK": { "fields": { "Callback": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "void" } }, "offset": 8 } }, "kind": "struct", "size": 16 }, "_KBUGCHECK_CALLBACK_RECORD": { "fields": { "Entry": { "type": { "kind": "struct", "name": "nt_symbols!_LIST_ENTRY" }, "offset": 0 }, "CallbackRoutine": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "void" } }, "offset": 16 }, "Component": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned char" } }, "offset": 40 } }, "kind": "struct", "size": 64 }, "_KBUGCHECK_REASON_CALLBACK_RECORD": { "fields": { "Entry": { "type": { "kind": "struct", "name": "nt_symbols!_LIST_ENTRY" }, "offset": 0 }, "CallbackRoutine": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "void" } }, "offset": 16 }, "Component": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned char" } }, "offset": 40 } }, "kind": "struct", "size": 64 }, "_EX_CALLBACK_ROUTINE_BLOCK": { "fields": { "Function": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "void" } }, "offset": 8 } }, "kind": "struct", "size": 64 } }, "metadata": { "producer": { "version": "0.0.1", "name": "mhl by hand", "datetime": "2019-08-27T18:17:16.417006" }, "format": "4.0.0" } }volatility3-1.0.1/volatility3/framework/symbols/windows/callbacks-x86.json000066400000000000000000000101371405267600400267010ustar00rootroot00000000000000{ "symbols": {}, "enums": {}, "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "user_types": { "_GENERIC_CALLBACK": { "fields": { "Callback": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "void" } }, "offset": 4 } }, "kind": "struct", "size": 8 }, "_KBUGCHECK_CALLBACK_RECORD": { "fields": { "Entry": { "type": { "kind": "struct", "name": "nt_symbols!_LIST_ENTRY" }, "offset": 0 }, "CallbackRoutine": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "void" } }, "offset": 8 }, "Component": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned char" } }, "offset": 20 } }, "kind": "struct", "size": 32 }, "_KBUGCHECK_REASON_CALLBACK_RECORD": { "fields": { "Entry": { "type": { "kind": "struct", "name": "nt_symbols!_LIST_ENTRY" }, "offset": 0 }, "CallbackRoutine": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "void" } }, "offset": 8 }, "Component": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned char" } }, "offset": 12 } }, "kind": "struct", "size": 28 }, "_EX_CALLBACK_ROUTINE_BLOCK": { "fields": { "Function": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "void" } }, "offset": 4 } }, "kind": "struct", "size": 28 } }, "metadata": { "producer": { "version": "0.0.1", "name": "mhl by hand", "datetime": "2019-08-27T18:17:16.417006" }, "format": "4.0.0" } }volatility3-1.0.1/volatility3/framework/symbols/windows/crash.json000066400000000000000000000216531405267600400254440ustar00rootroot00000000000000{ "symbols": { }, "user_types": { "_DUMP_HEADER": { "fields": { "Signature": { "offset": 0, "type": { "count": 4, "kind": "array", "subtype": { "kind": "base", "name": "unsigned char" } } }, "ValidDump": { "offset": 4, "type": { "count": 4, "kind": "array", "subtype": { "kind": "base", "name": "unsigned char" } } }, "MajorVersion": { "offset": 8, "type": { "kind": "base", "name": "unsigned long" } }, "MinorVersion": { "offset": 12, "type": { "kind": "base", "name": "unsigned long" } }, "DirectoryTableBase": { "offset": 16, "type": { "kind": "base", "name": "unsigned long" } }, "PfnDataBase": { "offset": 20, "type": { "kind": "base", "name": "unsigned long" } }, "PsLoadedModuleList": { "offset": 24, "type": { "kind": "base", "name": "unsigned long" } }, "PsActiveProcessHead": { "offset": 28, "type": { "kind": "base", "name": "unsigned long" } }, "MachineImageType": { "offset": 32, "type": { "kind": "base", "name": "unsigned long" } }, "NumberProcessors": { "offset": 36, "type": { "kind": "base", "name": "unsigned long" } }, "BugCheckCode": { "offset": 40, "type": { "kind": "base", "name": "unsigned long" } }, "BugCheckCodeParameter": { "offset": 44, "type": { "count": 4, "kind": "array", "subtype": { "kind": "base", "name": "unsigned long" } } }, "VersionUser": { "offset": 60, "type": { "count": 32, "kind": "array", "subtype": { "kind": "base", "name": "unsigned char" } } }, "PaeEnabled": { "offset": 92, "type": { "kind": "base", "name": "unsigned char" } }, "KdSecondaryVersion": { "offset": 93, "type": { "kind": "base", "name": "unsigned char" } }, "VersionUser2": { "offset": 94, "type": { "count": 2, "kind": "array", "subtype": { "kind": "base", "name": "unsigned char" } } }, "KdDebuggerDataBlock": { "offset": 96, "type": { "kind": "base", "name": "unsigned long" } }, "PhysicalMemoryBlockBuffer": { "offset": 100, "type": { "kind": "struct", "name": "_PHYSICAL_MEMORY_DESCRIPTOR" } }, "ContextRecord": { "offset": 800, "type": { "count": 1200, "kind": "array", "subtype": { "kind": "base", "name": "unsigned char" } } }, "Exception": { "offset": 2000, "type": { "kind": "struct", "name": "_EXCEPTION_RECORD32" } }, "Comment": { "offset": 2080, "type": { "count": 128, "kind": "array", "subtype": { "kind": "base", "name": "unsigned char" } } }, "DumpType": { "offset": 3976, "type": { "kind": "base", "name": "unsigned long" } }, "MiniDumpFields": { "offset": 3980, "type": { "kind": "base", "name": "unsigned long" } }, "SecondaryDataState": { "offset": 3984, "type": { "kind": "base", "name": "unsigned long" } }, "ProductType": { "offset": 3988, "type": { "kind": "base", "name": "unsigned long" } }, "SuiteMask": { "offset": 3992, "type": { "kind": "base", "name": "unsigned long" } }, "WriterStatus": { "offset": 3996, "type": { "kind": "base", "name": "unsigned long" } }, "RequiredDumpSpace": { "offset": 4000, "type": { "kind": "base", "name": "unsigned long long" } }, "SystemUpTime": { "offset": 4024, "type": { "kind": "base", "name": "unsigned long long" } }, "SystemTime": { "offset": 4032, "type": { "kind": "base", "name": "unsigned long long" } }, "reserved3": { "offset": 4040, "type": { "count": 56, "kind": "array", "subtype": { "kind": "base", "name": "unsigned char" } } } }, "kind": "struct", "size": 4096 }, "_EXCEPTION_RECORD32": { "fields": { "ExceptionCode": { "offset": 0, "type": { "kind": "base", "name": "long" } }, "ExceptionFlags": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "ExceptionRecord": { "offset": 8, "type": { "kind": "base", "name": "unsigned long" } }, "ExceptionAddress": { "offset": 12, "type": { "kind": "base", "name": "unsigned long" } }, "NumberParameters": { "offset": 16, "type": { "kind": "base", "name": "unsigned long" } }, "ExceptionInformation": { "offset": 20, "type": { "count": 15, "kind": "array", "subtype": { "kind": "base", "name": "unsigned long" } } } }, "kind": "struct", "size": 80 }, "_PHYSICAL_MEMORY_DESCRIPTOR": { "fields": { "NumberOfPages": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "NumberOfRuns": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "Run": { "offset": 8, "type": { "count": 1, "kind": "array", "subtype": { "kind": "struct", "name": "_PHYSICAL_MEMORY_RUN" } } } }, "kind": "struct", "size": 16 }, "_PHYSICAL_MEMORY_RUN": { "fields": { "BasePage": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "PageCount": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "struct", "size": 8 } }, "enums": { }, "base_types": { "unsigned char": { "endian": "little", "kind": "char", "signed": false, "size": 1 }, "unsigned short": { "endian": "little", "kind": "int", "signed": false, "size": 2 }, "long": { "endian": "little", "kind": "int", "signed": true, "size": 4 }, "char": { "endian": "little", "kind": "char", "signed": true, "size": 1 }, "unsigned long": { "endian": "little", "kind": "int", "signed": false, "size": 4 }, "long long": { "endian": "little", "kind": "int", "signed": true, "size": 8 }, "unsigned long long": { "endian": "little", "kind": "int", "signed": false, "size": 8 } }, "metadata": { "producer": { "version": "0.0.2", "name": "awalters-by-hand", "datetime": "2018-05-01T16:30:00" }, "format": "4.1.0" } } volatility3-1.0.1/volatility3/framework/symbols/windows/crash64.json000066400000000000000000000245131405267600400256140ustar00rootroot00000000000000{ "symbols": { }, "user_types": { "_DUMP_HEADER64": { "fields": { "Signature": { "offset": 0, "type": { "count": 4, "kind": "array", "subtype": { "kind": "base", "name": "unsigned char" } } }, "ValidDump": { "offset": 4, "type": { "count": 4, "kind": "array", "subtype": { "kind": "base", "name": "unsigned char" } } }, "MajorVersion": { "offset": 8, "type": { "kind": "base", "name": "unsigned long" } }, "MinorVersion": { "offset": 12, "type": { "kind": "base", "name": "unsigned long" } }, "DirectoryTableBase": { "offset": 16, "type": { "kind": "base", "name": "unsigned long long" } }, "PfnDataBase": { "offset": 24, "type": { "kind": "base", "name": "unsigned long long" } }, "PsLoadedModuleList": { "offset": 32, "type": { "kind": "base", "name": "unsigned long long" } }, "PsActiveProcessHead": { "offset": 40, "type": { "kind": "base", "name": "unsigned long" } }, "MachineImageType": { "offset": 44, "type": { "kind": "base", "name": "unsigned long" } }, "NumberProcessors": { "offset": 48, "type": { "kind": "base", "name": "unsigned long" } }, "BugCheckCode": { "offset": 60, "type": { "kind": "base", "name": "unsigned long" } }, "BugCheckCodeParameter": { "offset": 64, "type": { "count": 4, "kind": "array", "subtype": { "kind": "base", "name": "unsigned long long" } } }, "VersionUser": { "offset": 96, "type": { "count": 32, "kind": "array", "subtype": { "kind": "base", "name": "unsigned char" } } }, "KdDebuggerDataBlock": { "offset": 128, "type": { "kind": "base", "name": "unsigned long long" } }, "PhysicalMemoryBlockBuffer": { "offset": 136, "type": { "kind": "struct", "name": "_PHYSICAL_MEMORY_DESCRIPTOR64" } }, "ContextRecord": { "offset": 840, "type": { "count": 3000, "kind": "array", "subtype": { "kind": "base", "name": "unsigned char" } } }, "Exception": { "offset": 3840, "type": { "kind": "struct", "name": "_EXCEPTION_RECORD64" } }, "DumpType": { "offset": 3992, "type": { "kind": "base", "name": "unsigned long" } }, "RequiredDumpSpace": { "offset": 4000, "type": { "kind": "base", "name": "unsigned long long" } }, "SystemUpTime": { "offset": 4008, "type": { "kind": "base", "name": "unsigned long long" } }, "Comment": { "offset": 4016, "type": { "count": 128, "kind": "array", "subtype": { "kind": "base", "name": "unsigned char" } } }, "SystemTime": { "offset": 4144, "type": { "kind": "base", "name": "unsigned long long" } }, "MiniDumpFields": { "offset": 4152, "type": { "kind": "base", "name": "unsigned long" } }, "SecondaryDataState": { "offset": 4156, "type": { "kind": "base", "name": "unsigned long" } }, "ProductType": { "offset": 4160, "type": { "kind": "base", "name": "unsigned long" } }, "SuiteMask": { "offset": 4164, "type": { "kind": "base", "name": "unsigned long" } }, "WriterStatus": { "offset": 4168, "type": { "kind": "base", "name": "unsigned long" } }, "Unused1": { "offset": 4172, "type": { "kind": "base", "name": "unsigned char" } }, "KdSecondaryVersion": { "offset": 4173, "type": { "kind": "base", "name": "unsigned char" } }, "Unused2": { "offset": 4174, "type": { "kind": "base", "name": "unsigned char" } } }, "kind": "struct", "size": 8192 }, "_SUMMARY_DUMP64": { "fields": { "Signature": { "offset": 0, "type": { "count": 4, "kind": "array", "subtype": { "kind": "base", "name": "unsigned char" } } }, "ValidDump": { "offset": 4, "type": { "count": 4, "kind": "array", "subtype": { "kind": "base", "name": "unsigned char" } } }, "DumpOptions": { "offset": 8, "type": { "kind": "base", "name": "unsigned long" } }, "HeaderSize": { "offset": 32, "type": { "kind": "base", "name": "unsigned long long" } }, "BitmapSize": { "offset": 40, "type": { "kind": "base", "name": "unsigned long long" } }, "Pages": { "offset": 48, "type": { "kind": "base", "name": "unsigned long long" } }, "BufferLong": { "offset": 56, "type": { "kind": "array", "count": 1, "subtype": { "kind": "base", "name": "unsigned long" } } }, "BufferChar": { "offset": 56, "type": { "kind": "array", "count": 1, "subtype": { "kind": "base", "name": "unsigned char" } } } }, "kind": "struct", "size": 56 }, "_EXCEPTION_RECORD64": { "fields": { "ExceptionCode": { "offset": 0, "type": { "kind": "base", "name": "long" } }, "ExceptionFlags": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "ExceptionRecord": { "offset": 8, "type": { "kind": "base", "name": "unsigned long long" } }, "ExceptionAddress": { "offset": 16, "type": { "kind": "base", "name": "unsigned long long" } }, "NumberParameters": { "offset": 24, "type": { "kind": "base", "name": "unsigned long" } }, "ExceptionInformation": { "offset": 32, "type": { "count": 15, "kind": "array", "subtype": { "kind": "base", "name": "unsigned long long" } } } }, "kind": "struct", "size": 152 }, "_PHYSICAL_MEMORY_DESCRIPTOR64": { "fields": { "NumberOfPages": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "NumberOfRuns": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "Run": { "offset": 16, "type": { "count": 1, "kind": "array", "subtype": { "kind": "struct", "name": "_PHYSICAL_MEMORY_RUN64" } } } }, "kind": "struct", "size": 20 }, "_PHYSICAL_MEMORY_RUN64": { "fields": { "BasePage": { "offset": 0, "type": { "kind": "base", "name": "unsigned long long" } }, "PageCount": { "offset": 8, "type": { "kind": "base", "name": "unsigned long long" } } }, "kind": "struct", "size": 16 } }, "enums": { }, "base_types": { "unsigned char": { "endian": "little", "kind": "char", "signed": false, "size": 1 }, "unsigned short": { "endian": "little", "kind": "int", "signed": false, "size": 2 }, "long": { "endian": "little", "kind": "int", "signed": true, "size": 4 }, "char": { "endian": "little", "kind": "char", "signed": true, "size": 1 }, "unsigned long": { "endian": "little", "kind": "int", "signed": false, "size": 4 }, "long long": { "endian": "little", "kind": "int", "signed": true, "size": 8 }, "unsigned long long": { "endian": "little", "kind": "int", "signed": false, "size": 8 } }, "metadata": { "producer": { "version": "0.0.1", "name": "ikelos-by-hand", "datetime": "2020-09-10T00:20:00" }, "format": "6.2.0" } } volatility3-1.0.1/volatility3/framework/symbols/windows/extensions/000077500000000000000000000000001405267600400256415ustar00rootroot00000000000000volatility3-1.0.1/volatility3/framework/symbols/windows/extensions/__init__.py000077500000000000000000001366701405267600400277720ustar00rootroot00000000000000# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import collections.abc import datetime import functools import logging import math from typing import Iterable, Iterator, Optional, Union, Tuple, List from volatility3.framework import constants, exceptions, interfaces, objects, renderers, symbols from volatility3.framework.layers import intel from volatility3.framework.renderers import conversion from volatility3.framework.symbols import generic from volatility3.framework.symbols.windows.extensions import pool, pe, kdbg vollog = logging.getLogger(__name__) # Keep these in a basic module, to prevent import cycles when symbol providers require them class KSYSTEM_TIME(objects.StructType): """A system time structure that stores a high and low part.""" def get_time(self): wintime = (self.High1Time << 32) | self.LowPart return conversion.wintime_to_datetime(wintime) class MMVAD_SHORT(objects.StructType): """A class that represents process virtual memory ranges. Each instance is a node in a binary tree structure and is pointed to by VadRoot. """ @functools.lru_cache(maxsize = None) def get_tag(self): vad_address = self.vol.offset # the offset is different on 32 and 64 bits symbol_table_name = self.vol.type_name.split(constants.BANG)[0] if not symbols.symbol_table_is_64bit(self._context, symbol_table_name): vad_address -= 4 else: vad_address -= 12 try: # TODO: instantiate a _POOL_HEADER and return PoolTag bytesobj = self._context.object(symbol_table_name + constants.BANG + "bytes", layer_name = self.vol.layer_name, offset = vad_address, native_layer_name = self.vol.native_layer_name, length = 4) return bytesobj.decode() except exceptions.InvalidAddressException: return None except UnicodeDecodeError: return None def traverse(self, visited = None, depth = 0): """Traverse the VAD tree, determining each underlying VAD node type by looking up the pool tag for the structure and then casting into a new object.""" # TODO: this is an arbitrary limit chosen based on past observations if depth > 100: vollog.log(constants.LOGLEVEL_VVV, "Vad tree is too deep, something went wrong!") raise RuntimeError("Vad tree is too deep") if visited is None: visited = set() vad_address = self.vol.offset if vad_address in visited: vollog.log(constants.LOGLEVEL_VVV, "VAD node already seen!") return visited.add(vad_address) tag = self.get_tag() if tag in ["VadS", "VadF"]: target = "_MMVAD_SHORT" elif tag != None and tag.startswith("Vad"): target = "_MMVAD" elif depth == 0: # the root node at depth 0 is allowed to not have a tag # but we still want to continue and access its right & left child target = None else: # any node other than the root that doesn't have a recognized tag # is just garbage and we skip the node entirely vollog.log(constants.LOGLEVEL_VVV, "Skipping VAD at {} depth {} with tag {}".format(self.vol.offset, depth, tag)) return if target: vad_object = self.cast(target) yield vad_object try: for vad_node in self.get_left_child().dereference().traverse(visited, depth + 1): yield vad_node except exceptions.InvalidAddressException as excp: vollog.log(constants.LOGLEVEL_VVV, "Invalid address on LeftChild: {0:#x}".format(excp.invalid_address)) try: for vad_node in self.get_right_child().dereference().traverse(visited, depth + 1): yield vad_node except exceptions.InvalidAddressException as excp: vollog.log(constants.LOGLEVEL_VVV, "Invalid address on RightChild: {0:#x}".format(excp.invalid_address)) def get_right_child(self): """Get the right child member.""" if self.has_member("RightChild"): return self.RightChild elif self.has_member("Right"): return self.Right # this is for windows 8 and 10 elif self.has_member("VadNode"): if self.VadNode.has_member("RightChild"): return self.VadNode.RightChild if self.VadNode.has_member("Right"): return self.VadNode.Right # also for windows 8 and 10 elif self.has_member("Core"): if self.Core.has_member("VadNode"): if self.Core.VadNode.has_member("RightChild"): return self.Core.VadNode.RightChild if self.Core.VadNode.has_member("Right"): return self.Core.VadNode.Right raise AttributeError("Unable to find the right child member") def get_left_child(self): """Get the left child member.""" if self.has_member("LeftChild"): return self.LeftChild elif self.has_member("Left"): return self.Left # this is for windows 8 and 10 elif self.has_member("VadNode"): if self.VadNode.has_member("LeftChild"): return self.VadNode.LeftChild if self.VadNode.has_member("Left"): return self.VadNode.Left # also for windows 8 and 10 elif self.has_member("Core"): if self.Core.has_member("VadNode"): if self.Core.VadNode.has_member("LeftChild"): return self.Core.VadNode.LeftChild if self.Core.VadNode.has_member("Left"): return self.Core.VadNode.Left raise AttributeError("Unable to find the left child member") def get_parent(self): """Get the VAD's parent member.""" # this is for xp and 2003 if self.has_member("Parent"): return self.Parent # this is for vista through windows 7 elif self.has_member("u1") and self.u1.has_member("Parent"): return self.u1.Parent & ~0x3 # this is for windows 8 and 10 elif self.has_member("VadNode"): if self.VadNode.has_member("u1"): return self.VadNode.u1.Parent & ~0x3 elif self.VadNode.has_member("ParentValue"): return self.VadNode.ParentValue & ~0x3 # also for windows 8 and 10 elif self.has_member("Core"): if self.Core.VadNode.has_member("u1"): return self.Core.VadNode.u1.Parent & ~0x3 elif self.Core.VadNode.has_member("ParentValue"): return self.Core.VadNode.ParentValue & ~0x3 raise AttributeError("Unable to find the parent member") def get_start(self): """Get the VAD's starting virtual address.""" if self.has_member("StartingVpn"): if self.has_member("StartingVpnHigh"): return (self.StartingVpn << 12) | (self.StartingVpnHigh << 44) else: return self.StartingVpn << 12 elif self.has_member("Core"): if self.Core.has_member("StartingVpnHigh"): return (self.Core.StartingVpn << 12) | (self.Core.StartingVpnHigh << 44) else: return self.Core.StartingVpn << 12 raise AttributeError("Unable to find the starting VPN member") def get_end(self): """Get the VAD's ending virtual address.""" if self.has_member("EndingVpn"): if self.has_member("EndingVpnHigh"): return (((self.EndingVpn + 1) << 12) | (self.EndingVpnHigh << 44)) - 1 else: return ((self.EndingVpn + 1) << 12) - 1 elif self.has_member("Core"): if self.Core.has_member("EndingVpnHigh"): return (((self.Core.EndingVpn + 1) << 12) | (self.Core.EndingVpnHigh << 44)) - 1 else: return ((self.Core.EndingVpn + 1) << 12) - 1 raise AttributeError("Unable to find the ending VPN member") def get_commit_charge(self): """Get the VAD's commit charge (number of committed pages)""" if self.has_member("u1") and self.u1.has_member("VadFlags1"): return self.u1.VadFlags1.CommitCharge elif self.has_member("u") and self.u.has_member("VadFlags"): return self.u.VadFlags.CommitCharge elif self.has_member("Core"): return self.Core.u1.VadFlags1.CommitCharge raise AttributeError("Unable to find the commit charge member") def get_private_memory(self): """Get the VAD's private memory setting.""" if self.has_member("u1") and self.u1.has_member("VadFlags1") and self.u1.VadFlags1.has_member("PrivateMemory"): return self.u1.VadFlags1.PrivateMemory elif self.has_member("u") and self.u.has_member("VadFlags") and self.u.VadFlags.has_member("PrivateMemory"): return self.u.VadFlags.PrivateMemory elif self.has_member("Core"): if (self.Core.has_member("u1") and self.Core.u1.has_member("VadFlags1") and self.Core.u1.VadFlags1.has_member("PrivateMemory")): return self.Core.u1.VadFlags1.PrivateMemory elif (self.Core.has_member("u") and self.Core.u.has_member("VadFlags") and self.Core.u.VadFlags.has_member("PrivateMemory")): return self.Core.u.VadFlags.PrivateMemory raise AttributeError("Unable to find the private memory member") def get_protection(self, protect_values, winnt_protections): """Get the VAD's protection constants as a string.""" protect = None if self.has_member("u"): protect = self.u.VadFlags.Protection elif self.has_member("Core"): protect = self.Core.u.VadFlags.Protection try: value = protect_values[protect] except IndexError: value = 0 names = [] for name, mask in winnt_protections.items(): if value & mask != 0: names.append(name) return "|".join(names) def get_file_name(self): """Only long(er) vads have mapped files.""" return renderers.NotApplicableValue() class MMVAD(MMVAD_SHORT): """A version of the process virtual memory range structure that contains additional fields necessary to map files from disk.""" def get_file_name(self): """Get the name of the file mapped into the memory range (if any)""" file_name = renderers.NotApplicableValue() try: # this is for xp and 2003 if self.has_member("ControlArea"): file_name = self.ControlArea.FilePointer.FileName.get_string() # this is for vista through windows 7 else: file_name = self.Subsection.ControlArea.FilePointer.dereference().cast( "_FILE_OBJECT").FileName.get_string() except exceptions.InvalidAddressException: pass return file_name class EX_FAST_REF(objects.StructType): """This is a standard Windows structure that stores a pointer to an object but also leverages the least significant bits to encode additional details. When dereferencing the pointer, we need to strip off the extra bits. """ def dereference(self) -> interfaces.objects.ObjectInterface: if constants.BANG not in self.vol.type_name: raise ValueError("Invalid symbol table name syntax (no {} found)".format(constants.BANG)) # the mask value is different on 32 and 64 bits symbol_table_name = self.vol.type_name.split(constants.BANG)[0] if not symbols.symbol_table_is_64bit(self._context, symbol_table_name): max_fast_ref = 7 else: max_fast_ref = 15 return self._context.object(symbol_table_name + constants.BANG + "pointer", layer_name = self.vol.layer_name, offset = self.Object & ~max_fast_ref, native_layer_name = self.vol.native_layer_name) class DEVICE_OBJECT(objects.StructType, pool.ExecutiveObject): """A class for kernel device objects.""" def get_device_name(self) -> str: header = self.get_object_header() return header.NameInfo.Name.String # type: ignore class DRIVER_OBJECT(objects.StructType, pool.ExecutiveObject): """A class for kernel driver objects.""" def get_driver_name(self) -> str: header = self.get_object_header() return header.NameInfo.Name.String # type: ignore def is_valid(self) -> bool: """Determine if the object is valid.""" return True class OBJECT_SYMBOLIC_LINK(objects.StructType, pool.ExecutiveObject): """A class for kernel link objects.""" def get_link_name(self) -> str: header = self.get_object_header() return header.NameInfo.Name.String # type: ignore def is_valid(self) -> bool: """Determine if the object is valid.""" return True def get_create_time(self): return conversion.wintime_to_datetime(self.CreationTime.QuadPart) class FILE_OBJECT(objects.StructType, pool.ExecutiveObject): """A class for windows file objects.""" def is_valid(self) -> bool: """Determine if the object is valid.""" return self.FileName.Length > 0 and self._context.layers[self.FileName.Buffer.vol.native_layer_name].is_valid( self.FileName.Buffer) def file_name_with_device(self) -> Union[str, interfaces.renderers.BaseAbsentValue]: name = renderers.UnreadableValue() # type: Union[str, interfaces.renderers.BaseAbsentValue] # this pointer needs to be checked against native_layer_name because the object may # be instantiated from a primary (virtual) layer or a memory (physical) layer. if self._context.layers[self.vol.native_layer_name].is_valid(self.DeviceObject): try: name = "\\Device\\{}".format(self.DeviceObject.get_device_name()) except ValueError: pass try: name += self.FileName.String except (TypeError, exceptions.InvalidAddressException): pass return name def access_string(self): ## Make a nicely formatted ACL string return (('R' if self.ReadAccess else '-') + ('W' if self.WriteAccess else '-') + ('D' if self.DeleteAccess else '-') + ('r' if self.SharedRead else '-') + ('w' if self.SharedWrite else '-') + ('d' if self.SharedDelete else '-')) class KMUTANT(objects.StructType, pool.ExecutiveObject): """A class for windows mutant objects.""" def is_valid(self) -> bool: """Determine if the object is valid.""" return True def get_name(self) -> str: """Get the object's name from the object header.""" header = self.get_object_header() return header.NameInfo.Name.String # type: ignore class ETHREAD(objects.StructType): """A class for executive thread objects.""" def owning_process(self, kernel_layer: str = None) -> interfaces.objects.ObjectInterface: """Return the EPROCESS that owns this thread.""" return self.ThreadsProcess.dereference(kernel_layer) def get_cross_thread_flags(self) -> str: dictCrossThreadFlags = { 'PS_CROSS_THREAD_FLAGS_TERMINATED': 0, 'PS_CROSS_THREAD_FLAGS_DEADTHREAD': 1, 'PS_CROSS_THREAD_FLAGS_HIDEFROMDBG': 2, 'PS_CROSS_THREAD_FLAGS_IMPERSONATING': 3, 'PS_CROSS_THREAD_FLAGS_SYSTEM': 4, 'PS_CROSS_THREAD_FLAGS_HARD_ERRORS_DISABLED': 5, 'PS_CROSS_THREAD_FLAGS_BREAK_ON_TERMINATION': 6, 'PS_CROSS_THREAD_FLAGS_SKIP_CREATION_MSG': 7, 'PS_CROSS_THREAD_FLAGS_SKIP_TERMINATION_MSG': 8 } flags = self.CrossThreadFlags stringCrossThreadFlags = '' for flag in dictCrossThreadFlags: if flags & 2 ** dictCrossThreadFlags[flag]: stringCrossThreadFlags += '{} '.format(flag) return stringCrossThreadFlags[:-1] if stringCrossThreadFlags else stringCrossThreadFlags class UNICODE_STRING(objects.StructType): """A class for Windows unicode string structures.""" def get_string(self) -> interfaces.objects.ObjectInterface: # We explicitly do *not* catch errors here, we allow an exception to be thrown # (otherwise there's no way to determine anything went wrong) # It's up to the user of this method to catch exceptions return self.Buffer.dereference().cast("string", max_length = self.Length, errors = "replace", encoding = "utf16") String = property(get_string) class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): """A class for executive kernel processes objects.""" def is_valid(self) -> bool: """Determine if the object is valid.""" try: name = objects.utility.array_to_string(self.ImageFileName) if not name or len(name) == 0 or name[0] == "\x00": return False # The System/PID 4 process has no create time if not (str(name) == "System" and self.UniqueProcessId == 4): if self.CreateTime.QuadPart == 0: return False ctime = self.get_create_time() if not isinstance(ctime, datetime.datetime): return False if not (1998 < ctime.year < 2030): return False # NT pids are divisible by 4 if self.UniqueProcessId % 4 != 0: return False # check for all 0s besides the PCID entries if isinstance(self.Pcb.DirectoryTableBase, objects.Array): dtb = self.Pcb.DirectoryTableBase.cast("pointer") else: dtb = self.Pcb.DirectoryTableBase if dtb == 0: return False # check for all 0s besides the PCID entries if dtb & ~0xfff == 0: return False ## TODO: we can also add the thread Flink and Blink tests if necessary except exceptions.InvalidAddressException: return False return True def add_process_layer(self, config_prefix: str = None, preferred_name: str = None): """Constructs a new layer based on the process's DirectoryTableBase.""" parent_layer = self._context.layers[self.vol.layer_name] if not isinstance(parent_layer, intel.Intel): # We can't get bits_per_register unless we're an intel space (since that's not defined at the higher layer) raise TypeError("Parent layer is not a translation layer, unable to construct process layer") # Presumably for 64-bit systems, the DTB is defined as an array, rather than an unsigned long long dtb = 0 # type: int if isinstance(self.Pcb.DirectoryTableBase, objects.Array): dtb = self.Pcb.DirectoryTableBase.cast("unsigned long long") else: dtb = self.Pcb.DirectoryTableBase dtb = dtb & ((1 << parent_layer.bits_per_register) - 1) if preferred_name is None: preferred_name = self.vol.layer_name + "_Process{}".format(self.UniqueProcessId) # Add the constructed layer and return the name return self._add_process_layer(self._context, dtb, config_prefix, preferred_name) def get_peb(self) -> interfaces.objects.ObjectInterface: """Constructs a PEB object""" if constants.BANG not in self.vol.type_name: raise ValueError("Invalid symbol table name syntax (no {} found)".format(constants.BANG)) # add_process_layer can raise InvalidAddressException. # if that happens, we let the exception propagate upwards proc_layer_name = self.add_process_layer() proc_layer = self._context.layers[proc_layer_name] if not proc_layer.is_valid(self.Peb): raise exceptions.InvalidAddressException(proc_layer_name, self.Peb, "Invalid address at {:0x}".format(self.Peb)) sym_table = self.vol.type_name.split(constants.BANG)[0] peb = self._context.object("{}{}_PEB".format(sym_table, constants.BANG), layer_name = proc_layer_name, offset = self.Peb) return peb def load_order_modules(self) -> Iterable[interfaces.objects.ObjectInterface]: """Generator for DLLs in the order that they were loaded.""" try: peb = self.get_peb() for entry in peb.Ldr.InLoadOrderModuleList.to_list( "{}{}_LDR_DATA_TABLE_ENTRY".format(self.get_symbol_table_name(), constants.BANG), "InLoadOrderLinks"): yield entry except exceptions.InvalidAddressException: return def init_order_modules(self) -> Iterable[interfaces.objects.ObjectInterface]: """Generator for DLLs in the order that they were initialized""" try: peb = self.get_peb() for entry in peb.Ldr.InInitializationOrderModuleList.to_list( "{}{}_LDR_DATA_TABLE_ENTRY".format(self.get_symbol_table_name(), constants.BANG), "InInitializationOrderLinks"): yield entry except exceptions.InvalidAddressException: return def mem_order_modules(self) -> Iterable[interfaces.objects.ObjectInterface]: """Generator for DLLs in the order that they appear in memory""" try: peb = self.get_peb() for entry in peb.Ldr.InMemoryOrderModuleList.to_list( "{}{}_LDR_DATA_TABLE_ENTRY".format(self.get_symbol_table_name(), constants.BANG), "InMemoryOrderLinks"): yield entry except exceptions.InvalidAddressException: return def get_handle_count(self): try: if self.has_member("ObjectTable"): if self.ObjectTable.has_member("HandleCount"): return self.ObjectTable.HandleCount except exceptions.InvalidAddressException: vollog.log(constants.LOGLEVEL_VVV, "Cannot access _EPROCESS.ObjectTable.HandleCount at {0:#x}".format(self.vol.offset)) return renderers.UnreadableValue() def get_session_id(self): try: if self.has_member("Session"): if self.Session == 0: return renderers.NotApplicableValue() symbol_table_name = self.get_symbol_table_name() kvo = self._context.layers[self.vol.native_layer_name].config['kernel_virtual_offset'] ntkrnlmp = self._context.module(symbol_table_name, layer_name = self.vol.native_layer_name, offset = kvo, native_layer_name = self.vol.native_layer_name) session = ntkrnlmp.object(object_type = "_MM_SESSION_SPACE", offset = self.Session, absolute = True) if session.has_member("SessionId"): return session.SessionId except exceptions.InvalidAddressException: vollog.log(constants.LOGLEVEL_VVV, "Cannot access _EPROCESS.Session.SessionId at {0:#x}".format(self.vol.offset)) return renderers.UnreadableValue() def get_create_time(self): return conversion.wintime_to_datetime(self.CreateTime.QuadPart) def get_exit_time(self): return conversion.wintime_to_datetime(self.ExitTime.QuadPart) def get_wow_64_process(self): if self.has_member("Wow64Process"): return self.Wow64Process elif self.has_member("WoW64Process"): return self.WoW64Process raise AttributeError("Unable to find Wow64Process") def get_is_wow64(self): try: value = self.get_wow_64_process() except AttributeError: return False return value != 0 and value != None def get_vad_root(self): # windows 8 and 2012 (_MM_AVL_TABLE) if self.VadRoot.has_member("BalancedRoot"): return self.VadRoot.BalancedRoot # windows 8.1 and windows 10 (_RTL_AVL_TREE) elif self.VadRoot.has_member("Root"): return self.VadRoot.Root.dereference() # .cast("_MMVAD") else: # windows xp and 2003 return self.VadRoot.dereference().cast("_MMVAD") def environment_variables(self): """Generator for environment variables. The PEB points to our env block - a series of null-terminated unicode strings. Each string cannot be more than 0x7FFF chars. End of the list is a quad-null. """ context = self._context process_space = self.add_process_layer() try: block = self.get_peb().ProcessParameters.Environment try: block_size = self.get_peb().ProcessParameters.EnvironmentSize except AttributeError: # Windows XP block_size = self.get_peb().ProcessParameters.Length envars = context.layers[process_space].read(block, block_size).decode("utf-16-le", errors = 'replace').split('\x00')[:-1] except exceptions.InvalidAddressException: return renderers.UnreadableValue() for envar in envars: split_index = envar.find('=') env = envar[:split_index] var = envar[split_index + 1:] # Exlude parse problem with some types of env if env and var: yield env, var class LIST_ENTRY(objects.StructType, collections.abc.Iterable): """A class for double-linked lists on Windows.""" def to_list(self, symbol_type: str, member: str, forward: bool = True, sentinel: bool = True, layer: Optional[str] = None) -> Iterator[interfaces.objects.ObjectInterface]: """Returns an iterator of the entries in the list.""" layer = layer or self.vol.layer_name relative_offset = self._context.symbol_space.get_type(symbol_type).relative_child_offset(member) direction = 'Blink' if forward: direction = 'Flink' trans_layer = self._context.layers[layer] try: trans_layer.is_valid(self.vol.offset) link = getattr(self, direction).dereference() except exceptions.InvalidAddressException: return if not sentinel: yield self._context.object(symbol_type, layer, offset = self.vol.offset - relative_offset, native_layer_name = layer or self.vol.native_layer_name) seen = {self.vol.offset} while link.vol.offset not in seen: obj_offset = link.vol.offset - relative_offset try: trans_layer.is_valid(obj_offset) except exceptions.InvalidAddressException: return obj = self._context.object(symbol_type, layer, offset = obj_offset, native_layer_name = layer or self.vol.native_layer_name) yield obj seen.add(link.vol.offset) try: link = getattr(link, direction).dereference() except exceptions.InvalidAddressException: return def __iter__(self) -> Iterator[interfaces.objects.ObjectInterface]: return self.to_list(self.vol.parent.vol.type_name, self.vol.member_name) class TOKEN(objects.StructType): """A class for process etoken object.""" def get_sids(self) -> Iterable[str]: """Yield a sid for the current token object.""" if self.UserAndGroupCount < 0xFFFF: layer_name = self.vol.layer_name kvo = self._context.layers[layer_name].config["kernel_virtual_offset"] symbol_table = self.get_symbol_table_name() ntkrnlmp = self._context.module(symbol_table, layer_name = layer_name, offset = kvo) UserAndGroups = ntkrnlmp.object(object_type = "array", offset = self.UserAndGroups.dereference().vol.get("offset") - kvo, subtype = ntkrnlmp.get_type("_SID_AND_ATTRIBUTES"), count = self.UserAndGroupCount) for sid_and_attr in UserAndGroups: try: sid = sid_and_attr.Sid.dereference().cast("_SID") # catch invalid pointers (UserAndGroupCount is too high) if sid is None: return # this mimics the windows API IsValidSid if sid.Revision & 0xF != 1 or sid.SubAuthorityCount > 15: return id_auth = "" for i in sid.IdentifierAuthority.Value: id_auth = i SubAuthority = ntkrnlmp.object(object_type = "array", offset = sid.SubAuthority.vol.offset - kvo, subtype = ntkrnlmp.get_type("unsigned long"), count = int(sid.SubAuthorityCount)) yield "S-" + "-".join(str(i) for i in (sid.Revision, id_auth) + tuple(SubAuthority)) except exceptions.InvalidAddressException: vollog.log(constants.LOGLEVEL_VVVV, "InvalidAddressException while parsing for token sid") def privileges(self): """Return a list of privileges for the current token object.""" try: for priv_index in range(64): yield (priv_index, bool(self.Privileges.Present & (2 ** priv_index)), bool(self.Privileges.Enabled & (2 ** priv_index)), bool(self.Privileges.EnabledByDefault & (2 ** priv_index))) except AttributeError: # Windows XP if self.PrivilegeCount < 1024: # This is a pointer to an array of _LUID_AND_ATTRIBUTES for luid in self.Privileges.dereference().cast( "array", count = self.PrivilegeCount, subtype = self._context.symbol_space[self.get_symbol_table_name()].get_type( "_LUID_AND_ATTRIBUTES")): # The Attributes member is a flag enabled = luid.Attributes & 2 != 0 default = luid.Attributes & 1 != 0 yield luid.Luid.LowPart, True, enabled, default else: vollog.log(constants.LOGLEVEL_VVVV, "Broken Token Privileges.") class KTHREAD(objects.StructType): """A class for thread control block objects.""" def get_state(self) -> str: dictState = { 0: 'Initialized', 1: 'Ready', 2: 'Running', 3: 'Standby', 4: 'Terminated', 5: 'Waiting', 6: 'Transition', 7: 'DeferredReady', 8: 'GateWait' } return dictState.get(self.State, renderers.NotApplicableValue()) def get_wait_reason(self) -> str: dictWaitReason = { 0: 'Executive', 1: 'FreePage', 2: 'PageIn', 3: 'PoolAllocation', 4: 'DelayExecution', 5: 'Suspended', 6: 'UserRequest', 7: 'WrExecutive', 8: 'WrFreePage', 9: 'WrPageIn', 10: 'WrPoolAllocation', 11: 'WrDelayExecution', 12: 'WrSuspended', 13: 'WrUserRequest', 14: 'WrEventPair', 15: 'WrQueue', 16: 'WrLpcReceive', 17: 'WrLpcReply', 18: 'WrVirtualMemory', 19: 'WrPageOut', 20: 'WrRendezvous', 21: 'Spare2', 22: 'Spare3', 23: 'Spare4', 24: 'Spare5', 25: 'Spare6', 26: 'WrKernel', 27: 'WrResource', 28: 'WrPushLock', 29: 'WrMutex', 30: 'WrQuantumEnd', 31: 'WrDispatchInt', 32: 'WrPreempted', 33: 'WrYieldExecution', 34: 'WrFastMutex', 35: 'WrGuardedMutex', 36: 'WrRundown', 37: 'MaximumWaitReason' } return dictWaitReason.get(self.WaitReason, renderers.NotApplicableValue()) class CONTROL_AREA(objects.StructType): """A class for _CONTROL_AREA structures""" PAGE_SIZE = 0x1000 PAGE_MASK = PAGE_SIZE - 1 def is_valid(self) -> bool: """Determine if the object is valid.""" try: # The Segment.ControlArea should point back to this object if self.Segment.ControlArea != self.vol.offset: return False # The SizeOfSegment should match the total PTEs multiplied by a default page size if self.Segment.SizeOfSegment != (self.Segment.TotalNumberOfPtes * self.PAGE_SIZE): return False # The first SubsectionBase should not be page aligned #subsection = self.get_subsection() #if subsection.SubsectionBase & self.PAGE_MASK == 0: # return False except exceptions.InvalidAddressException: return False # True if everything else passes return True def get_subsection(self) -> interfaces.objects.ObjectInterface: """Get the Subsection object, which is found immediately after the _CONTROL_AREA.""" return self._context.object(self.get_symbol_table_name() + constants.BANG + "_SUBSECTION", layer_name = self.vol.layer_name, offset = self.vol.offset + self.vol.size, native_layer_name = self.vol.native_layer_name) def get_pte(self, offset: int) -> interfaces.objects.ObjectInterface: """Get a PTE object at the requested offset""" return self._context.object(self.get_symbol_table_name() + constants.BANG + "_MMPTE", layer_name = self.vol.layer_name, offset = offset, native_layer_name = self.vol.native_layer_name) def get_available_pages(self) -> Iterable[Tuple[int, int, int]]: """Get the available pages that correspond to a cached file. The tuples generated are (physical_offset, file_offset, page_size). """ symbol_table_name = self.get_symbol_table_name() mmpte_type = self._context.symbol_space.get_type(symbol_table_name + constants.BANG + "_MMPTE") mmpte_size = mmpte_type.size subsection = self.get_subsection() is_64bit = symbols.symbol_table_is_64bit(self._context, symbol_table_name) is_pae = self._context.layers[self.vol.layer_name].metadata.get("pae", False) # This is a null-terminated single-linked list. while subsection != 0: try: if subsection.ControlArea != self.vol.offset: break except exceptions.InvalidAddressException: break # The offset into the file is stored implicitly based on the PTE location within the Subsection. starting_sector = subsection.StartingSector subsection_offset = starting_sector * 0x200 # Similar to the check in is_valid(), make sure the SubsectionBase is not page aligned. #if subsection.SubsectionBase & self.PAGE_MASK == 0: # break ptecount = 0 while ptecount < subsection.PtesInSubsection: pte_offset = subsection.SubsectionBase + (mmpte_size * ptecount) file_offset = subsection_offset + ptecount * 0x1000 try: mmpte = self.get_pte(pte_offset) except exceptions.InvalidAddressException: ptecount += 1 continue # First we check if the entry is valid. If so, then we get the physical offset. # The valid entries are actually handled by the hardware. if mmpte.u.Hard.Valid == 1: physoffset = mmpte.u.Hard.PageFrameNumber << 12 yield physoffset, file_offset, self.PAGE_SIZE elif mmpte.u.Soft.Prototype == 1: if not is_64bit and not is_pae: subsection_offset = ((mmpte.u.Subsect.SubsectionAddressHigh << 7) | (mmpte.u.Subsect.SubsectionAddressLow << 3)) # If the entry is not a valid physical address then see if it is in transition. elif mmpte.u.Trans.Transition == 1: physoffset = mmpte.u.Trans.PageFrameNumber << 12 yield physoffset, file_offset, self.PAGE_SIZE # Go to the next PTE entry ptecount += 1 # Go to the next Subsection in the single-linked list subsection = subsection.NextSubsection class VACB(objects.StructType): """A class for _VACB structures""" FILEOFFSET_MASK = 0xFFFFFFFFFFFF0000 def get_file_offset(self) -> int: # The FileOffset member of VACB is used to denote the offset within the file where the # view begins. Since all views are 256 KB in size, the bottom 16 bits are used to # store the number of references to the view. return self.Overlay.FileOffset.QuadPart & self.FILEOFFSET_MASK class SHARED_CACHE_MAP(objects.StructType): """A class for _SHARED_CACHE_MAP structures""" VACB_BLOCK = 0x40000 VACB_OFFSET_SHIFT = 18 VACB_LEVEL_SHIFT = 7 VACB_SIZE_OF_FIRST_LEVEL = 1 << (VACB_OFFSET_SHIFT + VACB_LEVEL_SHIFT) VACB_ARRAY = 0x80 def is_valid(self) -> bool: """Determine if the object is valid.""" if self.FileSize.QuadPart <= 0 or self.ValidDataLength.QuadPart <= 0: return False if self.SectionSize.QuadPart < 0 or ((self.FileSize.QuadPart < self.ValidDataLength.QuadPart) and (self.ValidDataLength.QuadPart != 0x7fffffffffffffff)): return False return True def process_index_array(self, array_pointer: interfaces.objects.ObjectInterface, level: int, limit: int, vacb_list: Optional[List] = None) -> List: """Recursively process the sparse multilevel VACB index array. :param array_pointer: The address of a possible index array :param level: The current level :param limit: The level where we abandon all hope. Ideally this is 7 :param vacb_list: An array of collected VACBs :return: Collected VACBs """ if vacb_list is None: vacb_list = [] if level > limit: return [] symbol_table_name = self.get_symbol_table_name() pointer_type = self._context.symbol_space.get_type(symbol_table_name + constants.BANG + "pointer") # Create an array of 128 entries for the VACB index array vacb_array = self._context.object(object_type = symbol_table_name + constants.BANG + "array", layer_name = self.vol.layer_name, offset = array_pointer, count = self.VACB_ARRAY, subtype = pointer_type) # Iterate through the entries for counter in range(0, self.VACB_ARRAY): # Check if the VACB entry is in use if not vacb_array[counter]: continue vacb_obj = vacb_array[counter].dereference().cast(symbol_table_name + constants.BANG + "_VACB") if vacb_obj.SharedCacheMap == self.vol.offset: self.save_vacb(vacb_obj, vacb_list) else: # Process the next level of the multi-level array vacb_list = self.process_index_array(vacb_array[counter], level + 1, limit, vacb_list) return vacb_list def save_vacb(self, vacb_obj: interfaces.objects.ObjectInterface, vacb_list: List): data = (int(vacb_obj.BaseAddress), int(vacb_obj.get_file_offset()), self.VACB_BLOCK) vacb_list.append(data) def get_available_pages(self) -> List: """Get the available pages that correspond to a cached file. The lists generated are (virtual_offset, file_offset, page_size). """ vacb_list = [] section_size = self.SectionSize.QuadPart # Determine the number of VACBs within the cache (nonpaged). each VACB # represents a 256-KB view in the system cache. full_blocks = section_size // self.VACB_BLOCK left_over = section_size % self.VACB_BLOCK # As an optimization, the shared cache map object contains a VACB index array of four entries. # The VACB index arrays are arrays of pointers to VACBs, that track which views of a given file # are mapped in the cache. For example, the first entry in the VACB index array refers to the first # 256 KB of the file. The InitialVacbs can describe a file up to 1 MB (4xVACB). iterval = 0 while (iterval < full_blocks) and (full_blocks <= 4): vacb_obj = self.InitialVacbs[iterval] try: # Make sure that the SharedCacheMap member of the VACB points back to the parent object. if vacb_obj.SharedCacheMap == self.vol.offset: self.save_vacb(vacb_obj, vacb_list) except exceptions.InvalidAddressException: pass iterval += 1 # We also have to account for the spill over data that is not found in the full blocks. # The first case to consider is when the spill over is still in InitialVacbs. if (left_over > 0) and (full_blocks < 4): vacb_obj = self.InitialVacbs[iterval] if vacb_obj.SharedCacheMap == self.vol.offset: self.save_vacb(vacb_obj, vacb_list) # If the file is larger than 1 MB, a seperate VACB index array needs to be allocated. # This is based on how many 256 KB blocks would be required for the size of the file. # This newly allocated VACB index array is found through the Vacbs member of SHARED_CACHE_MAP. vacb_obj = self.Vacbs # Note: avoid calling is_valid() here, since self.Vacbs is a pointer to a pointer if not vacb_obj: return vacb_list # There are a number of instances where the initial value in InitialVacb will also be the fist # entry in Vacbs. Thus we ignore, since it was already processed. It is possible to just # process again as the file offset is specified for each VACB. if self.InitialVacbs[0].vol.offset == vacb_obj: return vacb_list # If the file is less than 32 MB than it can be found in a single level VACB index array. symbol_table_name = self.get_symbol_table_name() pointer_type = self._context.symbol_space.get_type(symbol_table_name + constants.BANG + "pointer") size_of_pointer = pointer_type.size if not section_size > self.VACB_SIZE_OF_FIRST_LEVEL: array_head = vacb_obj for counter in range(0, full_blocks): vacb_entry = self._context.object(symbol_table_name + constants.BANG + "pointer", layer_name = self.vol.layer_name, offset = array_head + (counter * size_of_pointer)) # If we find a zero entry, then we proceed to the next one. If the entry is zero, # then the view is not mapped and we skip. We do not pad because we use the # FileOffset to seek to the correct offset in the file. if not vacb_entry: continue vacb = vacb_entry.dereference().cast(symbol_table_name + constants.BANG + "_VACB") if vacb.SharedCacheMap == self.vol.offset: self.save_vacb(vacb, vacb_list) if left_over > 0: vacb_entry = self._context.object(symbol_table_name + constants.BANG + "pointer", layer_name = self.vol.layer_name, offset = array_head + ((counter + 1) * size_of_pointer)) if not vacb_entry: return vacb_list vacb = vacb_entry.dereference().cast(symbol_table_name + constants.BANG + "_VACB") if vacb.SharedCacheMap == self.vol.offset: self.save_vacb(vacb, vacb_list) # The file is less than 32 MB, so we can stop processing. return vacb_list # If we get to this point, then we know that the SectionSize is greater than # VACB_SIZE_OF_FIRST_LEVEL (32 MB). Then we have a "sparse" multilevel index # array where each VACB index array is made up of 128 entries. We no # longer assume the data is sequential. (Log2 (32 MB) - 18)/7 level_depth = math.ceil(math.log(section_size, 2)) level_depth = (level_depth - self.VACB_OFFSET_SHIFT) / self.VACB_LEVEL_SHIFT level_depth = math.ceil(level_depth) limit_depth = level_depth if section_size > self.VACB_SIZE_OF_FIRST_LEVEL: # Create an array of 128 entries for the VACB index array. vacb_array = self._context.object(object_type = symbol_table_name + constants.BANG + "array", layer_name = self.vol.layer_name, offset = vacb_obj, count = self.VACB_ARRAY, subtype = pointer_type) # Walk the array and if any entry points to the shared cache map object then we extract it. # Otherwise, if it is non-zero, then traverse to the next level. for counter in range(0, self.VACB_ARRAY): if not vacb_array[counter]: continue vacb = vacb_array[counter].dereference().cast(symbol_table_name + constants.BANG + "_VACB") if vacb.SharedCacheMap == self.vol.offset: self.save_vacb(vacb, vacb_list) else: # Process the next level of the multi-level array. We set the limit_depth to be # the depth of the tree as determined from the size and we initialize the # current level to 2. vacb_list = self.process_index_array(vacb_array[counter], 2, limit_depth, vacb_list) return vacb_list volatility3-1.0.1/volatility3/framework/symbols/windows/extensions/kdbg.py000066400000000000000000000025341405267600400271260ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from volatility3.framework import constants from volatility3.framework import objects class KDDEBUGGER_DATA64(objects.StructType): def get_build_lab(self): """Returns the NT build lab string from the KDBG.""" layer_name = self.vol.layer_name symbol_table_name = self.get_symbol_table_name() return self._context.object(symbol_table_name + constants.BANG + "string", layer_name = layer_name, offset = self.NtBuildLab, max_length = 32, errors = "replace") def get_csdversion(self): """Returns the CSDVersion as an integer (i.e. Service Pack number)""" layer_name = self.vol.layer_name symbol_table_name = self.get_symbol_table_name() csdresult = self._context.object(symbol_table_name + constants.BANG + "unsigned long", layer_name = layer_name, offset = self.CmNtCSDVersion) return (csdresult >> 8) & 0xffffffff class_types = {'_KDDEBUGGER_DATA64': KDDEBUGGER_DATA64} volatility3-1.0.1/volatility3/framework/symbols/windows/extensions/network.py000066400000000000000000000216201405267600400277050ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging import socket from typing import Dict, Tuple, List, Union from volatility3.framework import exceptions from volatility3.framework import objects, interfaces from volatility3.framework.objects import Array from volatility3.framework.renderers import conversion vollog = logging.getLogger(__name__) def inet_ntop(address_family: int, packed_ip: Union[List[int], Array]) -> str: if address_family in [socket.AF_INET6, socket.AF_INET]: try: return socket.inet_ntop(address_family, bytes(packed_ip)) except AttributeError: raise RuntimeError("This version of python does not have socket.inet_ntop, please upgrade") raise socket.error("[Errno 97] Address family not supported by protocol") # Python's socket.AF_INET6 is 0x1e but Microsoft defines it # as a constant value of 0x17 in their source code. Thus we # need Microsoft's since that's what is found in memory. AF_INET = 2 AF_INET6 = 0x17 # String representations of INADDR_ANY and INADDR6_ANY inaddr_any = inet_ntop(socket.AF_INET, [0] * 4) inaddr6_any = inet_ntop(socket.AF_INET6, [0] * 16) class _TCP_LISTENER(objects.StructType): """Class for objects found in TcpL pools. This class serves as a base class for all pooled network objects. It exposes some functions which return sanity-checked members. Substructures referred to by a pointer may appear valid at first glance but will throw an InvalidAddressException on access. This is not a problem when objects are validated via their `is_valid()` method, but when scanning for semi-corrupted data this check will not be performed. Be mindful that most of those methods return `None` when they would access invalid data. If you want to process the raw data access the attributes directly, e.g. via `network_object.InetAF` instead of `network_object.get_address_family()`. """ MIN_CREATETIME_YEAR = 1950 MAX_CREATETIME_YEAR = 2200 def __init__(self, context: interfaces.context.ContextInterface, type_name: str, object_info: interfaces.objects.ObjectInformation, size: int, members: Dict[str, Tuple[int, interfaces.objects.Template]]) -> None: super().__init__(context = context, type_name = type_name, object_info = object_info, size = size, members = members) def get_address_family(self): try: return self.InetAF.dereference().AddressFamily except exceptions.InvalidAddressException: return None def get_owner(self): try: return self.member('Owner').dereference() except exceptions.InvalidAddressException: return None def get_owner_pid(self): if self.get_owner().is_valid(): if self.get_owner().has_valid_member("UniqueProcessId"): return self.get_owner().UniqueProcessId return None def get_owner_procname(self): if self.get_owner().is_valid(): if self.get_owner().has_valid_member("ImageFileName"): return self.get_owner().ImageFileName.cast("string", max_length = self.get_owner().ImageFileName.vol.count, errors = "replace") return None def get_create_time(self): dt_obj = conversion.wintime_to_datetime(self.CreateTime.QuadPart) if isinstance(dt_obj, interfaces.renderers.BaseAbsentValue): return dt_obj # return None if the timestamp seems invalid if not (self.MIN_CREATETIME_YEAR < dt_obj.year < self.MAX_CREATETIME_YEAR): return None else: return dt_obj def get_in_addr(self): try: local_addr = self.LocalAddr.dereference() # there is a rare edge case here we have to consider: # if the struct has a null pointer at the LocalAddr offset, # this generally means this struct has no associated local address. # however, sometimes a pointer to the offset of 0 can be valid because # it points to a valid virtual memory address of 0. this confuses this # plugin because trying to access the nullpointer does not raise any # errors, leading to errors later down the line when accessing the # pointed-to _IN_ADDR addr4/6 attributes. # addr4/6 are at the same offset, accessing the first byte covers both. # if this causes no error, we can expect a valid network addr. _ = local_addr.pData.dereference().addr4[0] if local_addr.pData.dereference(): inaddr = local_addr.inaddr return inaddr else: return None except exceptions.InvalidAddressException: return None def dual_stack_sockets(self): """Handle Windows dual-stack sockets""" # If this pointer is valid, the socket is bound to # a specific IP address. Otherwise, the socket is # listening on all IP addresses of the address family. # Note the remote address is always INADDR_ANY or # INADDR6_ANY for sockets. The moment a client # connects to the listener, a TCP_ENDPOINT is created # and that structure contains the remote address. inaddr = self.get_in_addr() if inaddr: if self.get_address_family() == AF_INET: yield "v4", inet_ntop(socket.AF_INET, inaddr.addr4), inaddr_any elif self.get_address_family() == AF_INET6: yield "v6", inet_ntop(socket.AF_INET6, inaddr.addr6), inaddr6_any else: yield "v4", inaddr_any, inaddr_any if self.get_address_family() == AF_INET6: yield "v6", inaddr6_any, inaddr6_any def is_valid(self): try: if not self.get_address_family() in (AF_INET, AF_INET6): vollog.debug("netw obj 0x{:x} invalid due to invalid address_family {}".format( self.vol.offset, self.get_address_family())) return False except exceptions.InvalidAddressException: vollog.debug("netw obj 0x{:x} invalid due to invalid address access".format(self.vol.offset)) return False return True class _TCP_ENDPOINT(_TCP_LISTENER): """Class for objects found in TcpE pools""" def _ipv4_or_ipv6(self, inaddr): if self.get_address_family() == AF_INET: return inet_ntop(socket.AF_INET, inaddr.addr4) else: return inet_ntop(socket.AF_INET6, inaddr.addr6) def get_local_address(self): try: inaddr = self.AddrInfo.dereference().Local.pData.dereference().dereference() return self._ipv4_or_ipv6(inaddr) except exceptions.InvalidAddressException: return None def get_remote_address(self): try: inaddr = self.AddrInfo.dereference().Remote.dereference() return self._ipv4_or_ipv6(inaddr) except exceptions.InvalidAddressException: return None def is_valid(self): if self.State not in self.State.choices.values(): vollog.debug("invalid due to invalid tcp state {}".format(self.State)) return False try: if self.get_address_family() not in (AF_INET, AF_INET6): vollog.debug("invalid due to invalid address_family {}".format(self.get_address_family())) return False if not self.get_local_address() and (not self.get_owner() or self.get_owner().UniqueProcessId == 0 or self.get_owner().UniqueProcessId > 65535): vollog.debug("invalid due to invalid owner data") return False except exceptions.InvalidAddressException: vollog.debug("invalid due to invalid address access") return False return True class _UDP_ENDPOINT(_TCP_LISTENER): """Class for objects found in UdpA pools""" class _LOCAL_ADDRESS(objects.StructType): @property def inaddr(self): return self.pData.dereference().dereference() class _LOCAL_ADDRESS_WIN10_UDP(objects.StructType): @property def inaddr(self): return self.pData.dereference() win10_x64_class_types = { '_TCP_ENDPOINT': _TCP_ENDPOINT, '_TCP_LISTENER': _TCP_LISTENER, '_UDP_ENDPOINT': _UDP_ENDPOINT, '_LOCAL_ADDRESS': _LOCAL_ADDRESS, '_LOCAL_ADDRESS_WIN10_UDP': _LOCAL_ADDRESS_WIN10_UDP } class_types = { '_TCP_ENDPOINT': _TCP_ENDPOINT, '_TCP_LISTENER': _TCP_LISTENER, '_UDP_ENDPOINT': _UDP_ENDPOINT, '_LOCAL_ADDRESS': _LOCAL_ADDRESS } volatility3-1.0.1/volatility3/framework/symbols/windows/extensions/pe.py000066400000000000000000000174651405267600400266340ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from typing import Generator, Tuple import logging from volatility3.framework import constants from volatility3.framework import objects, interfaces from volatility3.framework.renderers import conversion vollog = logging.getLogger(__name__) class IMAGE_DOS_HEADER(objects.StructType): def get_nt_header(self) -> interfaces.objects.ObjectInterface: """Carve out the NT header from this DOS header. This reflects on the PE file's Machine type to create a 32- or 64-bit NT header structure. Returns: <_IMAGE_NT_HEADERS> or <_IMAGE_NT_HEADERS64> instance """ if self.e_magic != 0x5a4d: raise ValueError("e_magic {0:04X} is not a valid DOS signature.".format(self.e_magic)) layer_name = self.vol.layer_name symbol_table_name = self.get_symbol_table_name() nt_header = self._context.object(symbol_table_name + constants.BANG + "_IMAGE_NT_HEADERS", layer_name = layer_name, offset = self.vol.offset + self.e_lfanew) if nt_header.Signature != 0x4550: raise ValueError("NT header signature {0:04X} is not a valid".format(nt_header.Signature)) # this checks if we need a PE32+ header if nt_header.FileHeader.Machine == 34404: nt_header = nt_header.cast("_IMAGE_NT_HEADERS64") return nt_header def replace_header_field(self, sect: interfaces.objects.ObjectInterface, header: bytes, item: interfaces.objects.ObjectInterface, value: int) -> bytes: """Replaces a member in an _IMAGE_SECTION_HEADER structure. Args: sect: the section instance header: raw data for the section item: the member of the section to replace value: new value for the member Returns: The raw data with the replaced header field """ member_size = self._context.symbol_space.get_type(item.vol.type_name).size start = item.vol.offset - sect.vol.offset newval = objects.convert_value_to_data(value, int, item.vol.data_format) result = header[:start] + newval + header[start + member_size:] return result def fix_image_base(self, raw_data: bytes, nt_header: interfaces.objects.ObjectInterface) -> bytes: """Fix the _OPTIONAL_HEADER.ImageBase value (which is either an unsigned long for 32-bit PE's or unsigned long long for 64-bit PE's) to match the address where the PE file was carved out of memory. Args: raw_data: a bytes object of the PE's data nt_header: <_IMAGE_NT_HEADERS> or <_IMAGE_NT_HEADERS64> instance Returns: patched with the correct address """ image_base_offset = nt_header.OptionalHeader.ImageBase.vol.offset - self.vol.offset image_base_type = nt_header.OptionalHeader.ImageBase.vol.type_name member_size = self._context.symbol_space.get_type(image_base_type).size try: newval = objects.convert_value_to_data(self.vol.offset, int, nt_header.OptionalHeader.ImageBase.vol.data_format) new_pe = raw_data[:image_base_offset] + newval + raw_data[image_base_offset + member_size:] except OverflowError: vollog.warning("Volatility was unable to fix the image base for the PE file at base address {:#x}. " \ "This will cause issues with many static analysis tools if you do not inform the " \ "tool of the in-memory load address.".format(self.vol.offset)) new_pe = raw_data return new_pe def reconstruct(self) -> Generator[Tuple[int, bytes], None, None]: """This method generates the content necessary to reconstruct a PE file from memory. It preserves slack space (similar to the old --memory) and automatically fixes the ImageBase in the output PE file. Returns: of ( offset, data) """ nt_header = self.get_nt_header() layer_name = self.vol.layer_name symbol_table_name = self.get_symbol_table_name() section_alignment = nt_header.OptionalHeader.SectionAlignment sect_header_size = self._context.symbol_space.get_type(symbol_table_name + constants.BANG + "_IMAGE_SECTION_HEADER").size size_of_image = nt_header.OptionalHeader.SizeOfImage # no legitimate PE is going to be larger than this if size_of_image > (1024 * 1024 * 100): raise ValueError("The claimed SizeOfImage is too large: {}".format(size_of_image)) read_layer = self._context.layers[layer_name] raw_data = read_layer.read(self.vol.offset, nt_header.OptionalHeader.SizeOfImage, pad = True) # fix the PE image base before yielding the initial view of the data fixed_data = self.fix_image_base(raw_data, nt_header) yield 0, fixed_data start_addr = nt_header.FileHeader.SizeOfOptionalHeader + \ (nt_header.OptionalHeader.vol.offset - self.vol.offset) counter = 0 for sect in nt_header.get_sections(): if sect.VirtualAddress > size_of_image: raise ValueError("Section VirtualAddress is too large: {}".format(sect.VirtualAddress)) if sect.Misc.VirtualSize > size_of_image: raise ValueError("Section VirtualSize is too large: {}".format(sect.Misc.VirtualSize)) if sect.SizeOfRawData > size_of_image: raise ValueError("Section SizeOfRawData is too large: {}".format(sect.SizeOfRawData)) if sect is not None: # It doesn't matter if this is too big, because it'll get overwritten by the later layers sect_size = conversion.round(sect.Misc.VirtualSize, section_alignment, up = True) sectheader = read_layer.read(sect.vol.offset, sect_header_size) sectheader = self.replace_header_field(sect, sectheader, sect.PointerToRawData, sect.VirtualAddress) sectheader = self.replace_header_field(sect, sectheader, sect.SizeOfRawData, sect_size) sectheader = self.replace_header_field(sect, sectheader, sect.Misc.VirtualSize, sect_size) offset = start_addr + (counter * sect_header_size) yield offset, sectheader counter += 1 class IMAGE_NT_HEADERS(objects.StructType): def get_sections(self) -> Generator[interfaces.objects.ObjectInterface, None, None]: """Iterate through the section headers for this PE file. Yields: <_IMAGE_SECTION_HEADER> objects """ layer_name = self.vol.layer_name symbol_table_name = self.get_symbol_table_name() sect_header_size = self._context.symbol_space.get_type(symbol_table_name + constants.BANG + "_IMAGE_SECTION_HEADER").size start_addr = self.FileHeader.SizeOfOptionalHeader + self.OptionalHeader.vol.offset for i in range(self.FileHeader.NumberOfSections): sect_addr = start_addr + (i * sect_header_size) yield self._context.object(symbol_table_name + constants.BANG + "_IMAGE_SECTION_HEADER", offset = sect_addr, layer_name = layer_name) class_types = { '_IMAGE_DOS_HEADER': IMAGE_DOS_HEADER, # the 32- and 64-bit extensions behave the same way, but the underlying structure is different '_IMAGE_NT_HEADERS': IMAGE_NT_HEADERS, '_IMAGE_NT_HEADERS64': IMAGE_NT_HEADERS } volatility3-1.0.1/volatility3/framework/symbols/windows/extensions/pool.py000066400000000000000000000412011405267600400271620ustar00rootroot00000000000000import functools import logging import struct from typing import Optional, Tuple, List, Dict, Union from volatility3.framework import objects, interfaces, constants, symbols, exceptions, renderers from volatility3.framework.renderers import conversion vollog = logging.getLogger(__name__) class POOL_HEADER(objects.StructType): """A kernel pool allocation header. Exists at the base of the allocation and provides a tag that we can scan for. """ def get_object(self, type_name: str, use_top_down: bool, executive: bool = False, kernel_symbol_table: Optional[str] = None, native_layer_name: Optional[str] = None) -> Optional[interfaces.objects.ObjectInterface]: """Carve an object or data structure from a kernel pool allocation Args: type_name: the data structure type name native_layer_name: the name of the layer where the data originally lived object_type: the object type (executive kernel objects only) kernel_symbol_table: in case objects of a different symbol table are scanned for Returns: An object as found from a POOL_HEADER """ symbol_table_name = self.vol.type_name.split(constants.BANG)[0] if constants.BANG in type_name: symbol_table_name, type_name = type_name.split(constants.BANG)[0:2] # when checking for symbols from a table other than nt_symbols grab _OBJECT_HEADER from the kernel # because symbol_table_name will be different from kernel_symbol_table. if kernel_symbol_table: object_header_type = self._context.symbol_space.get_type(kernel_symbol_table + constants.BANG + "_OBJECT_HEADER") else: # otherwise symbol_table_name *is* the kernel symbol table, so just use that. object_header_type = self._context.symbol_space.get_type(symbol_table_name + constants.BANG + "_OBJECT_HEADER") pool_header_size = self.vol.size # if there is no object type, then just instantiate a structure if not executive: mem_object = self._context.object(symbol_table_name + constants.BANG + type_name, layer_name = self.vol.layer_name, offset = self.vol.offset + pool_header_size, native_layer_name = native_layer_name) return mem_object # otherwise we have an executive object in the pool else: if symbols.symbol_table_is_64bit(self._context, symbol_table_name): alignment = 16 else: alignment = 8 # use the top down approach for windows 8 and later if use_top_down: body_offset = object_header_type.relative_child_offset('Body') infomask_offset = object_header_type.relative_child_offset('InfoMask') pointercount_offset = object_header_type.relative_child_offset('PointerCount') pointercount_size = object_header_type.members['PointerCount'][1].size optional_headers, lengths_of_optional_headers = self._calculate_optional_header_lengths( self._context, symbol_table_name) padding_available = None if 'PADDING_INFO' not in optional_headers else optional_headers.index( 'PADDING_INFO') max_optional_headers_length = sum(lengths_of_optional_headers) # define the starting and ending bounds for the scan start_offset = self.vol.offset + pool_header_size addr_limit = min(max_optional_headers_length, self.BlockSize * alignment) # A single read is better than lots of little one-byte reads. # We're ok padding this, because the byte we'd check would be 0 which would only be valid if there # were no optional headers in the first place (ie, if we read too much for headers that don't exist, # but the bit we could read were valid) infomask_data = self._context.layers[self.vol.layer_name].read(start_offset, addr_limit + infomask_offset, pad = True) # Addr stores the offset to the potential start of the OBJECT_HEADER from just after the POOL_HEADER # It will always be aligned to a particular alignment for addr in range(0, addr_limit, alignment): infomask_value = infomask_data[addr + infomask_offset] pointercount_value = int.from_bytes( infomask_data[addr + pointercount_offset:addr + pointercount_offset + pointercount_size], byteorder = 'little', signed = True) if not 0x1000000 > pointercount_value >= 0: continue padding_present = False optional_headers_length = 0 for i in range(len(lengths_of_optional_headers)): if infomask_value & (1 << i): optional_headers_length += lengths_of_optional_headers[i] if i == padding_available: padding_present = True # PADDING_INFO is a special case (4 bytes that contain the total padding length) padding_length = 0 if padding_present: # Read the four bytes from just before the next optional_headers_length minus the padding_info size # # --------------- # POOL_HEADER # --------------- # # start of PADDING_INFO # --------------- # End of other optional headers # --------------- # OBJECT_HEADER # --------------- if addr - optional_headers_length < 0: continue padding_length = struct.unpack( "= padding_length > addr: continue try: mem_object = self._context.object(symbol_table_name + constants.BANG + type_name, layer_name = self.vol.layer_name, offset = addr + body_offset + start_offset, native_layer_name = native_layer_name) if mem_object.is_valid(): return mem_object except (TypeError, exceptions.InvalidAddressException): pass # use the bottom up approach for windows 7 and earlier else: type_size = self._context.symbol_space.get_type(symbol_table_name + constants.BANG + type_name).size rounded_size = conversion.round(type_size, alignment, up = True) mem_object = self._context.object(symbol_table_name + constants.BANG + type_name, layer_name = self.vol.layer_name, offset = self.vol.offset + self.BlockSize * alignment - rounded_size, native_layer_name = native_layer_name) try: if mem_object.is_valid(): return mem_object except (TypeError, exceptions.InvalidAddressException): return None return None @classmethod @functools.lru_cache() def _calculate_optional_header_lengths(cls, context: interfaces.context.ContextInterface, symbol_table_name: str) -> Tuple[List[str], List[int]]: headers = [] sizes = [] for header in [ 'CREATOR_INFO', 'NAME_INFO', 'HANDLE_INFO', 'QUOTA_INFO', 'PROCESS_INFO', 'AUDIT_INFO', 'EXTENDED_INFO', 'HANDLE_REVOCATION_INFO', 'PADDING_INFO' ]: try: type_name = "{}{}_OBJECT_HEADER_{}".format(symbol_table_name, constants.BANG, header) header_type = context.symbol_space.get_type(type_name) headers.append(header) sizes.append(header_type.size) except (AttributeError, exceptions.SymbolError): # Some of these may not exist, for example: # if build < 9200: PADDING_INFO else: AUDIT_INFO # if build == 10586: HANDLE_REVOCATION_INFO else EXTENDED_INFO # based on what's present and what's not, this list should be the right order and the right length pass return headers, sizes def is_free_pool(self): return self.PoolType == 0 def is_paged_pool(self): return self.PoolType % 2 == 0 and self.PoolType > 0 def is_nonpaged_pool(self): return self.PoolType % 2 == 1 class POOL_HEADER_VISTA(POOL_HEADER): """A kernel pool allocation header, updated for Vista and later. Exists at the base of the allocation and provides a tag that we can scan for. """ def is_paged_pool(self): return self.PoolType % 2 == 1 def is_nonpaged_pool(self): return self.PoolType % 2 == 0 and self.PoolType > 0 class POOL_TRACKER_BIG_PAGES(objects.StructType): """A kernel big page pool tracker.""" pool_type_lookup = {} # type: Dict[str, str] def _generate_pool_type_lookup(self): # Enumeration._generate_inverse_choices() raises ValueError because multiple enum names map to the same # value in the kernel _POOL_TYPE so create a custom mapping here and take the first match symbol_table_name = self.vol.type_name.split(constants.BANG)[0] pool_type_enum = self._context.symbol_space.get_enumeration(symbol_table_name + constants.BANG + "_POOL_TYPE") for k, v in pool_type_enum.choices.items(): if v not in self.pool_type_lookup: self.pool_type_lookup[v] = k def is_valid(self) -> bool: return self.Key > 0 # return self.Va > 0x1 def get_key(self) -> str: """Returns the Key value as a 4 character string""" tag_bytes = objects.convert_value_to_data(self.Key, int, objects.DataFormatInfo(4, "little", False)) return "".join([chr(x) if 32 < x < 127 else '' for x in tag_bytes]) def get_pool_type(self) -> Union[str, interfaces.renderers.BaseAbsentValue]: """Returns the enum name for the PoolType value on applicable systems""" # Not applicable until Vista if hasattr(self, 'PoolType'): if not self.pool_type_lookup: self._generate_pool_type_lookup() return self.pool_type_lookup.get(self.PoolType, "Unknown choice {}".format(self.PoolType)) else: return renderers.NotApplicableValue() def get_number_of_bytes(self) -> Union[int, interfaces.renderers.BaseAbsentValue]: """Returns the NumberOfBytes value on applicable systems""" # Not applicable until Vista try: return self.NumberOfBytes except AttributeError: return renderers.NotApplicableValue() class ExecutiveObject(interfaces.objects.ObjectInterface): """This is used as a "mixin" that provides all kernel executive objects with a means of finding their own object header.""" def get_object_header(self) -> 'OBJECT_HEADER': if constants.BANG not in self.vol.type_name: raise ValueError("Invalid symbol table name syntax (no {} found)".format(constants.BANG)) symbol_table_name = self.vol.type_name.split(constants.BANG)[0] body_offset = self._context.symbol_space.get_type(symbol_table_name + constants.BANG + "_OBJECT_HEADER").relative_child_offset("Body") return self._context.object(symbol_table_name + constants.BANG + "_OBJECT_HEADER", layer_name = self.vol.layer_name, offset = self.vol.offset - body_offset, native_layer_name = self.vol.native_layer_name) class OBJECT_HEADER(objects.StructType): """A class for the headers for executive kernel objects, which contains quota information, ownership details, naming data, and ACLs.""" def is_valid(self) -> bool: """Determine if the object is valid.""" # if self.InfoMask > 0x48: # return False try: if self.PointerCount > 0x1000000 or self.PointerCount < 0: return False except exceptions.InvalidAddressException: return False return True def get_object_type(self, type_map: Dict[int, str], cookie: int = None) -> Optional[str]: """Across all Windows versions, the _OBJECT_HEADER embeds details on the type of object (i.e. process, file) but the way its embedded differs between versions. This API abstracts away those details. """ if self.vol.get('object_header_object_type', None) is not None: return self.vol.object_header_object_type try: # vista and earlier have a Type member self._vol['object_header_object_type'] = self.Type.Name.String except AttributeError: # windows 7 and later have a TypeIndex, but windows 10 # further encodes the index value with nt1!ObHeaderCookie try: type_index = ((self.vol.offset >> 8) ^ cookie ^ self.TypeIndex) & 0xFF except (AttributeError, TypeError): type_index = self.TypeIndex self._vol['object_header_object_type'] = type_map.get(type_index) return self.vol.object_header_object_type @property def NameInfo(self) -> interfaces.objects.ObjectInterface: if constants.BANG not in self.vol.type_name: raise ValueError("Invalid symbol table name syntax (no {} found)".format(constants.BANG)) symbol_table_name = self.vol.type_name.split(constants.BANG)[0] try: header_offset = self.NameInfoOffset except AttributeError: # http://codemachine.com/article_objectheader.html (Windows 7 and later) name_info_bit = 0x2 layer = self._context.layers[self.vol.native_layer_name] kvo = layer.config.get("kernel_virtual_offset", None) if kvo is None: raise AttributeError("Could not find kernel_virtual_offset for layer: {}".format(self.vol.layer_name)) ntkrnlmp = self._context.module(symbol_table_name, layer_name = self.vol.layer_name, offset = kvo) address = ntkrnlmp.get_symbol("ObpInfoMaskToOffset").address calculated_index = self.InfoMask & (name_info_bit | (name_info_bit - 1)) header_offset = self._context.object(symbol_table_name + constants.BANG + "unsigned char", layer_name = self.vol.native_layer_name, offset = kvo + address + calculated_index) if header_offset == 0: raise ValueError("Could not find _OBJECT_HEADER_NAME_INFO for object at {} of layer {}".format( self.vol.offset, self.vol.layer_name)) header = self._context.object(symbol_table_name + constants.BANG + "_OBJECT_HEADER_NAME_INFO", layer_name = self.vol.layer_name, offset = self.vol.offset - header_offset, native_layer_name = self.vol.native_layer_name) return header volatility3-1.0.1/volatility3/framework/symbols/windows/extensions/registry.py000066400000000000000000000306701405267600400300710ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import enum import logging import struct from typing import Optional, Iterable, Union from volatility3.framework import constants, exceptions, objects, interfaces from volatility3.framework.layers.registry import RegistryHive, RegistryInvalidIndex, RegistryFormatException vollog = logging.getLogger(__name__) BIG_DATA_MAXLEN = 0x3fd8 class RegValueTypes(enum.Enum): REG_NONE = 0 REG_SZ = 1 REG_EXPAND_SZ = 2 REG_BINARY = 3 REG_DWORD = 4 REG_DWORD_BIG_ENDIAN = 5 REG_LINK = 6 REG_MULTI_SZ = 7 REG_RESOURCE_LIST = 8 REG_FULL_RESOURCE_DESCRIPTOR = 9 REG_RESOURCE_REQUIREMENTS_LIST = 10 REG_QWORD = 11 REG_UNKNOWN = 99999 # TODO: This _missing_() method can replace the get() method below # if support for Python 3.6 is added in the future # @classmethod # def _missing_(cls, value): # return cls(RegValueTypes.REG_UNKNOWN) @classmethod def get(cls, value): """An alternative method for using this enum when the value may be unknown. This is used to support unknown value requests in Python <3.6. """ try: return cls(value) except ValueError: return cls(RegValueTypes.REG_UNKNOWN) class RegKeyFlags(enum.IntEnum): KEY_IS_VOLATILE = 0x01 KEY_HIVE_EXIT = 0x02 KEY_HIVE_ENTRY = 0x04 KEY_NO_DELETE = 0x08 KEY_SYM_LINK = 0x10 KEY_COMP_NAME = 0x20 KEY_PREFEF_HANDLE = 0x40 KEY_VIRT_MIRRORED = 0x80 KEY_VIRT_TARGET = 0x100 KEY_VIRTUAL_STORE = 0x200 class HMAP_ENTRY(objects.StructType): def get_block_offset(self) -> int: try: return (self.PermanentBinAddress ^ (self.PermanentBinAddress & 0xf)) + self.BlockOffset except AttributeError: return self.BlockAddress class CMHIVE(objects.StructType): def is_valid(self) -> bool: """Determine if the object is valid.""" try: return self.Hive.Signature == 0xbee0bee0 except exceptions.InvalidAddressException: return False def get_name(self) -> Optional[interfaces.objects.ObjectInterface]: """Determine a name for the hive. Note that some attributes are unpredictably blank across different OS versions while others are populated, so we check all possibilities and take the first one that's not empty """ for attr in ["FileFullPath", "FileUserName", "HiveRootPath"]: try: return getattr(self, attr).get_string() except (AttributeError, exceptions.InvalidAddressException): pass return None name = property(get_name) class CM_KEY_BODY(objects.StructType): """This represents an open handle to a registry key and is not tied to the registry hive file format on disk.""" def _skip_key_hive_entry_path(self, kcb_flags): """Win10 14393 introduced an extra path element that it skips over by checking for Flags that contain KEY_HIVE_ENTRY.""" # _CM_KEY_BODY.Trans introduced in Win10 14393 if hasattr(self, "Trans") and RegKeyFlags.KEY_HIVE_ENTRY & kcb_flags == RegKeyFlags.KEY_HIVE_ENTRY: return True return False def get_full_key_name(self) -> str: output = [] kcb = self.KeyControlBlock while kcb.ParentKcb: if kcb.NameBlock.Name is None: break if self._skip_key_hive_entry_path(kcb.Flags): kcb = kcb.ParentKcb if not kcb: break output.append( kcb.NameBlock.Name.cast("string", encoding = "utf8", max_length = kcb.NameBlock.NameLength, errors = "replace")) kcb = kcb.ParentKcb return "\\".join(reversed(output)) class CM_KEY_NODE(objects.StructType): """Extension to allow traversal of registry keys.""" def get_volatile(self) -> bool: if not isinstance(self._context.layers[self.vol.layer_name], RegistryHive): raise ValueError("Cannot determine volatility of registry key without an offset in a RegistryHive layer") return bool(self.vol.offset & 0x80000000) def get_subkeys(self) -> Iterable[interfaces.objects.ObjectInterface]: """Returns a list of the key nodes.""" hive = self._context.layers[self.vol.layer_name] if not isinstance(hive, RegistryHive): raise TypeError("CM_KEY_NODE was not instantiated on a RegistryHive layer") for index in range(2): # Use get_cell because it should *always* be a KeyIndex subkey_node = hive.get_cell(self.SubKeyLists[index]).u.KeyIndex yield from self._get_subkeys_recursive(hive, subkey_node) def _get_subkeys_recursive( self, hive: RegistryHive, node: interfaces.objects.ObjectInterface) -> Iterable[interfaces.objects.ObjectInterface]: """Recursively descend a node returning subkeys.""" # The keylist appears to include 4 bytes of key name after each value # We can either double the list and only use the even items, or # We could change the array type to a struct with both parts try: signature = node.cast('string', max_length = 2, encoding = 'latin-1') except (exceptions.InvalidAddressException, RegistryFormatException): return listjump = None if signature == 'ri': listjump = 1 elif signature == 'lh' or signature == 'lf': listjump = 2 elif node.vol.type_name.endswith(constants.BANG + "_CM_KEY_NODE"): yield node else: vollog.debug("Unexpected node type encountered when traversing subkeys: {}, signature: {}".format( node.vol.type_name, signature)) if listjump: node.List.count = node.Count * listjump for subnode_offset in node.List[::listjump]: if (subnode_offset & 0x7fffffff) > hive.maximum_address: vollog.log(constants.LOGLEVEL_VVV, "Node found with address outside the valid Hive size: {}".format(hex(subnode_offset))) else: try: subnode = hive.get_node(subnode_offset) except (exceptions.InvalidAddressException, RegistryFormatException): vollog.log(constants.LOGLEVEL_VVV, "Failed to get node at {}, skipping".format(hex(subnode_offset))) continue yield from self._get_subkeys_recursive(hive, subnode) def get_values(self) -> Iterable[interfaces.objects.ObjectInterface]: """Returns a list of the Value nodes for a key.""" hive = self._context.layers[self.vol.layer_name] if not isinstance(hive, RegistryHive): raise TypeError("CM_KEY_NODE was not instantiated on a RegistryHive layer") child_list = hive.get_cell(self.ValueList.List).u.KeyList child_list.count = self.ValueList.Count try: for v in child_list: if v != 0: try: node = hive.get_node(v) except (RegistryInvalidIndex, RegistryFormatException) as excp: vollog.debug("Invalid address {}".format(excp)) continue if node.vol.type_name.endswith(constants.BANG + '_CM_KEY_VALUE'): yield node except (exceptions.InvalidAddressException, RegistryFormatException) as excp: vollog.debug("Invalid address in get_values iteration: {}".format(excp)) return def get_name(self) -> interfaces.objects.ObjectInterface: """Gets the name for the current key node""" namelength = self.NameLength self.Name.count = namelength return self.Name.cast("string", max_length = namelength, encoding = "latin-1") def get_key_path(self) -> str: reg = self._context.layers[self.vol.layer_name] if not isinstance(reg, RegistryHive): raise TypeError("Key was not instantiated on a RegistryHive layer") # Using the offset adds a significant delay (since it cannot be cached easily) # if self.vol.offset == reg.get_node(reg.root_cell_offset).vol.offset: if self.vol.offset == reg.root_cell_offset + 4: # return the last part of the hive name for the root entry return reg.get_name().split('\\')[-1] return reg.get_node(self.Parent).get_key_path() + '\\' + self.get_name() class CM_KEY_VALUE(objects.StructType): """Extensions to extract data from CM_KEY_VALUE nodes.""" def get_name(self) -> interfaces.objects.ObjectInterface: """Gets the name for the current key value""" namelength = self.NameLength self.Name.count = namelength return self.Name.cast("string", max_length = namelength, encoding = "latin-1") def decode_data(self) -> Union[int, bytes]: """Properly decodes the data associated with the value node""" # Determine if the data is stored inline datalen = self.DataLength data = b"" # Check if the data is stored inline layer = self._context.layers[self.vol.layer_name] if not isinstance(layer, RegistryHive): raise TypeError("Key value was not instantiated on a RegistryHive layer") # If the high-bit is set if datalen & 0x80000000: # Remove the high bit datalen = datalen & 0x7fffffff if (0 > datalen or datalen > 4): raise ValueError("Unable to read inline registry value with excessive length: {}".format(datalen)) else: data = layer.read(self.Data.vol.offset, datalen) elif layer.hive.Version == 5 and datalen > 0x4000: # We're bigdata big_data = layer.get_node(self.Data) # Oddly, we get a list of addresses, at which are addresses, which then point to data blocks for i in range(big_data.Count): # The value 4 should actually be unsigned-int.size, but since it's a file format that shouldn't change # the direct value 4 can be used instead block_offset = layer.get_cell(big_data.List + (i * 4)).cast("unsigned int") if isinstance(block_offset, int) and block_offset < layer.maximum_address: amount = min(BIG_DATA_MAXLEN, datalen) data += layer.read(offset = layer.get_cell(block_offset).vol.offset, length = amount) datalen -= amount else: # Suspect Data actually points to a Cell, # but the length at the start could be negative so just adding 4 to jump past it data = layer.read(self.Data + 4, datalen) self_type = RegValueTypes.get(self.Type) if self_type == RegValueTypes.REG_DWORD: if len(data) != struct.calcsize("L"): raise ValueError("Size of data does not match the type of registry value {}".format(self.get_name())) return struct.unpack(">L", data)[0] if self_type == RegValueTypes.REG_QWORD: if len(data) != struct.calcsize(" bool: """Determine if the structure is valid.""" if self.Order < 0 or self.Order > 0xFFFF: return False try: _ = self.State.description _ = self.Start.description except ValueError: return False return True def get_pid(self) -> Union[int, interfaces.renderers.BaseAbsentValue]: """Return the pid of the process, if any.""" if self.State.description != "SERVICE_RUNNING" or "PROCESS" not in self.get_type(): return renderers.NotApplicableValue() try: return self.ServiceProcess.ProcessId except exceptions.InvalidAddressException: return renderers.UnreadableValue() def get_binary(self) -> Union[str, interfaces.renderers.BaseAbsentValue]: """Returns the binary associated with the service.""" if self.State.description != "SERVICE_RUNNING": return renderers.NotApplicableValue() # depending on whether the service is for a process # or kernel driver, the binary path is stored differently try: if "PROCESS" in self.get_type(): return self.ServiceProcess.BinaryPath.dereference().cast("string", encoding = "utf-16", errors = "replace", max_length = 512) else: return self.DriverName.dereference().cast("string", encoding = "utf-16", errors = "replace", max_length = 512) except exceptions.InvalidAddressException: return renderers.UnreadableValue() def get_name(self) -> Union[str, interfaces.renderers.BaseAbsentValue]: """Returns the service name.""" try: return self.ServiceName.dereference().cast("string", encoding = "utf-16", errors = "replace", max_length = 512) except exceptions.InvalidAddressException: return renderers.UnreadableValue() def get_display(self) -> Union[str, interfaces.renderers.BaseAbsentValue]: """Returns the service display.""" try: return self.DisplayName.dereference().cast("string", encoding = "utf-16", errors = "replace", max_length = 512) except exceptions.InvalidAddressException: return renderers.UnreadableValue() def get_type(self) -> str: """Returns the binary types.""" SERVICE_TYPE_FLAGS = { 'SERVICE_KERNEL_DRIVER': 1, 'SERVICE_FILE_SYSTEM_DRIVER': 2, 'SERVICE_ADAPTOR': 4, 'SERVICE_RECOGNIZER_DRIVER': 8, 'SERVICE_WIN32_OWN_PROCESS': 16, 'SERVICE_WIN32_SHARE_PROCESS': 32, 'SERVICE_INTERACTIVE_PROCESS': 256 } type_flags = Flags(choices = SERVICE_TYPE_FLAGS) return "|".join(type_flags(self.Type)) def traverse(self): """Generator that enumerates other services.""" try: if hasattr(self, "PrevEntry"): yield self # make sure we dereference these pointers, or the # is_valid() checks will apply to the pointer and # not the _SERVICE_RECORD object as intended. rec = self.PrevEntry while rec and rec.is_valid(): yield rec rec = rec.PrevEntry else: rec = self while rec and rec.is_valid(): yield rec rec = rec.ServiceList.Blink.dereference() except exceptions.InvalidAddressException: return class SERVICE_HEADER(objects.StructType): """A service header structure.""" def is_valid(self) -> bool: """Determine if the structure is valid.""" try: return self.ServiceRecord.is_valid() except exceptions.InvalidAddressException: return False class_types = {'_SERVICE_RECORD': SERVICE_RECORD, '_SERVICE_HEADER': SERVICE_HEADER} volatility3-1.0.1/volatility3/framework/symbols/windows/kdbg.json000066400000000000000000001033371405267600400252530ustar00rootroot00000000000000{ "symbols": {}, "enums": {}, "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "unsigned long long": { "kind": "int", "size": 8, "signed": false, "endian": "little" } }, "user_types": { "_DBGKD_DEBUG_DATA_HEADER64": { "fields": { "OwnerTag": { "type": { "kind": "base", "name": "unsigned long" }, "offset": 16 }, "List": { "type": { "kind": "struct", "name": "LIST_ENTRY64" }, "offset": 0 }, "Size": { "type": { "kind": "base", "name": "unsigned long" }, "offset": 20 } }, "kind": "struct", "size": 24 }, "_KDDEBUGGER_DATA64": { "fields": { "MmBadPagesDetected": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 800 }, "KeUserCallbackDispatcher": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 64 }, "MmPagedPoolCommit": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 368 }, "FramePointer": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 52 }, "MmPfnDatabase": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 192 }, "KiProcessorBlock": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 536 }, "SizeEThread": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 704 }, "MmPeakCommitment": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 600 }, "OffsetPrcbContext": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 824 }, "ThCallbackStack": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 48 }, "GdtLdt": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 768 }, "MmModifiedPageListHead": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 408 }, "OffsetPrcbCurrentThread": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 692 }, "OffsetPrcbVendorString": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 698 }, "ObpTypeObjectType": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 160 }, "MmSystemCacheEnd": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 176 }, "MmDriverCommit": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 352 }, "OffsetPrcbCpuType": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 696 }, "MmTotalCommitLimit": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 328 }, "MmResidentAvailablePages": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 432 }, "OffsetEprocessPeb": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 682 }, "PsActiveProcessHead": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 80 }, "SizeEProcess": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 680 }, "Gdt64R3CmTeb": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 774 }, "MmFreePageListHead": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 392 }, "SizePrcb": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 688 }, "CmNtCSDVersion": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 616 }, "MmNumberOfPagingFiles": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 224 }, "KiNormalSystemCall": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 528 }, "OffsetKThreadBStoreLimit": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 678 }, "NextCallback": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 50 }, "IopNumTriageDumpDataBlocks": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 776 }, "MmProcessCommit": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 360 }, "MmPhysicalMemoryBlock": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 624 }, "OffsetPcrInitialBStore": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 744 }, "SizePcr": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 736 }, "OffsetKThreadBStore": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 676 }, "MmTotalCommittedPages": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 336 }, "OffsetKThreadApcProcess": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 672 }, "GdtR3Data": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 764 }, "GdtR0Pcr": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 760 }, "GdtR3Teb": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 766 }, "OffsetPcrContainedPrcb": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 742 }, "Gdt64R3CmCode": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 772 }, "KeBugCheckCallbackListHead": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 128 }, "MmZeroedPageSingleBitErrorsDetected": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 808 }, "OffsetPcrSelfPcr": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 738 }, "MmPagedPoolStart": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 288 }, "MmStandbyPageListHead": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 400 }, "MmVirtualTranslationBase": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 656 }, "GdtR0Data": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 758 }, "EtwpDebuggerData": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 816 }, "KdPrintBufferSize": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 720 }, "OffsetPrcbProcStateSpecialReg": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 754 }, "MmSystemParentTablePage": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 648 }, "MmSubsectionBase": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 216 }, "OffsetKThreadKernelStack": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 668 }, "MmHighestUserAddress": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 456 }, "KdPrintCircularBufferEnd": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 488 }, "MmPagedPoolEnd": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 296 }, "MmAvailablePages": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 424 }, "KiBugcheckData": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 136 }, "MmVerifierData": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 584 }, "OffsetKThreadState": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 674 }, "MmNonPagedSystemStart": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 264 }, "MmSystemPtesStart": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 200 }, "KeLoaderBlock": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 728 }, "OffsetPrcbProcStateContext": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 700 }, "MmNonPagedPoolStart": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 272 }, "VfCrashDataBlock": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 792 }, "ExpNumberOfPagedPools": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 112 }, "MmSharedCommit": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 344 }, "MmUnloadedDrivers": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 544 }, "GdtTss": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 770 }, "KernBase": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 24 }, "KeTimeIncrement": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 120 }, "OffsetPrcbPcrPage": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 752 }, "OffsetPcrCurrentPrcb": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 740 }, "NtBuildLab": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 520 }, "MmLastUnloadedDriver": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 552 }, "MmTriageActionTaken": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 560 }, "PspCidTable": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 88 }, "MmHighestPhysicalPage": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 240 }, "PsLoadedModuleList": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 72 }, "KdPrintWritePointer": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 496 }, "MmNonPagedPoolEnd": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 280 }, "OffsetPrcbNumber": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 702 }, "MmSystemCacheWs": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 184 }, "BreakpointWithStatus": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 32 }, "MmLowestPhysicalPage": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 232 }, "MmSystemPtesEnd": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 208 }, "MmModifiedNoWritePageListHead": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 416 }, "MmExtendedCommit": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 376 }, "OffsetPrcbDpcRoutine": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 690 }, "GdtR0Code": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 756 }, "OffsetEprocessParentCID": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 684 }, "MmZeroedPageListHead": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 384 }, "MmAllocatedNonPagedPool": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 592 }, "MmUserProbeAddress": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 472 }, "MmSystemCacheStart": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 168 }, "Header": { "type": { "kind": "struct", "name": "_DBGKD_DEBUG_DATA_HEADER64" }, "offset": 0 }, "OffsetKThreadNextProcessor": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 664 }, "ExpPagedPoolDescriptor": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 104 }, "MmNumberOfPhysicalPages": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 248 }, "OffsetPcrBStoreLimit": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 746 }, "MmPagedPoolInformation": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 304 }, "OffsetPrcbMhz": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 694 }, "MmSizeOfPagedPoolInBytes": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 320 }, "ObpRootDirectoryObject": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 152 }, "KdPrintCircularBuffer": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 480 }, "SavedContext": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 40 }, "KiCallUserMode": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 56 }, "MmTotalCommitLimitMaximum": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 608 }, "GdtR3Code": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 762 }, "MmPageSize": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 312 }, "IopErrorLogListHead": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 144 }, "KdPrintRolloverCount": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 504 }, "KdPrintCircularBufferPtr": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 712 }, "OffsetKThreadTeb": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 666 }, "MmLoadedUserImageList": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 512 }, "OffsetPcrStackLimit": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 750 }, "MmSessionBase": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 632 }, "NonPagedPoolDescriptor": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 448 }, "OffsetEprocessDirectoryTableBase": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 686 }, "IopTriageDumpDataBlocks": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 784 }, "OffsetKThreadInitialStack": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 670 }, "KernelVerifier": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 576 }, "PoolTrackTable": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 440 }, "MmSessionSize": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 640 }, "OffsetPcrInitialStack": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 748 }, "MmMaximumNonPagedPoolInBytes": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 256 }, "MmSystemRangeStart": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 464 }, "ExpSystemResourcesList": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 96 }, "MmSpecialPoolTag": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 568 } }, "kind": "struct", "size": 832 }, "LIST_ENTRY64": { "fields": { "Flink": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 0 }, "Blink": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 8 } }, "kind": "struct", "size": 16 } }, "metadata": { "producer": { "version": "0.0.1", "name": "vtypes_to_json.py", "datetime": "2018-05-22T22:47:20.182954" }, "format": "4.1.0" } }volatility3-1.0.1/volatility3/framework/symbols/windows/netscan-vista-sp12-x64.json000066400000000000000000000330661405267600400303260ustar00rootroot00000000000000{ "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 8, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "unsigned be short": { "kind": "int", "size": 2, "signed": false, "endian": "big" }, "long long": { "endian": "little", "kind": "int", "signed": true, "size": 8 }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "symbols": {}, "user_types": { "_TCP_SYN_ENDPOINT": { "fields": { "Owner": { "offset": 64, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SYN_OWNER" } } }, "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 16, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "InetAF": { "offset": 48, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 100, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 102, "type": { "kind": "base", "name": "unsigned be short" } }, "LocalAddr": { "offset": 56, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "RemoteAddress": { "offset": 80, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 104 }, "_TCP_TIMEWAIT_ENDPOINT": { "fields": { "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 0, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "InetAF": { "offset": 24, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 48, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 50, "type": { "kind": "base", "name": "unsigned be short" } }, "LocalAddr": { "offset": 56, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "RemoteAddress": { "offset": 64, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 72 }, "_UDP_ENDPOINT": { "fields": { "Owner": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 88, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 96, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 32, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 128, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 130 }, "_TCP_LISTENER": { "fields": { "Owner": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 32, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 88, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 96, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 106, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 108 }, "_TCP_ENDPOINT": { "fields": { "Owner": { "offset": 528, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 40, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "AddrInfo": { "offset": 32, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_ADDRINFO" } } }, "InetAF": { "offset": 24, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 84, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 86, "type": { "kind": "base", "name": "unsigned be short" } }, "State": { "offset": 80, "type": { "kind": "enum", "name": "TCPStateEnum" } } }, "kind": "struct", "size": 536 }, "_LOCAL_ADDRESS": { "fields": { "pData": { "offset": 16, "type": { "kind": "pointer", "subtype": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } } }, "kind": "struct", "size": 24 }, "_ADDRINFO": { "fields": { "Local": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "Remote": { "offset": 16, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 24 }, "_IN_ADDR": { "fields": { "addr4": { "offset": 0, "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } }, "addr6": { "offset": 0, "type": { "count": 16, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } } }, "kind": "struct", "size": 6 }, "_INETAF": { "fields": { "AddressFamily": { "offset": 20, "type": { "kind": "base", "name": "unsigned short" } } }, "kind": "struct", "size": 22 }, "_SYN_OWNER": { "fields": { "Process": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } } }, "kind": "struct", "size": 48 }, "_LARGE_INTEGER": { "fields": { "HighPart": { "offset": 4, "type": { "kind": "base", "name": "long" } }, "LowPart": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "QuadPart": { "offset": 0, "type": { "kind": "base", "name": "long long" } }, "u": { "offset": 0, "type": { "kind": "struct", "name": "__unnamed_2" } } }, "kind": "union", "size": 8 } }, "enums": { "TCPStateEnum": { "base": "long", "constants": { "CLOSED": 0, "LISTENING": 1, "SYN_SENT": 2, "SYN_RCVD": 3, "ESTABLISHED": 4, "FIN_WAIT1": 5, "FIN_WAIT2": 6, "CLOSE_WAIT": 7, "CLOSING": 8, "LAST_ACK": 9, "TIME_WAIT": 12, "DELETE_TCB": 13 }, "size": 4 } }, "metadata": { "producer": { "version": "0.0.1", "name": "japhlange-by-hand", "datetime": "2020-06-12T14:00:00" }, "format": "6.0.0" } } volatility3-1.0.1/volatility3/framework/symbols/windows/netscan-vista-x64.json000066400000000000000000000330661405267600400275430ustar00rootroot00000000000000{ "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 8, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "unsigned be short": { "kind": "int", "size": 2, "signed": false, "endian": "big" }, "long long": { "endian": "little", "kind": "int", "signed": true, "size": 8 }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "symbols": {}, "user_types": { "_TCP_SYN_ENDPOINT": { "fields": { "Owner": { "offset": 64, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SYN_OWNER" } } }, "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 16, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "InetAF": { "offset": 48, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 100, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 102, "type": { "kind": "base", "name": "unsigned be short" } }, "LocalAddr": { "offset": 56, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "RemoteAddress": { "offset": 80, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 104 }, "_TCP_TIMEWAIT_ENDPOINT": { "fields": { "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 0, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "InetAF": { "offset": 24, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 48, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 50, "type": { "kind": "base", "name": "unsigned be short" } }, "LocalAddr": { "offset": 56, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "RemoteAddress": { "offset": 64, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 72 }, "_UDP_ENDPOINT": { "fields": { "Owner": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 88, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 96, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 32, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 128, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 130 }, "_TCP_LISTENER": { "fields": { "Owner": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 32, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 88, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 96, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 106, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 108 }, "_TCP_ENDPOINT": { "fields": { "Owner": { "offset": 520, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 40, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "AddrInfo": { "offset": 32, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_ADDRINFO" } } }, "InetAF": { "offset": 24, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 84, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 86, "type": { "kind": "base", "name": "unsigned be short" } }, "State": { "offset": 80, "type": { "kind": "enum", "name": "TCPStateEnum" } } }, "kind": "struct", "size": 528 }, "_LOCAL_ADDRESS": { "fields": { "pData": { "offset": 16, "type": { "kind": "pointer", "subtype": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } } }, "kind": "struct", "size": 24 }, "_ADDRINFO": { "fields": { "Local": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "Remote": { "offset": 16, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 24 }, "_IN_ADDR": { "fields": { "addr4": { "offset": 0, "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } }, "addr6": { "offset": 0, "type": { "count": 16, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } } }, "kind": "struct", "size": 6 }, "_INETAF": { "fields": { "AddressFamily": { "offset": 20, "type": { "kind": "base", "name": "unsigned short" } } }, "kind": "struct", "size": 22 }, "_SYN_OWNER": { "fields": { "Process": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } } }, "kind": "struct", "size": 48 }, "_LARGE_INTEGER": { "fields": { "HighPart": { "offset": 4, "type": { "kind": "base", "name": "long" } }, "LowPart": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "QuadPart": { "offset": 0, "type": { "kind": "base", "name": "long long" } }, "u": { "offset": 0, "type": { "kind": "struct", "name": "__unnamed_2" } } }, "kind": "union", "size": 8 } }, "enums": { "TCPStateEnum": { "base": "long", "constants": { "CLOSED": 0, "LISTENING": 1, "SYN_SENT": 2, "SYN_RCVD": 3, "ESTABLISHED": 4, "FIN_WAIT1": 5, "FIN_WAIT2": 6, "CLOSE_WAIT": 7, "CLOSING": 8, "LAST_ACK": 9, "TIME_WAIT": 12, "DELETE_TCB": 13 }, "size": 4 } }, "metadata": { "producer": { "version": "0.0.1", "name": "japhlange-by-hand", "datetime": "2020-06-12T14:00:00" }, "format": "6.0.0" } } volatility3-1.0.1/volatility3/framework/symbols/windows/netscan-vista-x86.json000066400000000000000000000330571405267600400275470ustar00rootroot00000000000000{ "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "unsigned be short": { "kind": "int", "size": 2, "signed": false, "endian": "big" }, "long long": { "endian": "little", "kind": "int", "signed": true, "size": 8 }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "symbols": {}, "user_types": { "_TCP_SYN_ENDPOINT": { "fields": { "Owner": { "offset": 32, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SYN_OWNER" } } }, "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 8, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "InetAF": { "offset": 24, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 60, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 62, "type": { "kind": "base", "name": "unsigned be short" } }, "LocalAddr": { "offset": 28, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "RemoteAddress": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 64 }, "_TCP_TIMEWAIT_ENDPOINT": { "fields": { "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 20, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "InetAF": { "offset": 12, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 28, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 30, "type": { "kind": "base", "name": "unsigned be short" } }, "LocalAddr": { "offset": 32, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "RemoteAddress": { "offset": 36, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 40 }, "_UDP_ENDPOINT": { "fields": { "Owner": { "offset": 24, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 48, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 56, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 20, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 72, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 74 }, "_TCP_LISTENER": { "fields": { "Owner": { "offset": 24, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 32, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 52, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 56, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 62, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 64 }, "_TCP_ENDPOINT": { "fields": { "Owner": { "offset": 352, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 20, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "AddrInfo": { "offset": 16, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_ADDRINFO" } } }, "InetAF": { "offset": 12, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 44, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 46, "type": { "kind": "base", "name": "unsigned be short" } }, "State": { "offset": 40, "type": { "kind": "enum", "name": "TCPStateEnum" } } }, "kind": "struct", "size": 356 }, "_LOCAL_ADDRESS": { "fields": { "pData": { "offset": 12, "type": { "kind": "pointer", "subtype": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } } }, "kind": "struct", "size": 16 }, "_ADDRINFO": { "fields": { "Local": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "Remote": { "offset": 8, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 12 }, "_IN_ADDR": { "fields": { "addr4": { "offset": 0, "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } }, "addr6": { "offset": 0, "type": { "count": 16, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } } }, "kind": "struct", "size": 6 }, "_INETAF": { "fields": { "AddressFamily": { "offset": 12, "type": { "kind": "base", "name": "unsigned short" } } }, "kind": "struct", "size": 14 }, "_SYN_OWNER": { "fields": { "Process": { "offset": 24, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } } }, "kind": "struct", "size": 14 }, "_LARGE_INTEGER": { "fields": { "HighPart": { "offset": 4, "type": { "kind": "base", "name": "long" } }, "LowPart": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "QuadPart": { "offset": 0, "type": { "kind": "base", "name": "long long" } }, "u": { "offset": 0, "type": { "kind": "struct", "name": "__unnamed_2" } } }, "kind": "union", "size": 8 } }, "enums": { "TCPStateEnum": { "base": "long", "constants": { "CLOSED": 0, "LISTENING": 1, "SYN_SENT": 2, "SYN_RCVD": 3, "ESTABLISHED": 4, "FIN_WAIT1": 5, "FIN_WAIT2": 6, "CLOSE_WAIT": 7, "CLOSING": 8, "LAST_ACK": 9, "TIME_WAIT": 12, "DELETE_TCB": 13 }, "size": 4 } }, "metadata": { "producer": { "version": "0.0.1", "name": "japhlange-by-hand", "datetime": "2020-05-29T19:28:34" }, "format": "6.0.0" } } volatility3-1.0.1/volatility3/framework/symbols/windows/netscan-win10-14393-x86.json000066400000000000000000000330551405267600400300360ustar00rootroot00000000000000{ "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "unsigned be short": { "kind": "int", "size": 2, "signed": false, "endian": "big" }, "long long": { "endian": "little", "kind": "int", "signed": true, "size": 8 }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "symbols": {}, "user_types": { "_TCP_SYN_ENDPOINT": { "fields": { "Owner": { "offset": 32, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SYN_OWNER" } } }, "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 8, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "InetAF": { "offset": 24, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 60, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 62, "type": { "kind": "base", "name": "unsigned be short" } }, "LocalAddr": { "offset": 28, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "RemoteAddress": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 64 }, "_TCP_TIMEWAIT_ENDPOINT": { "fields": { "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 20, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "InetAF": { "offset": 12, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 28, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 30, "type": { "kind": "base", "name": "unsigned be short" } }, "LocalAddr": { "offset": 32, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "RemoteAddress": { "offset": 36, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 40 }, "_UDP_ENDPOINT": { "fields": { "Owner": { "offset": 24, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 48, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 56, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 20, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 72, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 74 }, "_TCP_LISTENER": { "fields": { "Owner": { "offset": 24, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 32, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 52, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 56, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 62, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 64 }, "_TCP_ENDPOINT": { "fields": { "Owner": { "offset": 436, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 20, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "AddrInfo": { "offset": 12, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_ADDRINFO" } } }, "InetAF": { "offset": 8, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 60, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 62, "type": { "kind": "base", "name": "unsigned be short" } }, "State": { "offset": 56, "type": { "kind": "enum", "name": "TCPStateEnum" } } }, "kind": "struct", "size": 440 }, "_LOCAL_ADDRESS": { "fields": { "pData": { "offset": 12, "type": { "kind": "pointer", "subtype": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } } }, "kind": "struct", "size": 16 }, "_ADDRINFO": { "fields": { "Local": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "Remote": { "offset": 12, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 16 }, "_IN_ADDR": { "fields": { "addr4": { "offset": 0, "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } }, "addr6": { "offset": 0, "type": { "count": 16, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } } }, "kind": "struct", "size": 6 }, "_INETAF": { "fields": { "AddressFamily": { "offset": 12, "type": { "kind": "base", "name": "unsigned short" } } }, "kind": "struct", "size": 14 }, "_SYN_OWNER": { "fields": { "Process": { "offset": 24, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } } }, "kind": "struct", "size": 14 }, "_LARGE_INTEGER": { "fields": { "HighPart": { "offset": 4, "type": { "kind": "base", "name": "long" } }, "LowPart": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "QuadPart": { "offset": 0, "type": { "kind": "base", "name": "long long" } }, "u": { "offset": 0, "type": { "kind": "struct", "name": "__unnamed_2" } } }, "kind": "union", "size": 8 } }, "enums": { "TCPStateEnum": { "base": "long", "constants": { "CLOSED": 0, "LISTENING": 1, "SYN_SENT": 2, "SYN_RCVD": 3, "ESTABLISHED": 4, "FIN_WAIT1": 5, "FIN_WAIT2": 6, "CLOSE_WAIT": 7, "CLOSING": 8, "LAST_ACK": 9, "TIME_WAIT": 12, "DELETE_TCB": 13 }, "size": 4 } }, "metadata": { "producer": { "version": "0.0.1", "name": "japhlange-by-hand", "datetime": "2020-05-29T19:28:34" }, "format": "6.0.0" } } volatility3-1.0.1/volatility3/framework/symbols/windows/netscan-win10-15063-x64.json000066400000000000000000000230621405267600400300220ustar00rootroot00000000000000{ "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 8, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "unsigned be short": { "kind": "int", "size": 2, "signed": false, "endian": "big" }, "long long": { "endian": "little", "kind": "int", "signed": true, "size": 8 }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "symbols": {}, "user_types": { "_UDP_ENDPOINT": { "fields": { "Owner": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 88, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 128, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS_WIN10_UDP" } } }, "InetAF": { "offset": 32, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 120, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 132 }, "_TCP_LISTENER": { "fields": { "Owner": { "offset": 48, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 64, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 96, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 40, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 114, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 116 }, "_TCP_ENDPOINT": { "fields": { "Owner": { "offset": 624, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 616, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "AddrInfo": { "offset": 24, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_ADDRINFO" } } }, "InetAF": { "offset": 16, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 112, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 114, "type": { "kind": "base", "name": "unsigned be short" } }, "State": { "offset": 108, "type": { "kind": "enum", "name": "TCPStateEnum" } } }, "kind": "struct", "size": 632 }, "_LOCAL_ADDRESS": { "fields": { "pData": { "offset": 16, "type": { "kind": "pointer", "subtype": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } } }, "kind": "struct", "size": 20 }, "_LOCAL_ADDRESS_WIN10_UDP": { "fields": { "pData": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 4 }, "_ADDRINFO": { "fields": { "Local": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "Remote": { "offset": 16, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 4 }, "_IN_ADDR": { "fields": { "addr4": { "offset": 0, "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } }, "addr6": { "offset": 0, "type": { "count": 16, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } } }, "kind": "struct", "size": 6 }, "_INETAF": { "fields": { "AddressFamily": { "offset": 24, "type": { "kind": "base", "name": "unsigned short" } } }, "kind": "struct", "size": 26 }, "_LARGE_INTEGER": { "fields": { "HighPart": { "offset": 4, "type": { "kind": "base", "name": "long" } }, "LowPart": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "QuadPart": { "offset": 0, "type": { "kind": "base", "name": "long long" } }, "u": { "offset": 0, "type": { "kind": "struct", "name": "__unnamed_2" } } }, "kind": "union", "size": 8 } }, "enums": { "TCPStateEnum": { "base": "long", "constants": { "CLOSED": 0, "LISTENING": 1, "SYN_SENT": 2, "SYN_RCVD": 3, "ESTABLISHED": 4, "FIN_WAIT1": 5, "FIN_WAIT2": 6, "CLOSE_WAIT": 7, "CLOSING": 8, "LAST_ACK": 9, "TIME_WAIT": 12, "DELETE_TCB": 13 }, "size": 4 } }, "metadata": { "producer": { "version": "0.0.1", "name": "japhlange-by-hand", "datetime": "2020-05-29T19:28:34" }, "format": "6.0.0" } } volatility3-1.0.1/volatility3/framework/symbols/windows/netscan-win10-15063-x86.json000066400000000000000000000330551405267600400300310ustar00rootroot00000000000000{ "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "unsigned be short": { "kind": "int", "size": 2, "signed": false, "endian": "big" }, "long long": { "endian": "little", "kind": "int", "signed": true, "size": 8 }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "symbols": {}, "user_types": { "_TCP_SYN_ENDPOINT": { "fields": { "Owner": { "offset": 32, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SYN_OWNER" } } }, "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 8, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "InetAF": { "offset": 24, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 60, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 62, "type": { "kind": "base", "name": "unsigned be short" } }, "LocalAddr": { "offset": 28, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "RemoteAddress": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 64 }, "_TCP_TIMEWAIT_ENDPOINT": { "fields": { "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 20, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "InetAF": { "offset": 12, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 28, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 30, "type": { "kind": "base", "name": "unsigned be short" } }, "LocalAddr": { "offset": 32, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "RemoteAddress": { "offset": 36, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 40 }, "_UDP_ENDPOINT": { "fields": { "Owner": { "offset": 24, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 48, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 56, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 20, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 72, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 74 }, "_TCP_LISTENER": { "fields": { "Owner": { "offset": 24, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 32, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 52, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 56, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 62, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 64 }, "_TCP_ENDPOINT": { "fields": { "Owner": { "offset": 460, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 20, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "AddrInfo": { "offset": 12, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_ADDRINFO" } } }, "InetAF": { "offset": 8, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 60, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 62, "type": { "kind": "base", "name": "unsigned be short" } }, "State": { "offset": 56, "type": { "kind": "enum", "name": "TCPStateEnum" } } }, "kind": "struct", "size": 464 }, "_LOCAL_ADDRESS": { "fields": { "pData": { "offset": 12, "type": { "kind": "pointer", "subtype": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } } }, "kind": "struct", "size": 16 }, "_ADDRINFO": { "fields": { "Local": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "Remote": { "offset": 12, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 16 }, "_IN_ADDR": { "fields": { "addr4": { "offset": 0, "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } }, "addr6": { "offset": 0, "type": { "count": 16, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } } }, "kind": "struct", "size": 6 }, "_INETAF": { "fields": { "AddressFamily": { "offset": 12, "type": { "kind": "base", "name": "unsigned short" } } }, "kind": "struct", "size": 14 }, "_SYN_OWNER": { "fields": { "Process": { "offset": 24, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } } }, "kind": "struct", "size": 14 }, "_LARGE_INTEGER": { "fields": { "HighPart": { "offset": 4, "type": { "kind": "base", "name": "long" } }, "LowPart": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "QuadPart": { "offset": 0, "type": { "kind": "base", "name": "long long" } }, "u": { "offset": 0, "type": { "kind": "struct", "name": "__unnamed_2" } } }, "kind": "union", "size": 8 } }, "enums": { "TCPStateEnum": { "base": "long", "constants": { "CLOSED": 0, "LISTENING": 1, "SYN_SENT": 2, "SYN_RCVD": 3, "ESTABLISHED": 4, "FIN_WAIT1": 5, "FIN_WAIT2": 6, "CLOSE_WAIT": 7, "CLOSING": 8, "LAST_ACK": 9, "TIME_WAIT": 12, "DELETE_TCB": 13 }, "size": 4 } }, "metadata": { "producer": { "version": "0.0.1", "name": "japhlange-by-hand", "datetime": "2020-05-29T19:28:34" }, "format": "6.0.0" } } volatility3-1.0.1/volatility3/framework/symbols/windows/netscan-win10-16299-x64.json000066400000000000000000000356601405267600400300450ustar00rootroot00000000000000{ "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 8, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "unsigned be short": { "kind": "int", "size": 2, "signed": false, "endian": "big" }, "long long": { "endian": "little", "kind": "int", "signed": true, "size": 8 }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "symbols": { "TcpCompartmentSet": { "address": 2059400 }, "UdpCompartmentSet": { "address": 2055504 }, "PartitionCount": { "address": 2057284 }, "PartitionTable": { "address": 2057288 } }, "user_types": { "_UDP_ENDPOINT": { "fields": { "Owner": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 88, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 128, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS_WIN10_UDP" } } }, "InetAF": { "offset": 32, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "MaskedPrevObj": { "offset": 112, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_UDP_ENDPOINT" } } }, "Port": { "offset": 120, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 132 }, "_TCP_LISTENER": { "fields": { "Owner": { "offset": 48, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 64, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 96, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 40, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 114, "type": { "kind": "base", "name": "unsigned be short" } }, "MaskedPrevObj": { "offset": 120, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_TCP_LISTENER" } } } }, "kind": "struct", "size": 128 }, "_TCP_ENDPOINT": { "fields": { "Owner": { "offset": 624, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 640, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "AddrInfo": { "offset": 24, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_ADDRINFO" } } }, "HashTableEntry": { "offset": 40, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LIST_ENTRY" } } }, "InetAF": { "offset": 16, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 112, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 114, "type": { "kind": "base", "name": "unsigned be short" } }, "State": { "offset": 108, "type": { "kind": "enum", "name": "TCPStateEnum" } }, "MaskedPrevObj": { "offset": 112, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_TCP_ENDPOINT" } } } }, "kind": "struct", "size": 632 }, "_LOCAL_ADDRESS": { "fields": { "pData": { "offset": 16, "type": { "kind": "pointer", "subtype": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } } }, "kind": "struct", "size": 20 }, "_LOCAL_ADDRESS_WIN10_UDP": { "fields": { "pData": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 4 }, "_ADDRINFO": { "fields": { "Local": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "Remote": { "offset": 16, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 4 }, "_IN_ADDR": { "fields": { "addr4": { "offset": 0, "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } }, "addr6": { "offset": 0, "type": { "count": 16, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } } }, "kind": "struct", "size": 6 }, "_INETAF": { "fields": { "AddressFamily": { "offset": 24, "type": { "kind": "base", "name": "unsigned short" } } }, "kind": "struct", "size": 26 }, "_LARGE_INTEGER": { "fields": { "HighPart": { "offset": 4, "type": { "kind": "base", "name": "long" } }, "LowPart": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "QuadPart": { "offset": 0, "type": { "kind": "base", "name": "long long" } }, "u": { "offset": 0, "type": { "kind": "struct", "name": "__unnamed_2" } } }, "kind": "union", "size": 8 }, "_INET_COMPARTMENT_SET": { "fields": { "InetCompartment": { "offset": 328, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_INET_COMPARTMENT" } } } }, "kind": "struct", "size": 384 }, "_INET_COMPARTMENT": { "fields": { "ProtocolCompartment": { "offset": 32, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_PROTOCOL_COMPARTMENT" } } } }, "kind": "struct", "size": 48 }, "_PROTOCOL_COMPARTMENT": { "fields": { "PortPool": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_INET_PORT_POOL" } } } }, "kind": "struct", "size": 16 }, "_PORT_ASSIGNMENT_ENTRY": { "fields": { "MaskedObjectPtr": { "offset": 8, "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "void" } } } }, "kind": "struct", "size": 24 }, "_PORT_ASSIGNMENT_LIST": { "fields": { "Assignments": { "offset": 0, "type": { "count": 256, "kind": "array", "subtype": { "kind": "struct", "name": "_PORT_ASSIGNMENT_ENTRY" } } } }, "kind": "struct", "size": 6144 }, "_PORT_ASSIGNMENT": { "fields": { "InPaBigPoolBase": { "offset": 24, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_PORT_ASSIGNMENT_LIST" } } } }, "kind": "struct", "size": 32 }, "_INET_PORT_POOL": { "fields": { "PortAssignments": { "offset": 232, "type": { "count": 256, "kind": "array", "subtype": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_PORT_ASSIGNMENT" } } } }, "PortBitMap": { "offset": 216, "type": { "kind": "struct", "name": "nt_symbols!_RTL_BITMAP" } } }, "kind": "struct", "size": 11200 }, "_PARTITION": { "fields": { "Endpoints" : { "offset": 8, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_RTL_DYNAMIC_HASH_TABLE" } } }, "UnknownHashTable" : { "offset": 16, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_RTL_DYNAMIC_HASH_TABLE" } } } }, "kind": "struct", "size": 128 } }, "enums": { "TCPStateEnum": { "base": "long", "constants": { "CLOSED": 0, "LISTENING": 1, "SYN_SENT": 2, "SYN_RCVD": 3, "ESTABLISHED": 4, "FIN_WAIT1": 5, "FIN_WAIT2": 6, "CLOSE_WAIT": 7, "CLOSING": 8, "LAST_ACK": 9, "TIME_WAIT": 12, "DELETE_TCB": 13 }, "size": 4 } }, "metadata": { "producer": { "version": "0.0.1", "name": "japhlange-by-hand", "datetime": "2020-05-29T19:28:34" }, "format": "6.0.0" } } volatility3-1.0.1/volatility3/framework/symbols/windows/netscan-win10-17134-x64.json000066400000000000000000000230621405267600400300230ustar00rootroot00000000000000{ "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 8, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "unsigned be short": { "kind": "int", "size": 2, "signed": false, "endian": "big" }, "long long": { "endian": "little", "kind": "int", "signed": true, "size": 8 }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "symbols": {}, "user_types": { "_UDP_ENDPOINT": { "fields": { "Owner": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 88, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 128, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS_WIN10_UDP" } } }, "InetAF": { "offset": 32, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 120, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 132 }, "_TCP_LISTENER": { "fields": { "Owner": { "offset": 48, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 64, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 96, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 40, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 114, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 116 }, "_TCP_ENDPOINT": { "fields": { "Owner": { "offset": 632, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 648, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "AddrInfo": { "offset": 24, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_ADDRINFO" } } }, "InetAF": { "offset": 16, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 112, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 114, "type": { "kind": "base", "name": "unsigned be short" } }, "State": { "offset": 108, "type": { "kind": "enum", "name": "TCPStateEnum" } } }, "kind": "struct", "size": 632 }, "_LOCAL_ADDRESS": { "fields": { "pData": { "offset": 16, "type": { "kind": "pointer", "subtype": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } } }, "kind": "struct", "size": 20 }, "_LOCAL_ADDRESS_WIN10_UDP": { "fields": { "pData": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 4 }, "_ADDRINFO": { "fields": { "Local": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "Remote": { "offset": 16, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 4 }, "_IN_ADDR": { "fields": { "addr4": { "offset": 0, "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } }, "addr6": { "offset": 0, "type": { "count": 16, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } } }, "kind": "struct", "size": 6 }, "_INETAF": { "fields": { "AddressFamily": { "offset": 24, "type": { "kind": "base", "name": "unsigned short" } } }, "kind": "struct", "size": 26 }, "_LARGE_INTEGER": { "fields": { "HighPart": { "offset": 4, "type": { "kind": "base", "name": "long" } }, "LowPart": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "QuadPart": { "offset": 0, "type": { "kind": "base", "name": "long long" } }, "u": { "offset": 0, "type": { "kind": "struct", "name": "__unnamed_2" } } }, "kind": "union", "size": 8 } }, "enums": { "TCPStateEnum": { "base": "long", "constants": { "CLOSED": 0, "LISTENING": 1, "SYN_SENT": 2, "SYN_RCVD": 3, "ESTABLISHED": 4, "FIN_WAIT1": 5, "FIN_WAIT2": 6, "CLOSE_WAIT": 7, "CLOSING": 8, "LAST_ACK": 9, "TIME_WAIT": 12, "DELETE_TCB": 13 }, "size": 4 } }, "metadata": { "producer": { "version": "0.0.1", "name": "japhlange-by-hand", "datetime": "2020-05-29T19:28:34" }, "format": "6.0.0" } } volatility3-1.0.1/volatility3/framework/symbols/windows/netscan-win10-17134-x86.json000066400000000000000000000330551405267600400300320ustar00rootroot00000000000000{ "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "unsigned be short": { "kind": "int", "size": 2, "signed": false, "endian": "big" }, "long long": { "endian": "little", "kind": "int", "signed": true, "size": 8 }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "symbols": {}, "user_types": { "_TCP_SYN_ENDPOINT": { "fields": { "Owner": { "offset": 32, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SYN_OWNER" } } }, "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 8, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "InetAF": { "offset": 24, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 60, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 62, "type": { "kind": "base", "name": "unsigned be short" } }, "LocalAddr": { "offset": 28, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "RemoteAddress": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 64 }, "_TCP_TIMEWAIT_ENDPOINT": { "fields": { "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 20, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "InetAF": { "offset": 12, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 28, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 30, "type": { "kind": "base", "name": "unsigned be short" } }, "LocalAddr": { "offset": 32, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "RemoteAddress": { "offset": 36, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 40 }, "_UDP_ENDPOINT": { "fields": { "Owner": { "offset": 24, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 48, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 56, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 20, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 68, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 74 }, "_TCP_LISTENER": { "fields": { "Owner": { "offset": 24, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 32, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 52, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 56, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 62, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 64 }, "_TCP_ENDPOINT": { "fields": { "Owner": { "offset": 460, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 20, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "AddrInfo": { "offset": 12, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_ADDRINFO" } } }, "InetAF": { "offset": 8, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 60, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 62, "type": { "kind": "base", "name": "unsigned be short" } }, "State": { "offset": 56, "type": { "kind": "enum", "name": "TCPStateEnum" } } }, "kind": "struct", "size": 464 }, "_LOCAL_ADDRESS": { "fields": { "pData": { "offset": 12, "type": { "kind": "pointer", "subtype": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } } }, "kind": "struct", "size": 16 }, "_ADDRINFO": { "fields": { "Local": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "Remote": { "offset": 12, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 16 }, "_IN_ADDR": { "fields": { "addr4": { "offset": 0, "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } }, "addr6": { "offset": 0, "type": { "count": 16, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } } }, "kind": "struct", "size": 6 }, "_INETAF": { "fields": { "AddressFamily": { "offset": 12, "type": { "kind": "base", "name": "unsigned short" } } }, "kind": "struct", "size": 14 }, "_SYN_OWNER": { "fields": { "Process": { "offset": 24, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } } }, "kind": "struct", "size": 14 }, "_LARGE_INTEGER": { "fields": { "HighPart": { "offset": 4, "type": { "kind": "base", "name": "long" } }, "LowPart": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "QuadPart": { "offset": 0, "type": { "kind": "base", "name": "long long" } }, "u": { "offset": 0, "type": { "kind": "struct", "name": "__unnamed_2" } } }, "kind": "union", "size": 8 } }, "enums": { "TCPStateEnum": { "base": "long", "constants": { "CLOSED": 0, "LISTENING": 1, "SYN_SENT": 2, "SYN_RCVD": 3, "ESTABLISHED": 4, "FIN_WAIT1": 5, "FIN_WAIT2": 6, "CLOSE_WAIT": 7, "CLOSING": 8, "LAST_ACK": 9, "TIME_WAIT": 12, "DELETE_TCB": 13 }, "size": 4 } }, "metadata": { "producer": { "version": "0.0.1", "name": "japhlange-by-hand", "datetime": "2020-05-29T19:28:34" }, "format": "6.0.0" } } volatility3-1.0.1/volatility3/framework/symbols/windows/netscan-win10-17763-x64.json000066400000000000000000000230621405267600400300330ustar00rootroot00000000000000{ "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 8, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "unsigned be short": { "kind": "int", "size": 2, "signed": false, "endian": "big" }, "long long": { "endian": "little", "kind": "int", "signed": true, "size": 8 }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "symbols": {}, "user_types": { "_UDP_ENDPOINT": { "fields": { "Owner": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 88, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 128, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS_WIN10_UDP" } } }, "InetAF": { "offset": 32, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 120, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 132 }, "_TCP_LISTENER": { "fields": { "Owner": { "offset": 48, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 64, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 96, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 40, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 114, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 116 }, "_TCP_ENDPOINT": { "fields": { "Owner": { "offset": 656, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 672, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "AddrInfo": { "offset": 24, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_ADDRINFO" } } }, "InetAF": { "offset": 16, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 112, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 114, "type": { "kind": "base", "name": "unsigned be short" } }, "State": { "offset": 108, "type": { "kind": "enum", "name": "TCPStateEnum" } } }, "kind": "struct", "size": 632 }, "_LOCAL_ADDRESS": { "fields": { "pData": { "offset": 16, "type": { "kind": "pointer", "subtype": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } } }, "kind": "struct", "size": 20 }, "_LOCAL_ADDRESS_WIN10_UDP": { "fields": { "pData": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 4 }, "_ADDRINFO": { "fields": { "Local": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "Remote": { "offset": 16, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 4 }, "_IN_ADDR": { "fields": { "addr4": { "offset": 0, "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } }, "addr6": { "offset": 0, "type": { "count": 16, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } } }, "kind": "struct", "size": 6 }, "_INETAF": { "fields": { "AddressFamily": { "offset": 24, "type": { "kind": "base", "name": "unsigned short" } } }, "kind": "struct", "size": 26 }, "_LARGE_INTEGER": { "fields": { "HighPart": { "offset": 4, "type": { "kind": "base", "name": "long" } }, "LowPart": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "QuadPart": { "offset": 0, "type": { "kind": "base", "name": "long long" } }, "u": { "offset": 0, "type": { "kind": "struct", "name": "__unnamed_2" } } }, "kind": "union", "size": 8 } }, "enums": { "TCPStateEnum": { "base": "long", "constants": { "CLOSED": 0, "LISTENING": 1, "SYN_SENT": 2, "SYN_RCVD": 3, "ESTABLISHED": 4, "FIN_WAIT1": 5, "FIN_WAIT2": 6, "CLOSE_WAIT": 7, "CLOSING": 8, "LAST_ACK": 9, "TIME_WAIT": 12, "DELETE_TCB": 13 }, "size": 4 } }, "metadata": { "producer": { "version": "0.0.1", "name": "japhlange-by-hand", "datetime": "2020-05-29T19:28:34" }, "format": "6.0.0" } } volatility3-1.0.1/volatility3/framework/symbols/windows/netscan-win10-18363-x64.json000066400000000000000000000230621405267600400300300ustar00rootroot00000000000000{ "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 8, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "unsigned be short": { "kind": "int", "size": 2, "signed": false, "endian": "big" }, "long long": { "endian": "little", "kind": "int", "signed": true, "size": 8 }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "symbols": {}, "user_types": { "_UDP_ENDPOINT": { "fields": { "Owner": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 88, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 136, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS_WIN10_UDP" } } }, "InetAF": { "offset": 32, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 128, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 132 }, "_TCP_LISTENER": { "fields": { "Owner": { "offset": 48, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 64, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 96, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 40, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 114, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 116 }, "_TCP_ENDPOINT": { "fields": { "Owner": { "offset": 656, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 672, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "AddrInfo": { "offset": 24, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_ADDRINFO" } } }, "InetAF": { "offset": 16, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 112, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 114, "type": { "kind": "base", "name": "unsigned be short" } }, "State": { "offset": 108, "type": { "kind": "enum", "name": "TCPStateEnum" } } }, "kind": "struct", "size": 632 }, "_LOCAL_ADDRESS": { "fields": { "pData": { "offset": 16, "type": { "kind": "pointer", "subtype": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } } }, "kind": "struct", "size": 20 }, "_LOCAL_ADDRESS_WIN10_UDP": { "fields": { "pData": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 4 }, "_ADDRINFO": { "fields": { "Local": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "Remote": { "offset": 16, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 4 }, "_IN_ADDR": { "fields": { "addr4": { "offset": 0, "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } }, "addr6": { "offset": 0, "type": { "count": 16, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } } }, "kind": "struct", "size": 6 }, "_INETAF": { "fields": { "AddressFamily": { "offset": 24, "type": { "kind": "base", "name": "unsigned short" } } }, "kind": "struct", "size": 26 }, "_LARGE_INTEGER": { "fields": { "HighPart": { "offset": 4, "type": { "kind": "base", "name": "long" } }, "LowPart": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "QuadPart": { "offset": 0, "type": { "kind": "base", "name": "long long" } }, "u": { "offset": 0, "type": { "kind": "struct", "name": "__unnamed_2" } } }, "kind": "union", "size": 8 } }, "enums": { "TCPStateEnum": { "base": "long", "constants": { "CLOSED": 0, "LISTENING": 1, "SYN_SENT": 2, "SYN_RCVD": 3, "ESTABLISHED": 4, "FIN_WAIT1": 5, "FIN_WAIT2": 6, "CLOSE_WAIT": 7, "CLOSING": 8, "LAST_ACK": 9, "TIME_WAIT": 12, "DELETE_TCB": 13 }, "size": 4 } }, "metadata": { "producer": { "version": "0.0.1", "name": "japhlange-by-hand", "datetime": "2020-05-29T19:28:34" }, "format": "6.0.0" } } volatility3-1.0.1/volatility3/framework/symbols/windows/netscan-win10-19041-x64.json000066400000000000000000000242221405267600400300210ustar00rootroot00000000000000{ "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 8, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "unsigned be short": { "kind": "int", "size": 2, "signed": false, "endian": "big" }, "long long": { "endian": "little", "kind": "int", "signed": true, "size": 8 }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "symbols": {}, "user_types": { "_UDP_ENDPOINT": { "fields": { "Owner": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 88, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 168, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS_WIN10_UDP" } } }, "InetAF": { "offset": 32, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "MaskedPrevObj": { "offset": 112, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_UDP_ENDPOINT" } } }, "Port": { "offset": 160, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 132 }, "_TCP_LISTENER": { "fields": { "Owner": { "offset": 48, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 64, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 96, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 40, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "MaskedPrevObj": { "offset": 120, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_TCP_LISTENER" } } }, "Port": { "offset": 114, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 128 }, "_TCP_ENDPOINT": { "fields": { "Owner": { "offset": 728, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 744, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "AddrInfo": { "offset": 24, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_ADDRINFO" } } }, "InetAF": { "offset": 16, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 112, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 114, "type": { "kind": "base", "name": "unsigned be short" } }, "State": { "offset": 108, "type": { "kind": "enum", "name": "TCPStateEnum" } } }, "kind": "struct", "size": 632 }, "_LOCAL_ADDRESS": { "fields": { "pData": { "offset": 16, "type": { "kind": "pointer", "subtype": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } } }, "kind": "struct", "size": 20 }, "_LOCAL_ADDRESS_WIN10_UDP": { "fields": { "pData": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 4 }, "_ADDRINFO": { "fields": { "Local": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "Remote": { "offset": 16, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 4 }, "_IN_ADDR": { "fields": { "addr4": { "offset": 0, "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } }, "addr6": { "offset": 0, "type": { "count": 16, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } } }, "kind": "struct", "size": 6 }, "_INETAF": { "fields": { "AddressFamily": { "offset": 24, "type": { "kind": "base", "name": "unsigned short" } } }, "kind": "struct", "size": 26 }, "_LARGE_INTEGER": { "fields": { "HighPart": { "offset": 4, "type": { "kind": "base", "name": "long" } }, "LowPart": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "QuadPart": { "offset": 0, "type": { "kind": "base", "name": "long long" } }, "u": { "offset": 0, "type": { "kind": "struct", "name": "__unnamed_2" } } }, "kind": "union", "size": 8 } }, "enums": { "TCPStateEnum": { "base": "long", "constants": { "CLOSED": 0, "LISTENING": 1, "SYN_SENT": 2, "SYN_RCVD": 3, "ESTABLISHED": 4, "FIN_WAIT1": 5, "FIN_WAIT2": 6, "CLOSE_WAIT": 7, "CLOSING": 8, "LAST_ACK": 9, "TIME_WAIT": 12, "DELETE_TCB": 13 }, "size": 4 } }, "metadata": { "producer": { "version": "0.0.1", "name": "japhlange-by-hand", "datetime": "2020-05-29T19:28:34" }, "format": "6.0.0" } } volatility3-1.0.1/volatility3/framework/symbols/windows/netscan-win10-19041-x86.json000066400000000000000000000230621405267600400300260ustar00rootroot00000000000000{ "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "unsigned be short": { "kind": "int", "size": 2, "signed": false, "endian": "big" }, "long long": { "endian": "little", "kind": "int", "signed": true, "size": 8 }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "symbols": {}, "user_types": { "_UDP_ENDPOINT": { "fields": { "Owner": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 88, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 160, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS_WIN10_UDP" } } }, "InetAF": { "offset": 32, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 152, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 132 }, "_TCP_LISTENER": { "fields": { "Owner": { "offset": 48, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 64, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 96, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 40, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 114, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 116 }, "_TCP_ENDPOINT": { "fields": { "Owner": { "offset": 624, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 616, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "AddrInfo": { "offset": 24, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_ADDRINFO" } } }, "InetAF": { "offset": 16, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 112, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 114, "type": { "kind": "base", "name": "unsigned be short" } }, "State": { "offset": 108, "type": { "kind": "enum", "name": "TCPStateEnum" } } }, "kind": "struct", "size": 632 }, "_LOCAL_ADDRESS": { "fields": { "pData": { "offset": 16, "type": { "kind": "pointer", "subtype": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } } }, "kind": "struct", "size": 20 }, "_LOCAL_ADDRESS_WIN10_UDP": { "fields": { "pData": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 4 }, "_ADDRINFO": { "fields": { "Local": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "Remote": { "offset": 16, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 4 }, "_IN_ADDR": { "fields": { "addr4": { "offset": 0, "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } }, "addr6": { "offset": 0, "type": { "count": 16, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } } }, "kind": "struct", "size": 6 }, "_INETAF": { "fields": { "AddressFamily": { "offset": 24, "type": { "kind": "base", "name": "unsigned short" } } }, "kind": "struct", "size": 26 }, "_LARGE_INTEGER": { "fields": { "HighPart": { "offset": 4, "type": { "kind": "base", "name": "long" } }, "LowPart": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "QuadPart": { "offset": 0, "type": { "kind": "base", "name": "long long" } }, "u": { "offset": 0, "type": { "kind": "struct", "name": "__unnamed_2" } } }, "kind": "union", "size": 8 } }, "enums": { "TCPStateEnum": { "base": "long", "constants": { "CLOSED": 0, "LISTENING": 1, "SYN_SENT": 2, "SYN_RCVD": 3, "ESTABLISHED": 4, "FIN_WAIT1": 5, "FIN_WAIT2": 6, "CLOSE_WAIT": 7, "CLOSING": 8, "LAST_ACK": 9, "TIME_WAIT": 12, "DELETE_TCB": 13 }, "size": 4 } }, "metadata": { "producer": { "version": "0.0.1", "name": "japhlange-by-hand", "datetime": "2020-08-20T17:00:00" }, "format": "6.0.0" } } volatility3-1.0.1/volatility3/framework/symbols/windows/netscan-win10-x64.json000066400000000000000000000230631405267600400273470ustar00rootroot00000000000000{ "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 8, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "unsigned be short": { "kind": "int", "size": 2, "signed": false, "endian": "big" }, "long long": { "endian": "little", "kind": "int", "signed": true, "size": 8 }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "symbols": {}, "user_types": { "_UDP_ENDPOINT": { "fields": { "Owner": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 88, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 128, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS_WIN10_UDP" } } }, "InetAF": { "offset": 32, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 120, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 132 }, "_TCP_LISTENER": { "fields": { "Owner": { "offset": 48, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 64, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 96, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 40, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 114, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 116 }, "_TCP_ENDPOINT": { "fields": { "Owner": { "offset": 600, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 616, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "AddrInfo": { "offset": 24, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_ADDRINFO" } } }, "InetAF": { "offset": 16, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 112, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 114, "type": { "kind": "base", "name": "unsigned be short" } }, "State": { "offset": 108, "type": { "kind": "enum", "name": "TCPStateEnum" } } }, "kind": "struct", "size": 624 }, "_LOCAL_ADDRESS": { "fields": { "pData": { "offset": 16, "type": { "kind": "pointer", "subtype": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } } }, "kind": "struct", "size": 20 }, "_LOCAL_ADDRESS_WIN10_UDP": { "fields": { "pData": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 4 }, "_ADDRINFO": { "fields": { "Local": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "Remote": { "offset": 16, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 4 }, "_IN_ADDR": { "fields": { "addr4": { "offset": 0, "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } }, "addr6": { "offset": 0, "type": { "count": 16, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } } }, "kind": "struct", "size": 6 }, "_INETAF": { "fields": { "AddressFamily": { "offset": 24, "type": { "kind": "base", "name": "unsigned short" } } }, "kind": "struct", "size": 26 }, "_LARGE_INTEGER": { "fields": { "HighPart": { "offset": 4, "type": { "kind": "base", "name": "long" } }, "LowPart": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "QuadPart": { "offset": 0, "type": { "kind": "base", "name": "long long" } }, "u": { "offset": 0, "type": { "kind": "struct", "name": "__unnamed_2" } } }, "kind": "union", "size": 8 } }, "enums": { "TCPStateEnum": { "base": "long", "constants": { "CLOSED": 0, "LISTENING": 1, "SYN_SENT": 2, "SYN_RCVD": 3, "ESTABLISHED": 4, "FIN_WAIT1": 5, "FIN_WAIT2": 6, "CLOSE_WAIT": 7, "CLOSING": 8, "LAST_ACK": 9, "TIME_WAIT": 12, "DELETE_TCB": 13 }, "size": 4 } }, "metadata": { "producer": { "version": "0.0.1", "name": "japhlange-by-hand", "datetime": "2020-06-12T11:00:00" }, "format": "6.0.0" } } volatility3-1.0.1/volatility3/framework/symbols/windows/netscan-win10-x86.json000066400000000000000000000330571405267600400273570ustar00rootroot00000000000000{ "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "unsigned be short": { "kind": "int", "size": 2, "signed": false, "endian": "big" }, "long long": { "endian": "little", "kind": "int", "signed": true, "size": 8 }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "symbols": {}, "user_types": { "_TCP_SYN_ENDPOINT": { "fields": { "Owner": { "offset": 32, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SYN_OWNER" } } }, "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 8, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "InetAF": { "offset": 24, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 60, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 62, "type": { "kind": "base", "name": "unsigned be short" } }, "LocalAddr": { "offset": 28, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "RemoteAddress": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 64 }, "_TCP_TIMEWAIT_ENDPOINT": { "fields": { "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 20, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "InetAF": { "offset": 12, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 28, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 30, "type": { "kind": "base", "name": "unsigned be short" } }, "LocalAddr": { "offset": 32, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "RemoteAddress": { "offset": 36, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 40 }, "_UDP_ENDPOINT": { "fields": { "Owner": { "offset": 24, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 48, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 56, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 20, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 72, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 74 }, "_TCP_LISTENER": { "fields": { "Owner": { "offset": 28, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 40, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 60, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 64, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 70, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 72 }, "_TCP_ENDPOINT": { "fields": { "Owner": { "offset": 432, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 440, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 20, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "AddrInfo": { "offset": 12, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_ADDRINFO" } } }, "InetAF": { "offset": 8, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 60, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 62, "type": { "kind": "base", "name": "unsigned be short" } }, "State": { "offset": 56, "type": { "kind": "enum", "name": "TCPStateEnum" } } }, "kind": "struct", "size": 448 }, "_LOCAL_ADDRESS": { "fields": { "pData": { "offset": 12, "type": { "kind": "pointer", "subtype": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } } }, "kind": "struct", "size": 16 }, "_ADDRINFO": { "fields": { "Local": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "Remote": { "offset": 12, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 16 }, "_IN_ADDR": { "fields": { "addr4": { "offset": 0, "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } }, "addr6": { "offset": 0, "type": { "count": 16, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } } }, "kind": "struct", "size": 6 }, "_INETAF": { "fields": { "AddressFamily": { "offset": 12, "type": { "kind": "base", "name": "unsigned short" } } }, "kind": "struct", "size": 14 }, "_SYN_OWNER": { "fields": { "Process": { "offset": 24, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } } }, "kind": "struct", "size": 14 }, "_LARGE_INTEGER": { "fields": { "HighPart": { "offset": 4, "type": { "kind": "base", "name": "long" } }, "LowPart": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "QuadPart": { "offset": 0, "type": { "kind": "base", "name": "long long" } }, "u": { "offset": 0, "type": { "kind": "struct", "name": "__unnamed_2" } } }, "kind": "union", "size": 8 } }, "enums": { "TCPStateEnum": { "base": "long", "constants": { "CLOSED": 0, "LISTENING": 1, "SYN_SENT": 2, "SYN_RCVD": 3, "ESTABLISHED": 4, "FIN_WAIT1": 5, "FIN_WAIT2": 6, "CLOSE_WAIT": 7, "CLOSING": 8, "LAST_ACK": 9, "TIME_WAIT": 12, "DELETE_TCB": 13 }, "size": 4 } }, "metadata": { "producer": { "version": "0.0.1", "name": "japhlange-by-hand", "datetime": "2020-05-29T19:28:34" }, "format": "6.0.0" } } volatility3-1.0.1/volatility3/framework/symbols/windows/netscan-win7-x64.json000066400000000000000000000365451405267600400273060ustar00rootroot00000000000000{ "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 8, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "unsigned be short": { "kind": "int", "size": 2, "signed": false, "endian": "big" }, "long long": { "endian": "little", "kind": "int", "signed": true, "size": 8 }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "symbols": {}, "user_types": { "_TCP_SYN_ENDPOINT": { "fields": { "Owner": { "offset": 88, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SYN_OWNER" } } }, "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 16, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "InetAF": { "offset": 72, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 124, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 126, "type": { "kind": "base", "name": "unsigned be short" } }, "LocalAddr": { "offset": 80, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "RemoteAddress": { "offset": 104, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 128 }, "_TCP_TIMEWAIT_ENDPOINT": { "fields": { "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 0, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "InetAF": { "offset": 48, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 72, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 74, "type": { "kind": "base", "name": "unsigned be short" } }, "LocalAddr": { "offset": 80, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "RemoteAddress": { "offset": 88, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 96 }, "_UDP_ENDPOINT": { "fields": { "Owner": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 88, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 96, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 32, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 128, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 130 }, "_TCP_LISTENER": { "fields": { "Owner": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 32, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 88, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 96, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 106, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 108 }, "_TCP_ENDPOINT": { "fields": { "Owner": { "offset": 568, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 40, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "AddrInfo": { "offset": 32, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_ADDRINFO" } } }, "InetAF": { "offset": 24, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 108, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 110, "type": { "kind": "base", "name": "unsigned be short" } }, "State": { "offset": 104, "type": { "kind": "enum", "name": "TCPStateEnum" } } }, "kind": "struct", "size": 576 }, "_LOCAL_ADDRESS": { "fields": { "pData": { "offset": 16, "type": { "kind": "pointer", "subtype": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } } }, "kind": "struct", "size": 24 }, "_ADDRINFO": { "fields": { "Local": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "Remote": { "offset": 16, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 24 }, "_IN_ADDR": { "fields": { "addr4": { "offset": 0, "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } }, "addr6": { "offset": 0, "type": { "count": 16, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } } }, "kind": "struct", "size": 6 }, "_INETAF": { "fields": { "AddressFamily": { "offset": 20, "type": { "kind": "base", "name": "unsigned short" } } }, "kind": "struct", "size": 22 }, "_SYN_OWNER": { "fields": { "Process": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } } }, "kind": "struct", "size": 48 }, "_PARTITION_TABLE": { "fields": { "HashTable": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "void" } } }, "Unknown2": { "offset": 8, "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "void" } } }, "Unknown3": { "offset": 16, "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "void" } } }, "Unknown4": { "offset": 24, "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "void" } } }, "Unknown5": { "offset": 32, "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "void" } } }, "Unknown6": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "void" } } } }, "kind": "struct", "size": 128 }, "_LARGE_INTEGER": { "fields": { "HighPart": { "offset": 4, "type": { "kind": "base", "name": "long" } }, "LowPart": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "QuadPart": { "offset": 0, "type": { "kind": "base", "name": "long long" } }, "u": { "offset": 0, "type": { "kind": "struct", "name": "__unnamed_2" } } }, "kind": "union", "size": 8 } }, "enums": { "TCPStateEnum": { "base": "long", "constants": { "CLOSED": 0, "LISTENING": 1, "SYN_SENT": 2, "SYN_RCVD": 3, "ESTABLISHED": 4, "FIN_WAIT1": 5, "FIN_WAIT2": 6, "CLOSE_WAIT": 7, "CLOSING": 8, "LAST_ACK": 9, "TIME_WAIT": 12, "DELETE_TCB": 13 }, "size": 4 } }, "metadata": { "producer": { "version": "0.0.1", "name": "japhlange-by-hand", "datetime": "2020-06-12T14:00:00" }, "format": "6.0.0" } } volatility3-1.0.1/volatility3/framework/symbols/windows/netscan-win7-x86.json000066400000000000000000000330551405267600400273030ustar00rootroot00000000000000{ "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "unsigned be short": { "kind": "int", "size": 2, "signed": false, "endian": "big" }, "long long": { "endian": "little", "kind": "int", "signed": true, "size": 8 }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "symbols": {}, "user_types": { "_TCP_SYN_ENDPOINT": { "fields": { "Owner": { "offset": 44, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SYN_OWNER" } } }, "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 8, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "InetAF": { "offset": 36, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 72, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 74, "type": { "kind": "base", "name": "unsigned be short" } }, "LocalAddr": { "offset": 40, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "RemoteAddress": { "offset": 52, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 76 }, "_TCP_TIMEWAIT_ENDPOINT": { "fields": { "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 0, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "InetAF": { "offset": 24, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 40, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 42, "type": { "kind": "base", "name": "unsigned be short" } }, "LocalAddr": { "offset": 44, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "RemoteAddress": { "offset": 48, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 52 }, "_UDP_ENDPOINT": { "fields": { "Owner": { "offset": 24, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 48, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 56, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 20, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 72, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 74 }, "_TCP_LISTENER": { "fields": { "Owner": { "offset": 24, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 32, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 52, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 56, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 62, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 64 }, "_TCP_ENDPOINT": { "fields": { "Owner": { "offset": 372, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 20, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "AddrInfo": { "offset": 16, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_ADDRINFO" } } }, "InetAF": { "offset": 12, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 56, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 58, "type": { "kind": "base", "name": "unsigned be short" } }, "State": { "offset": 52, "type": { "kind": "enum", "name": "TCPStateEnum" } } }, "kind": "struct", "size": 376 }, "_LOCAL_ADDRESS": { "fields": { "pData": { "offset": 12, "type": { "kind": "pointer", "subtype": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } } }, "kind": "struct", "size": 16 }, "_ADDRINFO": { "fields": { "Local": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "Remote": { "offset": 8, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 12 }, "_IN_ADDR": { "fields": { "addr4": { "offset": 0, "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } }, "addr6": { "offset": 0, "type": { "count": 16, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } } }, "kind": "struct", "size": 6 }, "_INETAF": { "fields": { "AddressFamily": { "offset": 12, "type": { "kind": "base", "name": "unsigned short" } } }, "kind": "struct", "size": 14 }, "_SYN_OWNER": { "fields": { "Process": { "offset": 24, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } } }, "kind": "struct", "size": 14 }, "_LARGE_INTEGER": { "fields": { "HighPart": { "offset": 4, "type": { "kind": "base", "name": "long" } }, "LowPart": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "QuadPart": { "offset": 0, "type": { "kind": "base", "name": "long long" } }, "u": { "offset": 0, "type": { "kind": "struct", "name": "__unnamed_2" } } }, "kind": "union", "size": 8 } }, "enums": { "TCPStateEnum": { "base": "long", "constants": { "CLOSED": 0, "LISTENING": 1, "SYN_SENT": 2, "SYN_RCVD": 3, "ESTABLISHED": 4, "FIN_WAIT1": 5, "FIN_WAIT2": 6, "CLOSE_WAIT": 7, "CLOSING": 8, "LAST_ACK": 9, "TIME_WAIT": 12, "DELETE_TCB": 13 }, "size": 4 } }, "metadata": { "producer": { "version": "0.0.1", "name": "japhlange-by-hand", "datetime": "2020-05-29T19:28:34" }, "format": "6.0.0" } } volatility3-1.0.1/volatility3/framework/symbols/windows/netscan-win8-x64.json000066400000000000000000000330711405267600400272760ustar00rootroot00000000000000{ "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 8, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "unsigned be short": { "kind": "int", "size": 2, "signed": false, "endian": "big" }, "long long": { "endian": "little", "kind": "int", "signed": true, "size": 8 }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "symbols": {}, "user_types": { "_TCP_SYN_ENDPOINT": { "fields": { "Owner": { "offset": 64, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SYN_OWNER" } } }, "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 16, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "InetAF": { "offset": 48, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 100, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 102, "type": { "kind": "base", "name": "unsigned be short" } }, "LocalAddr": { "offset": 56, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "RemoteAddress": { "offset": 80, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 104 }, "_TCP_TIMEWAIT_ENDPOINT": { "fields": { "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 0, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "InetAF": { "offset": 24, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 48, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 50, "type": { "kind": "base", "name": "unsigned be short" } }, "LocalAddr": { "offset": 56, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "RemoteAddress": { "offset": 64, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 72 }, "_UDP_ENDPOINT": { "fields": { "Owner": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 88, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 96, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 32, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 128, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 130 }, "_TCP_LISTENER": { "fields": { "Owner": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 32, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 88, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 96, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 106, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 108 }, "_TCP_ENDPOINT": { "fields": { "Owner": { "offset": 592, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 40, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "AddrInfo": { "offset": 24, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_ADDRINFO" } } }, "InetAF": { "offset": 16, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 112, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 114, "type": { "kind": "base", "name": "unsigned be short" } }, "State": { "offset": 108, "type": { "kind": "enum", "name": "TCPStateEnum" } } }, "kind": "struct", "size": 600 }, "_LOCAL_ADDRESS": { "fields": { "pData": { "offset": 16, "type": { "kind": "pointer", "subtype": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } } }, "kind": "struct", "size": 24 }, "_ADDRINFO": { "fields": { "Local": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "Remote": { "offset": 16, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 24 }, "_IN_ADDR": { "fields": { "addr4": { "offset": 0, "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } }, "addr6": { "offset": 0, "type": { "count": 16, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } } }, "kind": "struct", "size": 6 }, "_INETAF": { "fields": { "AddressFamily": { "offset": 24, "type": { "kind": "base", "name": "unsigned short" } } }, "kind": "struct", "size": 26 }, "_SYN_OWNER": { "fields": { "Process": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } } }, "kind": "struct", "size": 48 }, "_LARGE_INTEGER": { "fields": { "HighPart": { "offset": 4, "type": { "kind": "base", "name": "long" } }, "LowPart": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "QuadPart": { "offset": 0, "type": { "kind": "base", "name": "long long" } }, "u": { "offset": 0, "type": { "kind": "struct", "name": "__unnamed_2" } } }, "kind": "union", "size": 8 } }, "enums": { "TCPStateEnum": { "base": "long", "constants": { "CLOSED": 0, "LISTENING": 1, "SYN_SENT": 2, "SYN_RCVD": 3, "ESTABLISHED": 4, "FIN_WAIT1": 5, "FIN_WAIT2": 6, "CLOSE_WAIT": 7, "CLOSING": 8, "LAST_ACK": 9, "TIME_WAIT": 12, "DELETE_TCB": 13 }, "size": 4 } }, "metadata": { "producer": { "version": "0.0.1", "name": "japhlange-by-hand", "datetime": "2020-06-12T14:00:00" }, "format": "6.0.0" } } volatility3-1.0.1/volatility3/framework/symbols/windows/netscan-win8-x86.json000066400000000000000000000330571405267600400273060ustar00rootroot00000000000000{ "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "unsigned be short": { "kind": "int", "size": 2, "signed": false, "endian": "big" }, "long long": { "endian": "little", "kind": "int", "signed": true, "size": 8 }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "symbols": {}, "user_types": { "_TCP_SYN_ENDPOINT": { "fields": { "Owner": { "offset": 32, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SYN_OWNER" } } }, "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 8, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "InetAF": { "offset": 24, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 60, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 62, "type": { "kind": "base", "name": "unsigned be short" } }, "LocalAddr": { "offset": 28, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "RemoteAddress": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 64 }, "_TCP_TIMEWAIT_ENDPOINT": { "fields": { "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 20, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "InetAF": { "offset": 12, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 28, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 30, "type": { "kind": "base", "name": "unsigned be short" } }, "LocalAddr": { "offset": 32, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "RemoteAddress": { "offset": 36, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 40 }, "_UDP_ENDPOINT": { "fields": { "Owner": { "offset": 24, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 48, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 56, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 20, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 72, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 74 }, "_TCP_LISTENER": { "fields": { "Owner": { "offset": 24, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 32, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 52, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 56, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 62, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 64 }, "_TCP_ENDPOINT": { "fields": { "Owner": { "offset": 372, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 20, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "AddrInfo": { "offset": 12, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_ADDRINFO" } } }, "InetAF": { "offset": 8, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 60, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 62, "type": { "kind": "base", "name": "unsigned be short" } }, "State": { "offset": 56, "type": { "kind": "enum", "name": "TCPStateEnum" } } }, "kind": "struct", "size": 376 }, "_LOCAL_ADDRESS": { "fields": { "pData": { "offset": 12, "type": { "kind": "pointer", "subtype": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } } }, "kind": "struct", "size": 16 }, "_ADDRINFO": { "fields": { "Local": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "Remote": { "offset": 12, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 16 }, "_IN_ADDR": { "fields": { "addr4": { "offset": 0, "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } }, "addr6": { "offset": 0, "type": { "count": 16, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } } }, "kind": "struct", "size": 6 }, "_INETAF": { "fields": { "AddressFamily": { "offset": 12, "type": { "kind": "base", "name": "unsigned short" } } }, "kind": "struct", "size": 14 }, "_SYN_OWNER": { "fields": { "Process": { "offset": 24, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } } }, "kind": "struct", "size": 14 }, "_LARGE_INTEGER": { "fields": { "HighPart": { "offset": 4, "type": { "kind": "base", "name": "long" } }, "LowPart": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "QuadPart": { "offset": 0, "type": { "kind": "base", "name": "long long" } }, "u": { "offset": 0, "type": { "kind": "struct", "name": "__unnamed_2" } } }, "kind": "union", "size": 8 } }, "enums": { "TCPStateEnum": { "base": "long", "constants": { "CLOSED": 0, "LISTENING": 1, "SYN_SENT": 2, "SYN_RCVD": 3, "ESTABLISHED": 4, "FIN_WAIT1": 5, "FIN_WAIT2": 6, "CLOSE_WAIT": 7, "CLOSING": 8, "LAST_ACK": 9, "TIME_WAIT": 12, "DELETE_TCB": 13 }, "size": 4 } }, "metadata": { "producer": { "version": "0.0.1", "name": "japhlange-by-hand", "datetime": "2020-05-29T19:28:34" }, "format": "6.0.0" } } volatility3-1.0.1/volatility3/framework/symbols/windows/netscan-win81-x64.json000066400000000000000000000330711405267600400273570ustar00rootroot00000000000000{ "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 8, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "unsigned be short": { "kind": "int", "size": 2, "signed": false, "endian": "big" }, "long long": { "endian": "little", "kind": "int", "signed": true, "size": 8 }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "symbols": {}, "user_types": { "_TCP_SYN_ENDPOINT": { "fields": { "Owner": { "offset": 64, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SYN_OWNER" } } }, "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 16, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "InetAF": { "offset": 48, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 100, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 102, "type": { "kind": "base", "name": "unsigned be short" } }, "LocalAddr": { "offset": 56, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "RemoteAddress": { "offset": 80, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 104 }, "_TCP_TIMEWAIT_ENDPOINT": { "fields": { "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 0, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "InetAF": { "offset": 24, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 48, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 50, "type": { "kind": "base", "name": "unsigned be short" } }, "LocalAddr": { "offset": 56, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "RemoteAddress": { "offset": 64, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 72 }, "_UDP_ENDPOINT": { "fields": { "Owner": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 88, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 96, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 32, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 128, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 130 }, "_TCP_LISTENER": { "fields": { "Owner": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 32, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 88, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 96, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 106, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 108 }, "_TCP_ENDPOINT": { "fields": { "Owner": { "offset": 600, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 40, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "AddrInfo": { "offset": 24, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_ADDRINFO" } } }, "InetAF": { "offset": 16, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 112, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 114, "type": { "kind": "base", "name": "unsigned be short" } }, "State": { "offset": 108, "type": { "kind": "enum", "name": "TCPStateEnum" } } }, "kind": "struct", "size": 608 }, "_LOCAL_ADDRESS": { "fields": { "pData": { "offset": 16, "type": { "kind": "pointer", "subtype": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } } }, "kind": "struct", "size": 24 }, "_ADDRINFO": { "fields": { "Local": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "Remote": { "offset": 16, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 24 }, "_IN_ADDR": { "fields": { "addr4": { "offset": 0, "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } }, "addr6": { "offset": 0, "type": { "count": 16, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } } }, "kind": "struct", "size": 6 }, "_INETAF": { "fields": { "AddressFamily": { "offset": 24, "type": { "kind": "base", "name": "unsigned short" } } }, "kind": "struct", "size": 26 }, "_SYN_OWNER": { "fields": { "Process": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } } }, "kind": "struct", "size": 48 }, "_LARGE_INTEGER": { "fields": { "HighPart": { "offset": 4, "type": { "kind": "base", "name": "long" } }, "LowPart": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "QuadPart": { "offset": 0, "type": { "kind": "base", "name": "long long" } }, "u": { "offset": 0, "type": { "kind": "struct", "name": "__unnamed_2" } } }, "kind": "union", "size": 8 } }, "enums": { "TCPStateEnum": { "base": "long", "constants": { "CLOSED": 0, "LISTENING": 1, "SYN_SENT": 2, "SYN_RCVD": 3, "ESTABLISHED": 4, "FIN_WAIT1": 5, "FIN_WAIT2": 6, "CLOSE_WAIT": 7, "CLOSING": 8, "LAST_ACK": 9, "TIME_WAIT": 12, "DELETE_TCB": 13 }, "size": 4 } }, "metadata": { "producer": { "version": "0.0.1", "name": "japhlange-by-hand", "datetime": "2020-06-12T14:00:00" }, "format": "6.0.0" } } volatility3-1.0.1/volatility3/framework/symbols/windows/netscan-win81-x86.json000066400000000000000000000330571405267600400273670ustar00rootroot00000000000000{ "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "unsigned be short": { "kind": "int", "size": 2, "signed": false, "endian": "big" }, "long long": { "endian": "little", "kind": "int", "signed": true, "size": 8 }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "symbols": {}, "user_types": { "_TCP_SYN_ENDPOINT": { "fields": { "Owner": { "offset": 32, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SYN_OWNER" } } }, "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 8, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "InetAF": { "offset": 24, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 60, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 62, "type": { "kind": "base", "name": "unsigned be short" } }, "LocalAddr": { "offset": 28, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "RemoteAddress": { "offset": 40, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 64 }, "_TCP_TIMEWAIT_ENDPOINT": { "fields": { "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 20, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "InetAF": { "offset": 12, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 28, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 30, "type": { "kind": "base", "name": "unsigned be short" } }, "LocalAddr": { "offset": 32, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "RemoteAddress": { "offset": 36, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 40 }, "_UDP_ENDPOINT": { "fields": { "Owner": { "offset": 24, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 48, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 56, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 20, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 72, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 74 }, "_TCP_LISTENER": { "fields": { "Owner": { "offset": 24, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 32, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "LocalAddr": { "offset": 52, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "InetAF": { "offset": 56, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "Port": { "offset": 62, "type": { "kind": "base", "name": "unsigned be short" } } }, "kind": "struct", "size": 64 }, "_TCP_ENDPOINT": { "fields": { "Owner": { "offset": 424, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } }, "CreateTime": { "offset": 0, "type": { "kind": "union", "name": "_LARGE_INTEGER" } }, "ListEntry": { "offset": 20, "type": { "kind": "union", "name": "nt_symbols!_LIST_ENTRY" } }, "AddrInfo": { "offset": 12, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_ADDRINFO" } } }, "InetAF": { "offset": 8, "type":{ "kind": "pointer", "subtype": { "kind": "struct", "name": "_INETAF" } } }, "LocalPort": { "offset": 60, "type": { "kind": "base", "name": "unsigned be short" } }, "RemotePort": { "offset": 62, "type": { "kind": "base", "name": "unsigned be short" } }, "State": { "offset": 56, "type": { "kind": "enum", "name": "TCPStateEnum" } } }, "kind": "struct", "size": 428 }, "_LOCAL_ADDRESS": { "fields": { "pData": { "offset": 12, "type": { "kind": "pointer", "subtype": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } } }, "kind": "struct", "size": 16 }, "_ADDRINFO": { "fields": { "Local": { "offset": 0, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_LOCAL_ADDRESS" } } }, "Remote": { "offset": 12, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_IN_ADDR" } } } }, "kind": "struct", "size": 16 }, "_IN_ADDR": { "fields": { "addr4": { "offset": 0, "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } }, "addr6": { "offset": 0, "type": { "count": 16, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" } } }, "kind": "struct", "size": 6 }, "_INETAF": { "fields": { "AddressFamily": { "offset": 12, "type": { "kind": "base", "name": "unsigned short" } } }, "kind": "struct", "size": 14 }, "_SYN_OWNER": { "fields": { "Process": { "offset": 24, "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "nt_symbols!_EPROCESS" } } } }, "kind": "struct", "size": 14 }, "_LARGE_INTEGER": { "fields": { "HighPart": { "offset": 4, "type": { "kind": "base", "name": "long" } }, "LowPart": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "QuadPart": { "offset": 0, "type": { "kind": "base", "name": "long long" } }, "u": { "offset": 0, "type": { "kind": "struct", "name": "__unnamed_2" } } }, "kind": "union", "size": 8 } }, "enums": { "TCPStateEnum": { "base": "long", "constants": { "CLOSED": 0, "LISTENING": 1, "SYN_SENT": 2, "SYN_RCVD": 3, "ESTABLISHED": 4, "FIN_WAIT1": 5, "FIN_WAIT2": 6, "CLOSE_WAIT": 7, "CLOSING": 8, "LAST_ACK": 9, "TIME_WAIT": 12, "DELETE_TCB": 13 }, "size": 4 } }, "metadata": { "producer": { "version": "0.0.1", "name": "japhlange-by-hand", "datetime": "2020-05-29T19:28:34" }, "format": "6.0.0" } } volatility3-1.0.1/volatility3/framework/symbols/windows/pdb.json000066400000000000000000001140611405267600400251050ustar00rootroot00000000000000{ "symbols": { }, "user_types": { "pascal_string": { "fields": { "length": { "offset": 0, "type": { "kind": "base", "name": "unsigned char" } }, "string": { "offset": 1, "type": { "kind": "base", "name": "string" } } }, "kind": "struct", "size": 2 }, "Type_Properties": { "fields": { "packed": { "offset": 0, "type": { "bit_length": 1, "bit_position": 0, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned short" } } }, "constructors": { "offset": 0, "type": { "bit_length": 1, "bit_position": 1, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned short" } } }, "overloaded_operators": { "offset": 0, "type": { "bit_length": 1, "bit_position": 2, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned short" } } }, "nested_type": { "offset": 0, "type": { "bit_length": 1, "bit_position": 3, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned short" } } }, "contains_nested": { "offset": 0, "type": { "bit_length": 1, "bit_position": 4, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned short" } } }, "overloaded_assignment": { "offset": 0, "type": { "bit_length": 1, "bit_position": 5, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned short" } } }, "overloaded_casting": { "offset": 0, "type": { "bit_length": 1, "bit_position": 6, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned short" } } }, "forward_reference": { "offset": 0, "type": { "bit_length": 1, "bit_position": 7, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned short" } } }, "scoped_definition": { "offset": 0, "type": { "bit_length": 1, "bit_position": 8, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned short" } } }, "unique_name": { "offset": 0, "type": { "bit_length": 1, "bit_position": 9, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned short" } } }, "sealed": { "offset": 0, "type": { "bit_length": 1, "bit_position": 10, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned short" } } }, "hfa": { "offset": 0, "type": { "bit_length": 2, "bit_position": 11, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned short" } } }, "intrinsic_type": { "offset": 0, "type": { "bit_length": 1, "bit_position": 12, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned short" } } }, "mocom": { "offset": 0, "type": { "bit_length": 2, "bit_position": 13, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned short" } } } }, "kind": "struct", "size": 2 }, "SI_PERSIST": { "fields": { "StreamInfoSize": { "offset": 0, "type": { "kind": "base", "name": "long" } }, "mpspnpn": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "struct", "size": 8 }, "MSF_HDR": { "fields": { "Magic": { "offset": 0, "type": { "count": 44, "kind": "array", "subtype": { "kind": "base", "name": "unsigned char" } } }, "PageSize": { "offset": 44, "type": { "kind": "base", "name": "long" } }, "FreePageMapNumber": { "offset": 48, "type": { "kind": "base", "name": "unsigned short" } }, "NumPages": { "offset": 50, "type": { "kind": "base", "name": "unsigned short" } }, "StreamInfo": { "offset": 52, "type": { "kind": "struct", "name": "SI_PERSIST" } } }, "kind": "struct", "size": 60 }, "BIG_MSF_HDR": { "fields": { "Magic": { "offset": 0, "type": { "count": 30, "kind": "array", "subtype": { "kind": "base", "name": "unsigned char" } } }, "PageSize": { "offset": 32, "type": { "kind": "base", "name": "long" } }, "FreePageMapNumber": { "offset": 36, "type": { "kind": "base", "name": "unsigned long" } }, "NumPages": { "offset": 40, "type": { "kind": "base", "name": "unsigned long" } }, "StreamInfo": { "offset": 44, "type": { "kind": "struct", "name": "SI_PERSIST" } } }, "kind": "struct", "size": 52 }, "TPI_HEADER": { "fields": { "version": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "header_size": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "index_min": { "offset": 8, "type": { "kind": "base", "name": "unsigned long" } }, "index_max": { "offset": 12, "type": { "kind": "base", "name": "unsigned long" } }, "gprec_size": { "offset": 16, "type": { "kind": "base", "name": "unsigned long" } }, "tpi_hash_stream": { "offset": 20, "type": { "kind": "base", "name": "unsigned short" } }, "tpi_hash_pad_stream": { "offset": 22, "type": { "kind": "base", "name": "unsigned short" } }, "hash_key_size": { "offset": 24, "type": { "kind": "base", "name": "unsigned long" } }, "hash_bucket_size": { "offset": 28, "type": { "kind": "base", "name": "unsigned long" } }, "hash_values_offset": { "offset": 32, "type": { "kind": "base", "name": "unsigned long" } }, "hash_values_size": { "offset": 36, "type": { "kind": "base", "name": "unsigned long" } }, "ti_off_offset": { "offset": 40, "type": { "kind": "base", "name": "unsigned long" } }, "ti_off_size": { "offset": 44, "type": { "kind": "base", "name": "unsigned long" } }, "hash_adj_offset": { "offset": 48, "type": { "kind": "base", "name": "unsigned long" } }, "hash_adj_size": { "offset": 52, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "struct", "size": 56 }, "DBI_HEADER": { "fields": { "magic": { "offset": 0, "type": { "count": 4, "kind": "array", "subtype": { "kind": "base", "name": "unsigned char" } } }, "version": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "age": { "offset": 8, "type": { "kind": "base", "name": "unsigned long" } }, "gssymStream": { "offset": 12, "type": { "kind": "base", "name": "unsigned short" } }, "vers": { "offset": 14, "type": { "kind": "base", "name": "unsigned short" } }, "pssymStream": { "offset": 16, "type": { "kind": "base", "name": "unsigned short" } }, "pdbver": { "offset": 18, "type": { "kind": "base", "name": "unsigned short" } }, "symrecStream": { "offset": 20, "type": { "kind": "base", "name": "unsigned short" } }, "pdbver2": { "offset": 22, "type": { "kind": "base", "name": "unsigned short" } }, "module_size": { "offset": 24, "type": { "kind": "base", "name": "unsigned long" } }, "secconSize": { "offset": 28, "type": { "kind": "base", "name": "unsigned long" } }, "secmapSize": { "offset": 32, "type": { "kind": "base", "name": "unsigned long" } }, "filinfSize": { "offset": 36, "type": { "kind": "base", "name": "unsigned long" } }, "tsmapSize": { "offset": 40, "type": { "kind": "base", "name": "unsigned long" } }, "mfcIndex": { "offset": 44, "type": { "kind": "base", "name": "unsigned long" } }, "dbghdrSize": { "offset": 48, "type": { "kind": "base", "name": "unsigned long" } }, "ecinfoSize": { "offset": 52, "type": { "kind": "base", "name": "unsigned long" } }, "flags": { "offset": 56, "type": { "kind": "base", "name": "unsigned short" } }, "machine": { "offset": 58, "type": { "kind": "enum", "name": "MACHINE_TYPE" } }, "reserved": { "offset": 60, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "struct", "size": 64 }, "DBI_DBG_HEADER": { "fields": { "snFPO": { "offset": 0, "type": { "kind": "base", "name": "short" } }, "snException": { "offset": 2, "type": { "kind": "base", "name": "short" } }, "snFixup": { "offset": 4, "type": { "kind": "base", "name": "short" } }, "snOmapToSrc": { "offset": 6, "type": { "kind": "base", "name": "short" } }, "snOmapFromSrc": { "offset": 8, "type": { "kind": "base", "name": "short" } }, "snSectionHdr": { "offset": 10, "type": { "kind": "base", "name": "short" } }, "snTokenRidMap": { "offset": 12, "type": { "kind": "base", "name": "short" } }, "snXdata": { "offset": 14, "type": { "kind": "base", "name": "short" } }, "snPdata": { "offset": 16, "type": { "kind": "base", "name": "short" } }, "snNewFPO": { "offset": 18, "type": { "kind": "base", "name": "short" } }, "snSectionHdrOrig": { "offset": 20, "type": { "kind": "base", "name": "short" } } }, "kind": "struct", "size": 22 }, "GLOBAL_SYMBOL": { "fields": { "length": { "offset": 0, "type": { "kind": "base", "name": "unsigned short" } }, "leaf_type": { "offset": 2, "type": { "kind": "base", "name": "unsigned short" } }, "symtype": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "offset": { "offset": 8, "type": { "kind": "base", "name": "unsigned long" } }, "segment": { "offset": 12, "type": { "kind": "base", "name": "unsigned short" } }, "name": { "offset": 14, "type": { "kind": "base", "name": "string" } } }, "kind": "struct", "size": 14 }, "IMAGE_SECTION_HEADER": { "fields": { "Characteristics": { "offset": 36, "type": { "kind": "base", "name": "unsigned long" } }, "Misc": { "offset": 8, "type": { "kind": "base", "name": "unsigned long" } }, "Name": { "offset": 0, "type": { "count": 8, "kind": "array", "subtype": { "kind": "base", "name": "unsigned char" } } }, "NumberOfLinenumbers": { "offset": 34, "type": { "kind": "base", "name": "unsigned short" } }, "NumberOfRelocations": { "offset": 32, "type": { "kind": "base", "name": "unsigned short" } }, "PointerToLinenumbers": { "offset": 28, "type": { "kind": "base", "name": "unsigned long" } }, "PointerToRawData": { "offset": 20, "type": { "kind": "base", "name": "unsigned long" } }, "PointerToRelocations": { "offset": 24, "type": { "kind": "base", "name": "unsigned long" } }, "SizeOfRawData": { "offset": 16, "type": { "kind": "base", "name": "unsigned long" } }, "VirtualAddress": { "offset": 12, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "struct", "size": 40 }, "LF_ARRAY": { "fields": { "element_type": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "indexing_type": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "size": { "offset": 8, "type": { "kind": "base", "name": "unsigned short" } }, "name": { "offset": 10, "type": { "kind": "base", "name": "string" } } }, "kind": "struct", "size": 10 }, "LF_BITFIELD": { "fields": { "underlying_type": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "length": { "offset": 4, "type": { "kind": "base", "name": "unsigned char" } }, "position": { "offset": 5, "type": { "kind": "base", "name": "unsigned char" } } }, "kind": "struct", "size": 0 }, "LF_BUILDINFO": { "fields": { "count": { "offset": 0, "type": { "kind": "base", "name": "unsigned short" } }, "arguments": { "offset": 2, "type": { "count": 1, "kind": "array", "subtype": { "kind": "base", "name": "unsigned long" } } } }, "kind": "struct", "size": 2 }, "LF_ENUM": { "fields": { "count": { "offset": 0, "type": { "kind": "base", "name": "unsigned short" } }, "properties": { "offset": 2, "type": { "kind": "struct", "name": "Type_Properties" } }, "subtype_index": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "fields": { "offset": 8, "type": { "kind": "base", "name": "unsigned long" } }, "name": { "offset": 12, "type": { "kind": "base", "name": "string" } } }, "kind": "struct", "size": 12 }, "LF_ENUMERATE": { "fields": { "attributes": { "offset": 0, "type": { "kind": "base", "name": "unsigned short" } }, "value": { "offset": 2, "type": { "kind": "base", "name": "unsigned short" } }, "name": { "offset": 4, "type": { "kind": "base", "name": "string" } } }, "kind": "struct", "size": 4 }, "LF_FUNC_ID": { "fields": { "scope": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "function_type": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "name": { "offset": 8, "type": { "kind": "base", "name": "string" } } }, "kind": "struct", "size": 8 }, "LF_MEMBER": { "fields": { "attributes": { "offset": 0, "type": { "kind": "base", "name": "unsigned short" } }, "field_type": { "offset": 2, "type": { "kind": "base", "name": "unsigned long" } }, "offset": { "offset": 6, "type": { "kind": "base", "name": "unsigned short" } }, "name": { "offset": 8, "type": { "kind": "base", "name": "string" } } }, "kind": "struct", "size": 8 }, "LF_MODIFIER": { "fields": { "subtype_index": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "constant": { "offset": 4, "type": { "bit_length": 1, "bit_position": 0, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned short" } } }, "volatile": { "offset": 4, "type": { "bit_length": 1, "bit_position": 1, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned short" } } }, "unaligned": { "offset": 4, "type": { "bit_length": 1, "bit_position": 2, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned short" } } } }, "kind": "struct", "size": 6 }, "LF_POINTER": { "fields": { "subtype_index": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "pointer_type": { "offset": 4, "type": { "bit_length": 5, "bit_position": 0, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned long" } } }, "mode": { "offset": 4, "type": { "bit_length": 3, "bit_position": 5, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned long" } } }, "flat32": { "offset": 4, "type": { "bit_length": 1, "bit_position": 8, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned long" } } }, "volatile": { "offset": 4, "type": { "bit_length": 1, "bit_position": 9, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned long" } } }, "constant": { "offset": 4, "type": { "bit_length": 1, "bit_position": 10, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned long" } } }, "unaligned": { "offset": 4, "type": { "bit_length": 1, "bit_position": 11, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned long" } } }, "restricted": { "offset": 4, "type": { "bit_length": 1, "bit_position": 12, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned long" } } }, "size": { "offset": 4, "type": { "bit_length": 6, "bit_position": 13, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned long" } } }, "mocom": { "offset": 4, "type": { "bit_length": 1, "bit_position": 19, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned long" } } }, "lref": { "offset": 4, "type": { "bit_length": 1, "bit_position": 20, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned long" } } }, "rref": { "offset": 4, "type": { "bit_length": 1, "bit_position": 21, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned long" } } } }, "kind": "struct", "size": 6 }, "LF_PROCEDURE": { "fields": { "return_type": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "attributes": { "offset": 4, "type": { "kind": "base", "name": "unsigned short" } }, "parameter_count": { "offset": 6, "type": { "kind": "base", "name": "unsigned short" } }, "argument_list": { "offset": 8, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "struct", "size": 12 }, "LF_STRING_ID": { "fields": { "substrings": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "name": { "offset": 4, "type": { "kind": "base", "name": "string" } } }, "kind": "struct", "size": 4 }, "LF_STRUCTURE": { "fields": { "count": { "offset": 0, "type": { "kind": "base", "name": "unsigned short" } }, "properties": { "offset": 2, "type": { "kind": "struct", "name": "Type_Properties" } }, "fields": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "derived_from": { "offset": 8, "type": { "kind": "base", "name": "unsigned long" } }, "vtable_shape": { "offset": 12, "type": { "kind": "base", "name": "unsigned long" } }, "size": { "offset": 16, "type": { "kind": "base", "name": "unsigned short" } }, "name": { "offset": 18, "type": { "kind": "base", "name": "string" } } }, "kind": "struct", "size": 18 }, "LF_UDT_SRC_LINE": { "fields": { "udt": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "source_file": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "line": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "struct", "size": 12 }, "LF_UDT_MOD_SRC_LINE": { "fields": { "udt": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "source_file": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "line": { "offset": 8, "type": { "kind": "base", "name": "unsigned long" } }, "module": { "offset": 12, "type": { "kind": "base", "name": "string" } } }, "kind": "struct", "size": 12 }, "LF_UNION": { "fields": { "count": { "offset": 0, "type": { "kind": "base", "name": "unsigned short" } }, "properties": { "offset": 2, "type": { "kind": "struct", "name": "Type_Properties" } }, "fields": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "size": { "offset": 8, "type": { "kind": "base", "name": "unsigned short" } }, "name": { "offset": 10, "type": { "kind": "base", "name": "string" } } }, "kind": "struct", "size": 10 }, "OMAP_RECORD": { "fields": { "source_address": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "target_address": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "struct", "size": 8 }, "PDB_INFORMATION": { "fields": { "version": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "signature": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "age": { "offset": 8, "type": { "kind": "base", "name": "unsigned long" } }, "GUID": { "offset": 12, "type": { "count": 16, "kind": "array", "subtype": { "kind": "base", "name": "unsigned char" } } } }, "kind": "struct", "size": 0 } }, "enums": { "MACHINE_TYPE": { "base": "unsigned short", "constants": { "IMAGE_FILE_MACHINE_UNKNOWN": 0, "IMAGE_FILE_MACHINE_I386": 332, "IMAGE_FILE_MACHINE_R3000": 354, "IMAGE_FILE_MACHINE_R4000": 358, "IMAGE_FILE_MACHINE_R10000": 360, "IMAGE_FILE_MACHINE_WCEMIPSV2": 361, "IMAGE_FILE_MACHINE_ALPHA": 388, "IMAGE_FILE_MACHINE_SH3": 418, "IMAGE_FILE_MACHINE_SH3DSP": 419, "IMAGE_FILE_MACHINE_SH3E": 420, "IMAGE_FILE_MACHINE_SH4": 422, "IMAGE_FILE_MACHINE_SH5": 424, "IMAGE_FILE_MACHINE_ARM": 448, "IMAGE_FILE_MACHINE_THUMB": 450, "IMAGE_FILE_MACHINE_ARMNT": 452, "IMAGE_FILE_MACHINE_AM33": 467, "IMAGE_FILE_MACHINE_POWERPC": 496, "IMAGE_FILE_MACHINE_POWERPCFP": 497, "IMAGE_FILE_MACHINE_IA64": 512, "IMAGE_FILE_MACHINE_MIPS16": 614, "IMAGE_FILE_MACHINE_ALPHA64": 644, "IMAGE_FILE_MACHINE_MIPSFPU": 870, "IMAGE_FILE_MACHINE_MIPSFPU16": 1126, "IMAGE_FILE_MACHINE_TRICORE": 1312, "IMAGE_FILE_MACHINE_CEF": 3311, "IMAGE_FILE_MACHINE_EBC": 3772, "IMAGE_FILE_MACHINE_AMD64": 34404, "IMAGE_FILE_MACHINE_M32R": 36929, "IMAGE_FILE_MACHINE_CEE": 49390 }, "size": 2 }, "LEAF_TYPE": { "base": "unsigned short", "constants": { "LF_MODIFIER_16t": 1, "LF_POINTER_16t": 2, "LF_ARRAY_16t": 3, "LF_CLASS_16t": 4, "LF_STRUCTURE_16t": 5, "LF_UNION_16t": 6, "LF_ENUM_16t": 7, "LF_PROCEDURE_16t": 8, "LF_MFUNCTION_16t": 9, "LF_VTSHAPE": 10, "LF_COBOL0_16t": 11, "LF_COBOL1": 12, "LF_BARRAY_16t": 13, "LF_LABEL": 14, "LF_NULL": 15, "LF_NOTTRAN": 16, "LF_DIMARRAY_16t": 17, "LF_VFTPATH_16t": 18, "LF_PRECOMP_16t": 19, "LF_ENDPRECOMP": 20, "LF_OEM_16t": 21, "LF_TYPESERVER_ST": 22, "LF_SKIP_16t": 512, "LF_ARGLIST_16t": 513, "LF_DEFARG_16t": 514, "LF_LIST": 515, "LF_FIELDLIST_16t": 516, "LF_DERIVED_16t": 517, "LF_BITFIELD_16t": 518, "LF_METHODLIST_16t": 519, "LF_DIMCONU_16t": 520, "LF_DIMCONLU_16t": 521, "LF_DIMVARU_16t": 522, "LF_DIMVARLU_16t": 523, "LF_REFSYM": 524, "LF_BCLASS_16t": 1024, "LF_VBCLASS_16t": 1025, "LF_IVBCLASS_16t": 1026, "LF_ENUMERATE_ST": 1027, "LF_FRIENDFCN_16t": 1028, "LF_INDEX_16t": 1029, "LF_MEMBER_16t": 1030, "LF_STMEMBER_16t": 1031, "LF_METHOD_16t": 1032, "LF_NESTTYPE_16t": 1033, "LF_VFUNCTAB_16t": 1034, "LF_FRIENDCLS_16t": 1035, "LF_ONEMETHOD_16t": 1036, "LF_VFUNCOFF_16t": 1037, "LF_TI16_MAX": 4096, "LF_MODIFIER": 4097, "LF_POINTER": 4098, "LF_ARRAY_ST": 4099, "LF_CLASS_ST": 4100, "LF_STRUCTURE_ST": 4101, "LF_UNION_ST": 4102, "LF_ENUM_ST": 4103, "LF_PROCEDURE": 4104, "LF_MFUNCTION": 4105, "LF_COBOL0": 4106, "LF_BARRAY": 4107, "LF_DIMARRAY_ST": 4108, "LF_VFTPATH": 4109, "LF_PRECOMP_ST": 4110, "LF_OEM": 4111, "LF_ALIAS_ST": 4112, "LF_OEM2": 4113, "LF_SKIP": 4608, "LF_ARGLIST": 4609, "LF_DEFARG_ST": 4610, "LF_FIELDLIST": 4611, "LF_DERIVED": 4612, "LF_BITFIELD": 4613, "LF_METHODLIST": 4614, "LF_DIMCONU": 4615, "LF_DIMCONLU": 4616, "LF_DIMVARU": 4617, "LF_DIMVARLU": 4618, "LF_BCLASS": 5120, "LF_VBCLASS": 5121, "LF_IVBCLASS": 5122, "LF_FRIENDFCN_ST": 5123, "LF_INDEX": 5124, "LF_MEMBER_ST": 5125, "LF_STMEMBER_ST": 5126, "LF_METHOD_ST": 5127, "LF_NESTTYPE_ST": 5128, "LF_VFUNCTAB": 5129, "LF_FRIENDCLS": 5130, "LF_ONEMETHOD_ST": 5131, "LF_VFUNCOFF": 5132, "LF_NESTTYPEEX_ST": 5133, "LF_MEMBERMODIFY_ST": 5134, "LF_MANAGED_ST": 5135, "LF_ST_MAX": 5376, "LF_TYPESERVER": 5377, "LF_ENUMERATE": 5378, "LF_ARRAY": 5379, "LF_CLASS": 5380, "LF_STRUCTURE": 5381, "LF_UNION": 5382, "LF_ENUM": 5383, "LF_DIMARRAY": 5384, "LF_PRECOMP": 5385, "LF_ALIAS": 5386, "LF_DEFARG": 5387, "LF_FRIENDFCN": 5388, "LF_MEMBER": 5389, "LF_STMEMBER": 5390, "LF_METHOD": 5391, "LF_NESTTYPE": 5392, "LF_ONEMETHOD": 5393, "LF_NESTTYPEEX": 5394, "LF_MEMBERMODIFY": 5395, "LF_MANAGED": 5396, "LF_TYPESERVER2": 5397, "LF_STRIDED_ARRAY": 5398, "LF_HLSL": 5399, "LF_MODIFIER_EX": 5400, "LF_INTERFACE": 5401, "LF_BINTERFACE": 5402, "LF_VECTOR": 5403, "LF_MATRIX": 5404, "LF_VFTABLE": 5405, "LF_FUNC_ID": 5633, "LF_MFUNC_ID": 5634, "LF_BUILDINFO": 5635, "LF_SUBSTR_LIST": 5636, "LF_STRING_ID": 5637, "LF_UDT_SRC_LINE": 5638, "LF_UDT_MOD_SRC_LINE": 5639, "LF_CHAR": 32768, "LF_SHORT": 32769, "LF_USHORT": 32770, "LF_LONG": 32771, "LF_ULONG": 32772, "LF_REAL32": 32773, "LF_REAL64": 32774, "LF_REAL80": 32775, "LF_REAL128": 32776, "LF_QUADWORD": 32777, "LF_UQUADWORD": 32778, "LF_REAL48": 32779, "LF_COMPLEX32": 32780, "LF_COMPLEX64": 32781, "LF_COMPLEX80": 32782, "LF_COMPLEX128": 32783, "LF_VARSTRING": 32784, "LF_OCTWORD": 32791, "LF_UOCTWORD": 32792, "LF_DECIMAL": 32793, "LF_DATE": 32794, "LF_UTF8STRING": 32795, "LF_REAL16": 32796, "LF_PAD0": 240, "LF_PAD1": 241, "LF_PAD2": 242, "LF_PAD3": 243, "LF_PAD4": 244, "LF_PAD5": 245, "LF_PAD6": 246, "LF_PAD7": 247, "LF_PAD8": 248, "LF_PAD9": 249, "LF_PAD10": 250, "LF_PAD11": 251, "LF_PAD12": 252, "LF_PAD13": 253, "LF_PAD14": 254, "LF_PAD15": 255 }, "size": 2 } }, "base_types": { "unsigned char": { "endian": "little", "kind": "char", "signed": false, "size": 1 }, "unsigned short": { "endian": "little", "kind": "int", "signed": false, "size": 2 }, "short": { "endian": "little", "kind": "int", "signed": true, "size": 2 }, "long": { "endian": "little", "kind": "int", "signed": true, "size": 4 }, "char": { "endian": "little", "kind": "char", "signed": true, "size": 1 }, "unsigned long": { "endian": "little", "kind": "int", "signed": false, "size": 4 }, "long long": { "endian": "little", "kind": "int", "signed": true, "size": 8 }, "unsigned long long": { "endian": "little", "kind": "int", "signed": false, "size": 8 } }, "metadata": { "producer": { "version": "0.0.1", "name": "ikelos-by-hand", "datetime": "2019-05-22T15:51:03" }, "format": "4.0.0" } } volatility3-1.0.1/volatility3/framework/symbols/windows/pdbconv.py000066400000000000000000001253561405267600400254630ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import binascii import datetime import json import logging import os from bisect import bisect from typing import Tuple, Dict, Any, Optional, Union, List from urllib import request, error from volatility3.framework import contexts, interfaces, constants from volatility3.framework.layers import physical, msf, resources vollog = logging.getLogger(__name__) primatives = { 0x03: ("void", { "endian": "little", "kind": "void", "signed": True, "size": 0 }), 0x08: ("HRESULT", { "endian": "little", "kind": "int", "signed": False, "size": 4 }), 0x10: ("char", { "endian": "little", "kind": "char", "signed": True, "size": 1 }), 0x20: ("unsigned char", { "endian": "little", "kind": "char", "signed": False, "size": 1 }), 0x68: ("int8", { "endian": "little", "kind": "int", "signed": True, "size": 1 }), 0x69: ("uint8", { "endian": "little", "kind": "int", "signed": False, "size": 1 }), 0x70: ("char", { "endian": "little", "kind": "char", "signed": True, "size": 1 }), 0x71: ("wchar", { "endian": "little", "kind": "int", "signed": True, "size": 2 }), # 0x7a: ("rchar16", {}), # 0x7b: ("rchar32", {}), 0x11: ("short", { "endian": "little", "kind": "int", "signed": True, "size": 2 }), 0x21: ("unsigned short", { "endian": "little", "kind": "int", "signed": False, "size": 2 }), 0x72: ("short", { "endian": "little", "kind": "int", "signed": True, "size": 2 }), 0x73: ("unsigned short", { "endian": "little", "kind": "int", "signed": False, "size": 2 }), 0x12: ("long", { "endian": "little", "kind": "int", "signed": True, "size": 4 }), 0x22: ("unsigned long", { "endian": "little", "kind": "int", "signed": False, "size": 4 }), 0x74: ("int", { "endian": "little", "kind": "int", "signed": True, "size": 4 }), 0x75: ("unsigned int", { "endian": "little", "kind": "int", "signed": False, "size": 4 }), 0x13: ("long long", { "endian": "little", "kind": "int", "signed": True, "size": 8 }), 0x23: ("unsigned long long", { "endian": "little", "kind": "int", "signed": False, "size": 8 }), 0x76: ("long long", { "endian": "little", "kind": "int", "signed": True, "size": 8 }), 0x77: ("unsigned long long", { "endian": "little", "kind": "int", "signed": False, "size": 8 }), 0x14: ("int128", { "endian": "little", "kind": "int", "signed": True, "size": 16 }), 0x24: ("uint128", { "endian": "little", "kind": "int", "signed": False, "size": 16 }), 0x78: ("int128", { "endian": "little", "kind": "int", "signed": True, "size": 16 }), 0x79: ("uint128", { "endian": "little", "kind": "int", "signed": False, "size": 16 }), 0x46: ("f16", { "endian": "little", "kind": "float", "signed": True, "size": 2 }), 0x40: ("f32", { "endian": "little", "kind": "float", "signed": True, "size": 4 }), 0x45: ("f32pp", { "endian": "little", "kind": "float", "signed": True, "size": 4 }), 0x44: ("f48", { "endian": "little", "kind": "float", "signed": True, "size": 6 }), 0x41: ("double", { "endian": "little", "kind": "float", "signed": True, "size": 8 }), 0x42: ("f80", { "endian": "little", "kind": "float", "signed": True, "size": 10 }), 0x43: ("f128", { "endian": "little", "kind": "float", "signed": True, "size": 16 }) } indirections = { 0x100: ("pointer16", { "endian": "little", "kind": "int", "signed": False, "size": 2 }), 0x400: ("pointer32", { "endian": "little", "kind": "int", "signed": False, "size": 4 }), 0x600: ("pointer64", { "endian": "little", "kind": "int", "signed": False, "size": 8 }) } class ForwardArrayCount: def __init__(self, size, element_type): self.element_type = element_type self.size = size class PdbReader: """Class to read Microsoft PDB files. This reads the various streams according to various sources as to how pdb should be read. These sources include: https://docs.rs/crate/pdb/0.5.0/source/src/ https://github.com/moyix/pdbparse https://llvm.org/docs/PDB/index.html https://github.com/Microsoft/microsoft-pdb/ In order to generate ISF files, we need the type stream (2), and the symbols stream (variable). The MultiStream Format wrapper is handled as a volatility layer, which constructs sublayers for each stream. The streams can then be read contiguously allowing the data to be accessed. Volatility's type system is strong when everything must be laid out in advance, but PDB data is reasonably dynamic, particularly when it comes to names. We must therefore parse it after we've collected other information already. This is in comparison to something such as Construct/pdbparse which can use just-parsed data to determine dynamically sized data following. """ def __init__(self, context: interfaces.context.ContextInterface, location: str, database_name: Optional[str] = None, progress_callback: constants.ProgressCallback = None) -> None: self._layer_name, self._context = self.load_pdb_layer(context, location) self._dbiheader = None # type: Optional[interfaces.objects.ObjectInterface] if not progress_callback: progress_callback = lambda x, y: None self._progress_callback = progress_callback self.types = [ ] # type: List[Tuple[interfaces.objects.ObjectInterface, Optional[str], interfaces.objects.ObjectInterface]] self.bases = {} # type: Dict[str, Any] self.user_types = {} # type: Dict[str, Any] self.enumerations = {} # type: Dict[str, Any] self.symbols = {} # type: Dict[str, Any] self._omap_mapping = [] # type: List[Tuple[int, int]] self._sections = [] # type: List[interfaces.objects.ObjectInterface] self.metadata = {"format": "6.1.0", "windows": {}} self._database_name = database_name @property def context(self): return self._context @property def pdb_layer_name(self): return self._layer_name @classmethod def load_pdb_layer(cls, context: interfaces.context.ContextInterface, location: str) -> Tuple[str, interfaces.context.ContextInterface]: """Loads a PDB file into a layer within the context and returns the name of the new layer. Note: the context may be changed by this method """ physical_layer_name = context.layers.free_layer_name("FileLayer") physical_config_path = interfaces.configuration.path_join("pdbreader", physical_layer_name) # Create the file layer # This must be specific to get us started, setup the config and run new_context = context.clone() new_context.config[interfaces.configuration.path_join(physical_config_path, "location")] = location physical_layer = physical.FileLayer(new_context, physical_config_path, physical_layer_name) new_context.add_layer(physical_layer) # Add on the MSF format layer msf_layer_name = context.layers.free_layer_name("MSFLayer") msf_config_path = interfaces.configuration.path_join("pdbreader", msf_layer_name) new_context.config[interfaces.configuration.path_join(msf_config_path, "base_layer")] = physical_layer_name msf_layer = msf.PdbMultiStreamFormat(new_context, msf_config_path, msf_layer_name) new_context.add_layer(msf_layer) msf_layer.read_streams() return msf_layer_name, new_context def reset(self): self.bases = {} self.user_types = {} self.enumerations = {} self.symbols = {} self._sections = [] self._omap_mapping = [] def read_necessary_streams(self): """Read streams to populate the various internal components for a PDB table.""" if not self.metadata['windows'].get('pdb', None): self.read_pdb_info_stream() if not self.user_types: self.read_tpi_stream() if not self.symbols: self.read_symbol_stream() def read_tpi_stream(self) -> None: """Reads the TPI type steam.""" self.types = [] type_references = self._read_info_stream(2, "TPI", self.types) self.process_types(type_references) def read_ipi_stream(self): """""" if not self._dbiheader: self.read_dbi_stream() vollog.debug("Reading IPI layer") ipi_list = [] type_references = self._read_info_stream(4, "IPI", ipi_list) for name in type_references.keys(): # This doesn't break, because we want to use the last string/pdbname in the list if name.endswith('.pdb'): self._database_name = name.split('\\')[-1] def _read_info_stream(self, stream_number, stream_name, info_list): vollog.debug("Reading {}".format(stream_name)) info_layer = self._context.layers.get(self._layer_name + "_stream" + str(stream_number), None) if not info_layer: raise ValueError("No TPI stream available") module = self._context.module(module_name = info_layer.pdb_symbol_table, layer_name = info_layer.name, offset = 0) header = module.object(object_type = "TPI_HEADER", offset = 0) # Check the header if not (56 <= header.header_size < 1024): raise ValueError("{} Stream Header size outside normal bounds".format(stream_name)) if header.index_min < 4096: raise ValueError("Minimum {} index is 4096, found: {}".format(stream_name, header.index_min)) if header.index_max < header.index_min: raise ValueError("Maximum {} index is smaller than minimum TPI index, found: {} < {} ".format( stream_name, header.index_max, header.index_min)) # Reset the state info_references = {} # type: Dict[str, int] offset = header.header_size # Ensure we use the same type everywhere length_type = "unsigned short" length_len = module.get_type(length_type).size info_index = 1 while info_layer.maximum_address - offset > 0: self._progress_callback(offset * 100 / info_layer.maximum_address, "Reading TPI layer") length = module.object(object_type = length_type, offset = offset) if not isinstance(length, int): raise TypeError("Non-integer length provided") offset += length_len output, consumed = self.consume_type(module, offset, length) leaf_type, name, value = output for tag_type in ['unnamed', 'anonymous']: if name == '<{}-tag>'.format(tag_type) or name == '__{}'.format(tag_type): name = '__{}_'.format(tag_type) + hex(len(info_list) + 0x1000)[2:] if name: info_references[name] = len(info_list) info_list.append((leaf_type, name, value)) offset += length info_index += 1 # Since types can only refer to earlier types, assigning the name at this point is fine if info_layer.maximum_address - offset != 0: raise ValueError("Type values did not fill the TPI stream correctly") return info_references def read_dbi_stream(self) -> None: """Reads the DBI Stream.""" vollog.debug("Reading DBI stream") dbi_layer = self._context.layers.get(self._layer_name + "_stream3", None) if not dbi_layer: raise ValueError("No DBI stream available") module = self._context.module(module_name = dbi_layer.pdb_symbol_table, layer_name = dbi_layer.name, offset = 0) self._dbiheader = module.object(object_type = "DBI_HEADER", offset = 0) if not self._dbiheader: raise ValueError("DBI Header could not be read") # Skip past sections we don't care about to get to the DBG header dbg_hdr_offset = (self._dbiheader.vol.size + self._dbiheader.module_size + self._dbiheader.secconSize + self._dbiheader.secmapSize + self._dbiheader.filinfSize + self._dbiheader.tsmapSize + self._dbiheader.ecinfoSize) self._dbidbgheader = module.object(object_type = "DBI_DBG_HEADER", offset = dbg_hdr_offset) self._sections = [] self._omap_mapping = [] if self._dbidbgheader.snSectionHdrOrig != -1: section_orig_layer_name = self._layer_name + "_stream" + str(self._dbidbgheader.snSectionHdrOrig) consumed, length = 0, self.context.layers[section_orig_layer_name].maximum_address while consumed < length: section = self.context.object(dbi_layer.pdb_symbol_table + constants.BANG + "IMAGE_SECTION_HEADER", offset = consumed, layer_name = section_orig_layer_name) self._sections.append(section) consumed += section.vol.size if self._dbidbgheader.snOmapFromSrc != -1: omap_layer_name = self._layer_name + "_stream" + str(self._dbidbgheader.snOmapFromSrc) length = self.context.layers[omap_layer_name].maximum_address data = self.context.layers[omap_layer_name].read(0, length) # For speed we don't use the framework to read this (usually sizeable) data for i in range(0, length, 8): self._omap_mapping.append( (int.from_bytes(data[i:i + 4], byteorder = 'little'), int.from_bytes(data[i + 4:i + 8], byteorder = 'little'))) elif self._dbidbgheader.snSectionHdr != -1: section_layer_name = self._layer_name + "_stream" + str(self._dbidbgheader.snSectionHdr) consumed, length = 0, self.context.layers[section_layer_name].maximum_address while consumed < length: section = self.context.object(dbi_layer.pdb_symbol_table + constants.BANG + "IMAGE_SECTION_HEADER", offset = consumed, layer_name = section_layer_name) self._sections.append(section) consumed += section.vol.size def read_symbol_stream(self): """Reads in the symbol stream.""" self.symbols = {} if not self._dbiheader: self.read_dbi_stream() vollog.debug("Reading Symbols") symrec_layer = self._context.layers.get(self._layer_name + "_stream" + str(self._dbiheader.symrecStream), None) if not symrec_layer: raise ValueError("No SymRec stream available") module = self._context.module(module_name = symrec_layer.pdb_symbol_table, layer_name = symrec_layer.name, offset = 0) offset = 0 max_address = symrec_layer.maximum_address while offset < max_address: self._progress_callback(offset * 100 / max_address, "Reading Symbol layer") sym = module.object(object_type = "GLOBAL_SYMBOL", offset = offset) leaf_type = module.object(object_type = "unsigned short", offset = sym.leaf_type.vol.offset) name = None address = None if sym.segment < len(self._sections): if leaf_type == 0x110e: # v3 symbol (c-string) name = self.parse_string(sym.name, False, sym.length - sym.vol.size + 2) address = self._sections[sym.segment - 1].VirtualAddress + sym.offset elif leaf_type == 0x1009: # v2 symbol (pascal-string) name = self.parse_string(sym.name, True, sym.length - sym.vol.size + 2) address = self._sections[sym.segment - 1].VirtualAddress + sym.offset else: vollog.debug("Only v2 and v3 symbols are supported") if name: if self._omap_mapping: address = self.omap_lookup(address) stripped_name = self.name_strip(name) self.symbols[stripped_name] = {"address": address} if name != self.name_strip(name): self.symbols[stripped_name]["linkage_name"] = name offset += sym.length + 2 # Add on length itself def read_pdb_info_stream(self): """Reads in the pdb information stream.""" if not self._dbiheader: self.read_dbi_stream() if self._database_name is None: self.read_ipi_stream() vollog.debug("Reading PDB Info") pdb_info_layer = self._context.layers.get(self._layer_name + "_stream1", None) if not pdb_info_layer: raise ValueError("No PDB Info Stream available") module = self._context.module(module_name = pdb_info_layer.pdb_symbol_table, layer_name = pdb_info_layer.name, offset = 0) pdb_info = module.object(object_type = "PDB_INFORMATION", offset = 0) self.metadata['windows']['pdb'] = { "GUID": self.convert_bytes_to_guid(pdb_info.GUID), "age": pdb_info.age, "database": self._database_name or 'unknown.pdb', "machine_type": self._dbiheader.machine } def convert_bytes_to_guid(self, original: bytes) -> str: """Convert the bytes to the correct ordering for a GUID.""" orig_guid_list = [x for x in original] guid_list = [] for i in [3, 2, 1, 0, 5, 4, 7, 6, 8, 9, 10, 11, 12, 13, 14, 15]: guid_list.append(orig_guid_list[i]) return str(binascii.hexlify(bytes(guid_list)), "latin-1").upper() # SYMBOL HANDLING CODE def omap_lookup(self, address): """Looks up an address using the omap mapping.""" pos = bisect(self._omap_mapping, (address, -1)) if self._omap_mapping[pos][0] > address: pos -= 1 if not self._omap_mapping[pos][1]: return 0 return self._omap_mapping[pos][1] + (address - self._omap_mapping[pos][0]) def name_strip(self, name): """Strips unnecessary components from the start of a symbol name.""" new_name = name if new_name[:1] in ["_", "@", "\u007F"]: new_name = new_name[1:] name_array = new_name.split("@") if len(name_array) == 2: if name_array[1].isnumeric() and name_array[0][0] != "?": new_name = name_array[0] else: new_name = name return new_name def get_json(self): """Returns the intermediate format JSON data from this pdb file.""" self.read_necessary_streams() # Set the time/datestamp for the output self.metadata["producer"] = { "datetime": datetime.datetime.now().isoformat(), "name": "volatility3", "version": constants.PACKAGE_VERSION } return { "user_types": self.user_types, "enums": self.enumerations, "base_types": self.bases, "symbols": self.symbols, "metadata": self.metadata, } def get_type_from_index(self, index: int) -> Union[List[Any], Dict[str, Any]]: """Takes a type index and returns appropriate dictionary.""" if index < 0x1000: base_name, base = primatives[index & 0xff] self.bases[base_name] = base result = {"kind": "base", "name": base_name} # type: Union[List[Dict[str, Any]], Dict[str, Any]] indirection = (index & 0xf00) if indirection: pointer_name, pointer_base = indirections[indirection] if self.bases.get('pointer', None) and self.bases['pointer'] == pointer_base: result = {"kind": "pointer", "subtype": result} else: self.bases[pointer_name] = pointer_base result = {"kind": "pointer", "base": pointer_name, "subtype": result} return result else: leaf_type, name, value = self.types[index - 0x1000] result = {"kind": "struct", "name": name} if leaf_type in [leaf_type.LF_MODIFIER]: result = self.get_type_from_index(value.subtype_index) elif leaf_type in [leaf_type.LF_ARRAY, leaf_type.LF_ARRAY_ST, leaf_type.LF_STRIDED_ARRAY]: result = { "count": ForwardArrayCount(value.size, value.element_type), "kind": "array", "subtype": self.get_type_from_index(value.element_type) } elif leaf_type in [leaf_type.LF_BITFIELD]: result = { "kind": "bitfield", "type": self.get_type_from_index(value.underlying_type), "bit_length": value.length, "bit_position": value.position } elif leaf_type in [leaf_type.LF_POINTER]: # Since we use the base['pointer'] to set the size for pointers, update it and check we don't get conflicts size = self.get_size_from_index(index) if self.bases.get("pointer", None) is None: self.bases['pointer'] = {"endian": "little", "kind": "int", "signed": False, "size": size} else: if size != self.bases['pointer']['size']: raise ValueError("Native pointers with different sizes!") result = {"kind": "pointer", "subtype": self.get_type_from_index(value.subtype_index)} elif leaf_type in [leaf_type.LF_PROCEDURE]: return {"kind": "function"} elif leaf_type in [leaf_type.LF_UNION]: result = {"kind": "union", "name": name} elif leaf_type in [leaf_type.LF_ENUM]: result = {"kind": "enum", "name": name} elif leaf_type in [leaf_type.LF_FIELDLIST]: result = value elif not name: raise ValueError("No name for structure that should be named") return result def get_size_from_index(self, index: int) -> int: """Returns the size of the structure based on the type index provided.""" result = -1 name = '' # type: Optional[str] if index < 0x1000: if (index & 0xf00): _, base = indirections[index & 0xf00] else: _, base = primatives[index & 0xff] result = base['size'] else: leaf_type, name, value = self.types[index - 0x1000] if leaf_type in [ leaf_type.LF_UNION, leaf_type.LF_CLASS, leaf_type.LF_CLASS_ST, leaf_type.LF_STRUCTURE, leaf_type.LF_STRUCTURE_ST, leaf_type.LF_INTERFACE ]: if not value.properties.forward_reference: result = value.size elif leaf_type in [leaf_type.LF_ARRAY, leaf_type.LF_ARRAY_ST, leaf_type.LF_STRIDED_ARRAY]: result = value.size elif leaf_type in [leaf_type.LF_MODIFIER, leaf_type.LF_ENUM, leaf_type.LF_ARGLIST]: result = self.get_size_from_index(value.subtype_index) elif leaf_type in [leaf_type.LF_MEMBER]: result = self.get_size_from_index(value.field_type) elif leaf_type in [leaf_type.LF_BITFIELD]: result = self.get_size_from_index(value.underlying_type) elif leaf_type in [leaf_type.LF_POINTER]: result = value.size if not result: if value.pointer_type == 0x0a: return 4 elif value.pointer_type == 0x0c: return 8 else: raise ValueError("Pointer size could not be determined") elif leaf_type in [leaf_type.LF_PROCEDURE]: raise ValueError("LF_PROCEDURE size could not be identified") else: raise ValueError("Unable to determine size of leaf_type {}".format(leaf_type.lookup())) if result <= 0: raise ValueError("Invalid size identified: {} ({})".format(index, name)) return result ### TYPE HANDLING CODE def process_types(self, type_references: Dict[str, int]) -> None: """Reads the TPI and symbol streams to populate the reader's variables.""" self.bases = {} self.user_types = {} self.enumerations = {} max_len = len(self.types) for index in range(max_len): self._progress_callback(index * 100 / max_len, "Processing types") leaf_type, name, value = self.types[index] if leaf_type in [ leaf_type.LF_CLASS, leaf_type.LF_CLASS_ST, leaf_type.LF_STRUCTURE, leaf_type.LF_STRUCTURE_ST, leaf_type.LF_INTERFACE ]: if not value.properties.forward_reference and name: self.user_types[name] = { "kind": "struct", "size": value.size, "fields": self.convert_fields(value.fields - 0x1000) } elif leaf_type in [leaf_type.LF_UNION]: if not value.properties.forward_reference and name: # Deal with UNION types self.user_types[name] = { "kind": "union", "size": value.size, "fields": self.convert_fields(value.fields - 0x1000) } elif leaf_type in [leaf_type.LF_ENUM]: if not value.properties.forward_reference and name: base = self.get_type_from_index(value.subtype_index) if not isinstance(base, Dict): raise ValueError("Invalid base type returned for Enumeration") constants = self.get_type_from_index(value.fields) if not isinstance(constants, list): raise ValueError("Enumeration fields type not a list") self.enumerations[name] = { 'base': base['name'], 'size': self.get_size_from_index(value.subtype_index), 'constants': dict([(name, enum.value) for _, name, enum in constants]) } # Re-run through for ForwardSizeReferences self.user_types = self.replace_forward_references(self.user_types, type_references) def consume_type( self, module: interfaces.context.ModuleInterface, offset: int, length: int ) -> Tuple[Tuple[Optional[interfaces.objects.ObjectInterface], Optional[str], Union[ None, List, interfaces.objects.ObjectInterface]], int]: """Returns a (leaf_type, name, object) Tuple for a type, and the number of bytes consumed.""" leaf_type = self.context.object(module.get_enumeration("LEAF_TYPE"), layer_name = module._layer_name, offset = offset) consumed = leaf_type.vol.base_type.size remaining = length - consumed if leaf_type in [ leaf_type.LF_CLASS, leaf_type.LF_CLASS_ST, leaf_type.LF_STRUCTURE, leaf_type.LF_STRUCTURE_ST, leaf_type.LF_INTERFACE ]: structure = module.object(object_type = "LF_STRUCTURE", offset = offset + consumed) name_offset = structure.name.vol.offset - structure.vol.offset name, value, excess = self.determine_extended_value(leaf_type, structure.size, module, remaining - name_offset) structure.size = value structure.name = name consumed += remaining result = leaf_type, name, structure elif leaf_type in [leaf_type.LF_MEMBER, leaf_type.LF_MEMBER_ST]: member = module.object(object_type = "LF_MEMBER", offset = offset + consumed) name_offset = member.name.vol.offset - member.vol.offset name, value, excess = self.determine_extended_value(leaf_type, member.offset, module, remaining - name_offset) member.offset = value member.name = name result = leaf_type, name, member consumed += member.vol.size + len(name) + 1 + excess elif leaf_type in [leaf_type.LF_ARRAY, leaf_type.LF_ARRAY_ST, leaf_type.LF_STRIDED_ARRAY]: array = module.object(object_type = "LF_ARRAY", offset = offset + consumed) name_offset = array.name.vol.offset - array.vol.offset name, value, excess = self.determine_extended_value(leaf_type, array.size, module, remaining - name_offset) array.size = value array.name = name result = leaf_type, name, array consumed += remaining elif leaf_type in [leaf_type.LF_ENUMERATE]: enum = module.object(object_type = 'LF_ENUMERATE', offset = offset + consumed) name_offset = enum.name.vol.offset - enum.vol.offset name, value, excess = self.determine_extended_value(leaf_type, enum.value, module, remaining - name_offset) enum.value = value enum.name = name result = leaf_type, name, enum consumed += enum.vol.size + len(name) + 1 + excess elif leaf_type in [leaf_type.LF_ARGLIST, leaf_type.LF_ENUM]: enum = module.object(object_type = "LF_ENUM", offset = offset + consumed) name_offset = enum.name.vol.offset - enum.vol.offset name = self.parse_string(enum.name, leaf_type < leaf_type.LF_ST_MAX, size = remaining - name_offset) enum.name = name result = leaf_type, name, enum consumed += remaining elif leaf_type in [leaf_type.LF_UNION]: union = module.object(object_type = "LF_UNION", offset = offset + consumed) name_offset = union.name.vol.offset - union.vol.offset name = self.parse_string(union.name, leaf_type < leaf_type.LF_ST_MAX, size = remaining - name_offset) result = leaf_type, name, union consumed += remaining elif leaf_type in [leaf_type.LF_MODIFIER, leaf_type.LF_POINTER, leaf_type.LF_PROCEDURE]: obj = module.object(object_type = leaf_type.lookup(), offset = offset + consumed) result = leaf_type, None, obj consumed += remaining elif leaf_type in [leaf_type.LF_FIELDLIST]: sub_length = remaining sub_offset = offset + consumed fields = [] while length > consumed: subfield, sub_consumed = self.consume_type(module, sub_offset, sub_length) sub_consumed += self.consume_padding(module.layer_name, sub_offset + sub_consumed) sub_length -= sub_consumed sub_offset += sub_consumed consumed += sub_consumed fields.append(subfield) result = leaf_type, None, fields elif leaf_type in [leaf_type.LF_BITFIELD]: bitfield = module.object(object_type = "LF_BITFIELD", offset = offset + consumed) result = leaf_type, None, bitfield consumed += remaining elif leaf_type in [leaf_type.LF_STRING_ID, leaf_type.LF_FUNC_ID]: string_id = module.object(object_type = leaf_type.lookup(), offset = offset + consumed) name_offset = string_id.name.vol.offset - string_id.vol.offset name = self.parse_string(string_id.name, leaf_type < leaf_type.LF_ST_MAX, size = remaining - name_offset) result = leaf_type, name, string_id elif leaf_type in [leaf_type.LF_UDT_SRC_LINE, leaf_type.LF_UDT_MOD_SRC_LINE]: src_line = module.object(object_type = leaf_type.lookup(), offset = offset + consumed) result = leaf_type, None, src_line elif leaf_type in [leaf_type.LF_BUILDINFO]: buildinfo = module.object(object_type = leaf_type.lookup(), offset = offset + consumed) buildinfo.arguments.count = buildinfo.count consumed += buildinfo.arguments.vol.size result = leaf_type, None, buildinfo else: raise TypeError("Unhandled leaf_type: {}".format(leaf_type)) return result, consumed def consume_padding(self, layer_name: str, offset: int) -> int: """Returns the amount of padding used between fields.""" val = self.context.layers[layer_name].read(offset, 1) if not ((val[0] & 0xf0) == 0xf0): return 0 return (int(val[0]) & 0x0f) def convert_fields(self, fields: int) -> Dict[Optional[str], Dict[str, Any]]: """Converts a field list into a list of fields.""" result = {} # type: Dict[Optional[str], Dict[str, Any]] _, _, fields_struct = self.types[fields] if not isinstance(fields_struct, list): vollog.warning("Fields structure did not contain a list of fields") return result for field in fields_struct: _, name, member = field result[name] = {"offset": member.offset, "type": self.get_type_from_index(member.field_type)} return result def replace_forward_references(self, types, type_references): """Finds all ForwardArrayCounts and calculates them once ForwardReferences have been resolved.""" if isinstance(types, dict): for k, v in types.items(): types[k] = self.replace_forward_references(v, type_references) elif isinstance(types, list): new_types = [] for v in types: new_types.append(self.replace_forward_references(v, type_references)) types = new_types elif isinstance(types, ForwardArrayCount): element_type = types.element_type # If we're a forward array count, we need to do the calculation now after all the types have been processed loop = True while loop: loop = False if element_type > 0x1000: _, name, toplevel_type = self.types[element_type - 0x1000] # If there's no name, the original size is probably fine as long as we're not indirect (LF_MODIFIER) if not name and isinstance( toplevel_type, interfaces.objects.ObjectInterface) and toplevel_type.vol.type_name.endswith('LF_MODIFIER'): # We have check they don't point to a forward reference, so we go round again with the subtype element_type = toplevel_type.subtype_index loop = True elif name: # If there is a name, look it up so we're not using a reference but the real thing element_type = type_references[name] + 0x1000 return types.size // self.get_size_from_index(element_type) return types # COMMON CODE @staticmethod def parse_string(structure: interfaces.objects.ObjectInterface, parse_as_pascal: bool = False, size: int = 0) -> str: """Consumes either a c-string or a pascal string depending on the leaf_type.""" if not parse_as_pascal: name = structure.cast("string", max_length = size, encoding = "latin-1") else: name = structure.cast("pascal_string") name = name.string.cast("string", max_length = name.length, encoding = "latin-1") return str(name) def determine_extended_value(self, leaf_type: interfaces.objects.ObjectInterface, value: interfaces.objects.ObjectInterface, module: interfaces.context.ModuleInterface, length: int) -> Tuple[str, interfaces.objects.ObjectInterface, int]: """Reads a value and potentially consumes more data to construct the value.""" excess = 0 if value >= leaf_type.LF_CHAR: sub_leaf_type = self.context.object(self.context.symbol_space.get_enumeration(leaf_type.vol.type_name), layer_name = leaf_type.vol.layer_name, offset = value.vol.offset) # Set the offset at just after the previous size type offset = value.vol.offset + value.vol.data_format.length if sub_leaf_type in [leaf_type.LF_CHAR]: value = module.object(object_type = 'char', offset = offset) elif sub_leaf_type in [leaf_type.LF_SHORT]: value = module.object(object_type = 'short', offset = offset) elif sub_leaf_type in [leaf_type.LF_USHORT]: value = module.object(object_type = 'unsigned short', offset = offset) elif sub_leaf_type in [leaf_type.LF_LONG]: value = module.object(object_type = 'long', offset = offset) elif sub_leaf_type in [leaf_type.LF_ULONG]: value = module.object(object_type = 'unsigned long', offset = offset) else: raise TypeError("Unexpected extended value type") excess = value.vol.data_format.length # Updated the consume/offset counters name = module.object(object_type = "string", offset = value.vol.offset + value.vol.data_format.length) name_str = self.parse_string(name, leaf_type < leaf_type.LF_ST_MAX, size = length - excess) return name_str, value, excess class PdbRetreiver: def retreive_pdb(self, guid: str, file_name: str, progress_callback: constants.ProgressCallback = None) -> Optional[str]: vollog.info("Download PDB file...") file_name = ".".join(file_name.split(".")[:-1] + ['pdb']) for sym_url in ['http://msdl.microsoft.com/download/symbols']: url = sym_url + "/{}/{}/".format(file_name, guid) result = None for suffix in [file_name, file_name[:-1] + '_']: try: vollog.debug("Attempting to retrieve {}".format(url + suffix)) result = resources.ResourceAccessor(progress_callback).open(url + suffix) except error.HTTPError as excp: vollog.debug("Failed with {}".format(excp)) if result: break if progress_callback is not None: progress_callback(100, "Downloading {}".format(url + suffix)) if result is None: return None return result.name if __name__ == '__main__': import argparse class PrintedProgress(object): """A progress handler that prints the progress value and the description onto the command line.""" def __init__(self): self._max_message_len = 0 def __call__(self, progress: Union[int, float], description: str = None): """A simple function for providing text-based feedback. .. warning:: Only for development use. Args: progress: Percentage of progress of the current procedure """ message = "\rProgress: {0: 7.2f}\t\t{1:}".format(round(progress, 2), description or '') message_len = len(message) self._max_message_len = max([self._max_message_len, message_len]) print(message, end = (' ' * (self._max_message_len - message_len)) + '\r') parser = argparse.ArgumentParser( description = "Read PDB files and convert to Volatility 3 Intermediate Symbol Format") parser.add_argument("-o", "--output", metavar = "OUTPUT", help = "Filename for data output", required = True) file_group = parser.add_argument_group("file", description = "File-based conversion of PDB to ISF") file_group.add_argument("-f", "--file", metavar = "FILE", help = "PDB file to translate to ISF") data_group = parser.add_argument_group("data", description = "Convert based on a GUID and filename pattern") data_group.add_argument("-p", "--pattern", metavar = "PATTERN", help = "Filename pattern to recover PDB file") data_group.add_argument("-g", "--guid", metavar = "GUID", help = "GUID + Age string for the required PDB file", default = None) data_group.add_argument("-k", "--keep", action = "store_true", default = False, help = "Keep the downloaded PDB file") args = parser.parse_args() pg_cb = PrintedProgress() delfile = False filename = None if args.guid is not None and args.pattern is not None: filename = PdbRetreiver().retreive_pdb(guid = args.guid, file_name = args.pattern, progress_callback = pg_cb) delfile = True elif args.file: filename = args.file else: parser.error("No GUID/pattern or file provided") if not filename: parser.error("No suitable filename provided or retrieved") ctx = contexts.Context() if not os.path.exists(filename): parser.error("File {} does not exists".format(filename)) location = "file:" + request.pathname2url(filename) convertor = PdbReader(ctx, location, database_name = args.pattern, progress_callback = pg_cb) with open(args.output, "w") as f: json.dump(convertor.get_json(), f, indent = 2, sort_keys = True) if args.keep: print("Temporary PDB file: {}".format(filename)) elif delfile: os.remove(filename) volatility3-1.0.1/volatility3/framework/symbols/windows/pdbutil.py000066400000000000000000000351001405267600400254560ustar00rootroot00000000000000# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import binascii import json import logging import lzma import os import struct from typing import Any, Dict, Generator, List, Optional, Tuple, Union from urllib import request from volatility3 import symbols from volatility3.framework import constants, interfaces from volatility3.framework.configuration.requirements import SymbolTableRequirement from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows import pdbconv vollog = logging.getLogger(__name__) class PDBUtility: """Class to handle and manage all getting symbols based on MZ header""" @classmethod def symbol_table_from_offset( cls, context: interfaces.context.ContextInterface, layer_name: str, offset: int, symbol_table_class: str = "volatility3.framework.symbols.intermed.IntermediateSymbolTable", config_path: str = None, progress_callback: constants.ProgressCallback = None) -> Optional[str]: """Produces the name of a symbol table loaded from the offset for an MZ header Args: context: The context on which to operate layer_name: The name of the (contiguous) layer within the context that contains the MZ file offset: The offset in the layer at which the MZ file begins symbol_table_class: The class to use when constructing the SymbolTable config_path: New path for the produced symbol table configuration with the config tree progress_callback: Callable called to update ongoing progress Returns: None if no pdb information can be determined, else returned the name of the loaded symbols for the MZ """ result = cls.get_guid_from_mz(context, layer_name, offset) if result is None: return None guid, age, pdb_name = result if config_path is None: config_path = interfaces.configuration.path_join('pdbutility', pdb_name.replace('.', '_')) return cls.load_windows_symbol_table(context, guid, age, pdb_name, symbol_table_class, config_path, progress_callback) @classmethod def load_windows_symbol_table(cls, context: interfaces.context.ContextInterface, guid: str, age: int, pdb_name: str, symbol_table_class: str, config_path: str = 'pdbutility', progress_callback: constants.ProgressCallback = None): """Loads (downlading if necessary) a windows symbol table""" filter_string = os.path.join(pdb_name.strip('\x00'), guid.upper() + "-" + str(age)) isf_path = False # Take the first result of search for the intermediate file for value in intermed.IntermediateSymbolTable.file_symbol_url("windows", filter_string): isf_path = value break else: # If none are found, attempt to download the pdb, convert it and try again cls.download_pdb_isf(context, guid.upper(), age, pdb_name, progress_callback) # Try again for value in intermed.IntermediateSymbolTable.file_symbol_url("windows", filter_string): isf_path = value break if not isf_path: vollog.debug("Required symbol library path not found: {}".format(filter_string)) return None vollog.debug("Using symbol library: {}".format(filter_string)) # Set the discovered options join = interfaces.configuration.path_join context.config[join(config_path, "class")] = symbol_table_class context.config[join(config_path, "isf_url")] = isf_path parent_config_path = interfaces.configuration.parent_path(config_path) requirement_name = interfaces.configuration.path_head(config_path) # Construct the appropriate symbol table requirement = SymbolTableRequirement(name = requirement_name, description = "PDBUtility generated symbol table") requirement.construct(context, parent_config_path) return context.config[config_path] @classmethod def get_guid_from_mz(cls, context: interfaces.context.ContextInterface, layer_name: str, offset: int) -> Optional[Tuple[str, int, str]]: """Takes the offset to an MZ header, locates any available pdb headers, and extracts the guid, age and pdb_name from them Args: context: The context on which to operate layer_name: The name of the (contiguous) layer within the context that contains the MZ file offset: The offset in the layer at which the MZ file begins Returns: A tuple of the guid, age and pdb_name, or None if no PDB record can be found """ try: import pefile except ImportError: vollog.error("Get_guid_from_mz requires the following python module: pefile") return None layer = context.layers[layer_name] mz_sig = layer.read(offset, 2) # Check it is actually the MZ header if mz_sig != b"MZ": return None nt_header_start = ord(layer.read(offset + 0x3C, 1)) optional_header_size = struct.unpack(' None: """Attempts to download the PDB file, convert it to an ISF file and save it to one of the symbol locations.""" # Check for writability filter_string = os.path.join(pdb_name, guid + "-" + str(age)) for path in symbols.__path__: # Store any temporary files created by downloading PDB files tmp_files = [] potential_output_filename = os.path.join(path, "windows", filter_string + ".json.xz") data_written = False try: os.makedirs(os.path.dirname(potential_output_filename), exist_ok = True) with lzma.open(potential_output_filename, "w") as of: # Once we haven't thrown an error, do the computation filename = pdbconv.PdbRetreiver().retreive_pdb(guid + str(age), file_name = pdb_name, progress_callback = progress_callback) if filename: tmp_files.append(filename) location = "file:" + request.pathname2url(tmp_files[-1]) json_output = pdbconv.PdbReader(context, location, pdb_name, progress_callback).get_json() of.write(bytes(json.dumps(json_output, indent = 2, sort_keys = True), 'utf-8')) # After we've successfully written it out, record the fact so we don't clear it out data_written = True else: vollog.warning("Symbol file could not be found on remote server" + (" " * 100)) break except PermissionError: vollog.warning("Cannot write necessary symbol file, please check permissions on {}".format( potential_output_filename)) continue finally: # If something else failed, removed the symbol file so we don't pick it up in the future if not data_written and os.path.exists(potential_output_filename): os.remove(potential_output_filename) # Clear out all the temporary file if we constructed one for filename in tmp_files: try: os.remove(filename) except PermissionError: vollog.warning("Temporary file could not be removed: {}".format(filename)) else: vollog.warning("Cannot write downloaded symbols, please add the appropriate symbols" " or add/modify a symbols directory that is writable") @classmethod def pdbname_scan(cls, ctx: interfaces.context.ContextInterface, layer_name: str, page_size: int, pdb_names: List[bytes], progress_callback: constants.ProgressCallback = None, start: Optional[int] = None, end: Optional[int] = None) -> Generator[Dict[str, Optional[Union[bytes, str, int]]], None, None]: """Scans through `layer_name` at `ctx` looking for RSDS headers that indicate one of four common pdb kernel names (as listed in `self.pdb_names`) and returns the tuple (GUID, age, pdb_name, signature_offset, mz_offset) .. note:: This is automagical and therefore not guaranteed to provide correct results. The UI should always provide the user an opportunity to specify the appropriate types and PDB values themselves """ min_pfn = 0 if start is None: start = ctx.layers[layer_name].minimum_address if end is None: end = ctx.layers[layer_name].maximum_address for (GUID, age, pdb_name, signature_offset) in ctx.layers[layer_name].scan(ctx, PdbSignatureScanner(pdb_names), progress_callback = progress_callback, sections = [(start, end - start)]): mz_offset = None sig_pfn = signature_offset // page_size for i in range(sig_pfn, min_pfn, -1): if not ctx.layers[layer_name].is_valid(i * page_size, 2): break data = ctx.layers[layer_name].read(i * page_size, 2) if data == b'MZ': mz_offset = i * page_size break min_pfn = sig_pfn yield { 'GUID': GUID, 'age': age, 'pdb_name': str(pdb_name, "utf-8"), 'signature_offset': signature_offset, 'mz_offset': mz_offset } class PdbSignatureScanner(interfaces.layers.ScannerInterface): """A :class:`~volatility3.framework.interfaces.layers.ScannerInterface` based scanner use to identify Windows PDB records. Args: pdb_names: A list of bytestrings, used to match pdb signatures against the pdb names within the records. .. note:: The pdb_names must be a list of byte strings, unicode strs will not match against the data scanned """ overlap = 0x4000 """The size of overlap needed for the signature to ensure data cannot hide between two scanned chunks""" thread_safe = True """Determines whether the scanner accesses global variables in a thread safe manner (for use with :mod:`multiprocessing`)""" _RSDS_format = struct.Struct("<16BI") def __init__(self, pdb_names: List[bytes]) -> None: super().__init__() self._pdb_names = pdb_names def __call__(self, data: bytes, data_offset: int) -> Generator[Tuple[str, Any, bytes, int], None, None]: sig = data.find(b"RSDS") while sig >= 0: null = data.find(b'\0', sig + 4 + self._RSDS_format.size) if null > -1: if (null - sig - self._RSDS_format.size) <= 100: name_offset = sig + 4 + self._RSDS_format.size pdb_name = data[name_offset:null] if pdb_name in self._pdb_names: ## this ordering is intentional due to mixed endianness in the GUID (g3, g2, g1, g0, g5, g4, g7, g6, g8, g9, ga, gb, gc, gd, ge, gf, a) = \ self._RSDS_format.unpack(data[sig + 4:name_offset]) guid = (16 * '{:02X}').format(g0, g1, g2, g3, g4, g5, g6, g7, g8, g9, ga, gb, gc, gd, ge, gf) if sig < self.chunk_size: yield (guid, a, pdb_name, data_offset + sig) sig = data.find(b"RSDS", sig + 1) volatility3-1.0.1/volatility3/framework/symbols/windows/pe.json000066400000000000000000000512041405267600400247430ustar00rootroot00000000000000{ "metadata": { "producer": { "version": "0.0.1", "name": "vtypes_to_json.py", "datetime": "2018-05-22T22:47:20.182954" }, "format": "4.1.0" }, "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned long long": { "kind": "int", "size": 8, "signed": false, "endian": "little" }, "long": { "kind": "int", "size": 4, "signed": true, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "unsigned char": { "kind": "int", "size": 1, "signed": false, "endian": "little" } }, "symbols": {}, "enums": {}, "user_types": { "_IMAGE_DATA_DIRECTORY": { "fields": { "Size": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "VirtualAddress": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "struct", "size": 8 }, "_IMAGE_DEBUG_DIRECTORY": { "fields": { "AddressOfRawData": { "offset": 20, "type": { "kind": "base", "name": "unsigned long" } }, "Characteristics": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "MajorVersion": { "offset": 8, "type": { "kind": "base", "name": "unsigned short" } }, "MinorVersion": { "offset": 10, "type": { "kind": "base", "name": "unsigned short" } }, "PointerToRawData": { "offset": 24, "type": { "kind": "base", "name": "unsigned long" } }, "SizeOfData": { "offset": 16, "type": { "kind": "base", "name": "unsigned long" } }, "TimeDateStamp": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "Type": { "offset": 12, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "struct", "size": 28 }, "_IMAGE_DOS_HEADER": { "fields": { "e_cblp": { "offset": 2, "type": { "kind": "base", "name": "unsigned short" } }, "e_cp": { "offset": 4, "type": { "kind": "base", "name": "unsigned short" } }, "e_cparhdr": { "offset": 8, "type": { "kind": "base", "name": "unsigned short" } }, "e_crlc": { "offset": 6, "type": { "kind": "base", "name": "unsigned short" } }, "e_cs": { "offset": 22, "type": { "kind": "base", "name": "unsigned short" } }, "e_csum": { "offset": 18, "type": { "kind": "base", "name": "unsigned short" } }, "e_ip": { "offset": 20, "type": { "kind": "base", "name": "unsigned short" } }, "e_lfanew": { "offset": 60, "type": { "kind": "base", "name": "long" } }, "e_lfarlc": { "offset": 24, "type": { "kind": "base", "name": "unsigned short" } }, "e_magic": { "offset": 0, "type": { "kind": "base", "name": "unsigned short" } }, "e_maxalloc": { "offset": 12, "type": { "kind": "base", "name": "unsigned short" } }, "e_minalloc": { "offset": 10, "type": { "kind": "base", "name": "unsigned short" } }, "e_oemid": { "offset": 36, "type": { "kind": "base", "name": "unsigned short" } }, "e_oeminfo": { "offset": 38, "type": { "kind": "base", "name": "unsigned short" } }, "e_ovno": { "offset": 26, "type": { "kind": "base", "name": "unsigned short" } }, "e_res": { "offset": 28, "type": { "count": 4, "kind": "array", "subtype": { "kind": "base", "name": "unsigned short" } } }, "e_res2": { "offset": 40, "type": { "count": 10, "kind": "array", "subtype": { "kind": "base", "name": "unsigned short" } } }, "e_sp": { "offset": 16, "type": { "kind": "base", "name": "unsigned short" } }, "e_ss": { "offset": 14, "type": { "kind": "base", "name": "unsigned short" } } }, "kind": "struct", "size": 64 }, "_IMAGE_FILE_HEADER": { "fields": { "Characteristics": { "offset": 18, "type": { "kind": "base", "name": "unsigned short" } }, "Machine": { "offset": 0, "type": { "kind": "base", "name": "unsigned short" } }, "NumberOfSections": { "offset": 2, "type": { "kind": "base", "name": "unsigned short" } }, "NumberOfSymbols": { "offset": 12, "type": { "kind": "base", "name": "unsigned long" } }, "PointerToSymbolTable": { "offset": 8, "type": { "kind": "base", "name": "unsigned long" } }, "SizeOfOptionalHeader": { "offset": 16, "type": { "kind": "base", "name": "unsigned short" } }, "TimeDateStamp": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "struct", "size": 20 }, "_IMAGE_NT_HEADERS": { "fields": { "FileHeader": { "offset": 4, "type": { "kind": "struct", "name": "_IMAGE_FILE_HEADER" } }, "OptionalHeader": { "offset": 24, "type": { "kind": "struct", "name": "_IMAGE_OPTIONAL_HEADER" } }, "Signature": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "struct", "size": 248 }, "_IMAGE_OPTIONAL_HEADER": { "fields": { "AddressOfEntryPoint": { "offset": 16, "type": { "kind": "base", "name": "unsigned long" } }, "BaseOfCode": { "offset": 20, "type": { "kind": "base", "name": "unsigned long" } }, "BaseOfData": { "offset": 24, "type": { "kind": "base", "name": "unsigned long" } }, "CheckSum": { "offset": 64, "type": { "kind": "base", "name": "unsigned long" } }, "DataDirectory": { "offset": 96, "type": { "count": 16, "kind": "array", "subtype": { "kind": "struct", "name": "_IMAGE_DATA_DIRECTORY" } } }, "DllCharacteristics": { "offset": 70, "type": { "kind": "base", "name": "unsigned short" } }, "FileAlignment": { "offset": 36, "type": { "kind": "base", "name": "unsigned long" } }, "ImageBase": { "offset": 28, "type": { "kind": "base", "name": "unsigned long" } }, "LoaderFlags": { "offset": 88, "type": { "kind": "base", "name": "unsigned long" } }, "Magic": { "offset": 0, "type": { "kind": "base", "name": "unsigned short" } }, "MajorImageVersion": { "offset": 44, "type": { "kind": "base", "name": "unsigned short" } }, "MajorLinkerVersion": { "offset": 2, "type": { "kind": "base", "name": "unsigned char" } }, "MajorOperatingSystemVersion": { "offset": 40, "type": { "kind": "base", "name": "unsigned short" } }, "MajorSubsystemVersion": { "offset": 48, "type": { "kind": "base", "name": "unsigned short" } }, "MinorImageVersion": { "offset": 46, "type": { "kind": "base", "name": "unsigned short" } }, "MinorLinkerVersion": { "offset": 3, "type": { "kind": "base", "name": "unsigned char" } }, "MinorOperatingSystemVersion": { "offset": 42, "type": { "kind": "base", "name": "unsigned short" } }, "MinorSubsystemVersion": { "offset": 50, "type": { "kind": "base", "name": "unsigned short" } }, "NumberOfRvaAndSizes": { "offset": 92, "type": { "kind": "base", "name": "unsigned long" } }, "SectionAlignment": { "offset": 32, "type": { "kind": "base", "name": "unsigned long" } }, "SizeOfCode": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "SizeOfHeaders": { "offset": 60, "type": { "kind": "base", "name": "unsigned long" } }, "SizeOfHeapCommit": { "offset": 84, "type": { "kind": "base", "name": "unsigned long" } }, "SizeOfHeapReserve": { "offset": 80, "type": { "kind": "base", "name": "unsigned long" } }, "SizeOfImage": { "offset": 56, "type": { "kind": "base", "name": "unsigned long" } }, "SizeOfInitializedData": { "offset": 8, "type": { "kind": "base", "name": "unsigned long" } }, "SizeOfStackCommit": { "offset": 76, "type": { "kind": "base", "name": "unsigned long" } }, "SizeOfStackReserve": { "offset": 72, "type": { "kind": "base", "name": "unsigned long" } }, "SizeOfUninitializedData": { "offset": 12, "type": { "kind": "base", "name": "unsigned long" } }, "Subsystem": { "offset": 68, "type": { "kind": "base", "name": "unsigned short" } }, "Win32VersionValue": { "offset": 52, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "struct", "size": 224 }, "__unnamed_46": { "fields": { "PhysicalAddress": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "VirtualSize": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "union", "size": 4 }, "_IMAGE_SECTION_HEADER": { "fields": { "Characteristics": { "offset": 36, "type": { "kind": "base", "name": "unsigned long" } }, "Misc": { "offset": 8, "type": { "kind": "union", "name": "__unnamed_46" } }, "Name": { "offset": 0, "type": { "count": 8, "kind": "array", "subtype": { "kind": "base", "name": "unsigned char" } } }, "NumberOfLinenumbers": { "offset": 34, "type": { "kind": "base", "name": "unsigned short" } }, "NumberOfRelocations": { "offset": 32, "type": { "kind": "base", "name": "unsigned short" } }, "PointerToLinenumbers": { "offset": 28, "type": { "kind": "base", "name": "unsigned long" } }, "PointerToRawData": { "offset": 20, "type": { "kind": "base", "name": "unsigned long" } }, "PointerToRelocations": { "offset": 24, "type": { "kind": "base", "name": "unsigned long" } }, "SizeOfRawData": { "offset": 16, "type": { "kind": "base", "name": "unsigned long" } }, "VirtualAddress": { "offset": 12, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "struct", "size": 40 }, "_IMAGE_NT_HEADERS64": { "fields": { "Signature": { "type": { "kind": "base", "name": "unsigned long" }, "offset": 0 }, "FileHeader": { "type": { "kind": "struct", "name": "_IMAGE_FILE_HEADER" }, "offset": 4 }, "OptionalHeader": { "type": { "kind": "struct", "name": "_IMAGE_OPTIONAL_HEADER64" }, "offset": 24 } }, "kind": "struct", "size": 264 }, "_IMAGE_OPTIONAL_HEADER64": { "fields": { "Magic": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 0 }, "MajorLinkerVersion": { "type": { "kind": "base", "name": "unsigned char" }, "offset": 2 }, "MinorLinkerVersion": { "type": { "kind": "base", "name": "unsigned char" }, "offset": 3 }, "SizeOfCode": { "type": { "kind": "base", "name": "unsigned long" }, "offset": 4 }, "SizeOfInitializedData": { "type": { "kind": "base", "name": "unsigned long" }, "offset": 8 }, "SizeOfUninitializedData": { "type": { "kind": "base", "name": "unsigned long" }, "offset": 12 }, "AddressOfEntryPoint": { "type": { "kind": "base", "name": "unsigned long" }, "offset": 16 }, "BaseOfCode": { "type": { "kind": "base", "name": "unsigned long" }, "offset": 20 }, "ImageBase": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 24 }, "SectionAlignment": { "type": { "kind": "base", "name": "unsigned long" }, "offset": 32 }, "FileAlignment": { "type": { "kind": "base", "name": "unsigned long" }, "offset": 36 }, "MajorOperatingSystemVersion": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 40 }, "MinorOperatingSystemVersion": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 42 }, "MajorImageVersion": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 44 }, "MinorImageVersion": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 46 }, "MajorSubsystemVersion": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 48 }, "MinorSubsystemVersion": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 50 }, "Win32VersionValue": { "type": { "kind": "base", "name": "unsigned long" }, "offset": 52 }, "SizeOfImage": { "type": { "kind": "base", "name": "unsigned long" }, "offset": 56 }, "SizeOfHeaders": { "type": { "kind": "base", "name": "unsigned long" }, "offset": 60 }, "CheckSum": { "type": { "kind": "base", "name": "unsigned long" }, "offset": 64 }, "Subsystem": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 68 }, "DllCharacteristics": { "type": { "kind": "base", "name": "unsigned short" }, "offset": 70 }, "SizeOfStackReserve": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 72 }, "SizeOfStackCommit": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 80 }, "SizeOfHeapReserve": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 88 }, "SizeOfHeapCommit": { "type": { "kind": "base", "name": "unsigned long long" }, "offset": 96 }, "LoaderFlags": { "type": { "kind": "base", "name": "unsigned long" }, "offset": 104 }, "NumberOfRvaAndSizes": { "type": { "kind": "base", "name": "unsigned long" }, "offset": 108 }, "DataDirectory": { "type": { "count": 16, "subtype": { "kind": "struct", "name": "_IMAGE_DATA_DIRECTORY" }, "kind": "array" }, "offset": 112 } }, "kind": "struct", "size": 240 } } }volatility3-1.0.1/volatility3/framework/symbols/windows/poolheader-x64-win7.json000066400000000000000000000030531405267600400277610ustar00rootroot00000000000000{ "metadata": { "producer": { "version": "0.1.5", "name": "mhl-by-hand", "datetime": "2018-10-03T16:53:00.478000" }, "format": "4.0.0" }, "user_types": { "_POOL_HEADER": { "fields": { "BlockSize": { "offset": 0, "type": { "bit_length": 8, "bit_position": 16, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned long" } } }, "PoolIndex": { "offset": 0, "type": { "bit_length": 8, "bit_position": 8, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned long" } } }, "PoolTag": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "PoolType": { "offset": 0, "type": { "bit_length": 8, "bit_position": 24, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned long" } } } }, "kind": "struct", "size": 16 } }, "symbols": { }, "enums": { }, "base_types": { "unsigned long": { "endian": "little", "kind": "int", "signed": false, "size": 4 }, "int": { "endian": "little", "kind": "int", "signed": true, "size": 4 } } } volatility3-1.0.1/volatility3/framework/symbols/windows/poolheader-x64.json000066400000000000000000000032411405267600400270760ustar00rootroot00000000000000{ "metadata": { "producer": { "version": "0.1.5", "name": "mhl-by-hand", "datetime": "2018-10-03T16:53:00.478000" }, "format": "4.0.0" }, "user_types": { "_POOL_HEADER": { "fields": { "BlockSize": { "offset": 2, "type": { "bit_length": 8, "bit_position": 0, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned short" } } }, "PoolIndex": { "offset": 0, "type": { "bit_length": 8, "bit_position": 8, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned short" } } }, "PoolTag": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "PoolType": { "offset": 2, "type": { "bit_length": 8, "bit_position": 8, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned short" } } } }, "kind": "struct", "size": 16 } }, "symbols": { }, "enums": { }, "base_types": { "unsigned long": { "endian": "little", "kind": "int", "signed": false, "size": 4 }, "unsigned short": { "endian": "little", "kind": "int", "signed": false, "size": 2 }, "int": { "endian": "little", "kind": "int", "signed": true, "size": 4 } } } volatility3-1.0.1/volatility3/framework/symbols/windows/poolheader-x86.json000066400000000000000000000032411405267600400271020ustar00rootroot00000000000000{ "metadata": { "producer": { "version": "0.1.5", "name": "mhl-by-hand", "datetime": "2018-10-03T16:53:00.478000" }, "format": "4.0.0" }, "user_types": { "_POOL_HEADER": { "fields": { "BlockSize": { "offset": 2, "type": { "bit_length": 9, "bit_position": 0, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned short" } } }, "PoolIndex": { "offset": 0, "type": { "bit_length": 7, "bit_position": 9, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned short" } } }, "PoolTag": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "PoolType": { "offset": 2, "type": { "bit_length": 7, "bit_position": 9, "kind": "bitfield", "type": { "kind": "base", "name": "unsigned short" } } } }, "kind": "struct", "size": 16 } }, "symbols": { }, "enums": { }, "base_types": { "unsigned long": { "endian": "little", "kind": "int", "signed": false, "size": 4 }, "unsigned short": { "endian": "little", "kind": "int", "signed": false, "size": 2 }, "int": { "endian": "little", "kind": "int", "signed": true, "size": 4 } } } volatility3-1.0.1/volatility3/framework/symbols/windows/registry.json000066400000000000000000000142541405267600400262130ustar00rootroot00000000000000{ "symbols": { }, "user_types": { "__unnamed_114": { "fields": { "Next": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "UserData": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "union", "size": 4 }, "__unnamed_115": { "fields": { "Last": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "u": { "offset": 4, "type": { "kind": "union", "name": "__unnamed_114" } } }, "kind": "struct", "size": 8 }, "__unnamed_116": { "fields": { "u": { "offset": 0, "type": { "kind": "union", "name": "__unnamed_114" } } }, "kind": "struct", "size": 4 }, "__unnamed_117": { "fields": { "NewCell": { "offset": 0, "type": { "kind": "struct", "name": "__unnamed_116" } }, "OldCell": { "offset": 0, "type": { "kind": "struct", "name": "__unnamed_115" } } }, "kind": "union", "size": 8 }, "_HBIN": { "fields": { "FileOffset": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "Reserved1": { "offset": 12, "type": { "count": 2, "kind": "array", "subtype": { "kind": "base", "name": "unsigned long" } } }, "Signature": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "Size": { "offset": 8, "type": { "kind": "base", "name": "unsigned long" } }, "Spare": { "offset": 28, "type": { "kind": "base", "name": "unsigned long" } }, "TimeStamp": { "offset": 20, "type": { "kind": "union", "name": "_LARGE_INTEGER" } } }, "kind": "struct", "size": 32 }, "_HCELL": { "fields": { "Size": { "offset": 0, "type": { "kind": "base", "name": "long" } }, "u": { "offset": 4, "type": { "kind": "union", "name": "__unnamed_117" } } }, "kind": "struct", "size": 12 }, "_VOL_USERASSIST_TYPES_XP": { "fields": { "ID": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "CountStartingAtFive": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "LastUpdated": { "offset": 8, "type": { "kind": "union", "name": "_LARGE_INTEGER" } } }, "kind": "struct", "size": 16 }, "_VOL_USERASSIST_TYPES_7": { "fields": { "Count": { "offset": 4, "type": { "kind": "base", "name": "unsigned long" } }, "FocusCount": { "offset": 8, "type": { "kind": "base", "name": "unsigned long" } }, "FocusTime": { "offset": 12, "type": { "kind": "base", "name": "unsigned long" } }, "LastUpdated": { "offset": 60, "type": { "kind": "union", "name": "_LARGE_INTEGER" } } }, "kind": "struct", "size": 72 }, "_LARGE_INTEGER": { "fields": { "HighPart": { "offset": 4, "type": { "kind": "base", "name": "long" } }, "LowPart": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } }, "QuadPart": { "offset": 0, "type": { "kind": "base", "name": "long long" } }, "u": { "offset": 0, "type": { "kind": "struct", "name": "__unnamed_2" } } }, "kind": "union", "size": 8 }, "__unnamed_2": { "fields": { "HighPart": { "offset": 4, "type": { "kind": "base", "name": "long" } }, "LowPart": { "offset": 0, "type": { "kind": "base", "name": "unsigned long" } } }, "kind": "struct", "size": 8 } }, "enums": { }, "base_types": { "unsigned char": { "endian": "little", "kind": "char", "signed": false, "size": 1 }, "unsigned short": { "endian": "little", "kind": "int", "signed": false, "size": 2 }, "long": { "endian": "little", "kind": "int", "signed": true, "size": 4 }, "char": { "endian": "little", "kind": "char", "signed": true, "size": 1 }, "unsigned long": { "endian": "little", "kind": "int", "signed": false, "size": 4 }, "long long": { "endian": "little", "kind": "int", "signed": true, "size": 8 }, "unsigned long long": { "endian": "little", "kind": "int", "signed": false, "size": 8 } }, "metadata": { "producer": { "version": "0.0.1", "name": "ikelos-by-hand", "datetime": "2017-09-04T22:45:22" }, "format": "4.0.0" } } volatility3-1.0.1/volatility3/framework/symbols/windows/services-vista-x64.json000066400000000000000000000170011405267600400277220ustar00rootroot00000000000000{ "symbols": {}, "enums": { "StateEnum": { "base": "long", "constants": { "SERVICE_START_PENDING": 2, "SERVICE_STOP_PENDING": 3, "SERVICE_STOPPED": 1, "SERVICE_CONTINUE_PENDING": 5, "SERVICE_PAUSE_PENDING": 6, "SERVICE_PAUSED": 7, "SERVICE_RUNNING": 4 }, "size": 4 }, "StartEnum": { "base": "long", "constants": { "SERVICE_DEMAND_START": 3, "SERVICE_AUTO_START": 2, "SERVICE_BOOT_START": 0, "SERVICE_DISABLED": 4, "SERVICE_SYSTEM_START": 1 }, "size": 4 } }, "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 8, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "user_types": { "_SERVICE_LIST_ENTRY": { "fields": { "Flink": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_LIST_ENTRY" } }, "offset": 16 }, "Blink": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_LIST_ENTRY" } }, "offset": 0 } }, "kind": "struct", "size": 16 }, "_SERVICE_PROCESS": { "fields": { "BinaryPath": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 16 }, "ProcessId": { "type": { "kind": "base", "name": "unsigned int" }, "offset": 24 } }, "kind": "struct", "size": 24 }, "_SERVICE_HEADER": { "fields": { "Tag": { "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" }, "offset": 0 }, "ServiceRecord": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_RECORD" } }, "offset": 16 } }, "kind": "struct", "size": 16 }, "_SERVICE_RECORD": { "fields": { "ServiceList": { "type": { "kind": "struct", "name": "_SERVICE_LIST_ENTRY" }, "offset": 120 }, "DisplayName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 16 }, "ServiceProcess": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_PROCESS" } }, "offset": 40 }, "ServiceName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 8 }, "PrevEntry": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_RECORD" } }, "offset": 0 }, "Start": { "type": { "kind": "enum", "name": "StartEnum" }, "offset": 76 }, "State": { "type": { "kind": "enum", "name": "StateEnum" }, "offset": 52 }, "Tag": { "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" }, "offset": 32 }, "DriverName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 40 }, "Type": { "type": { "kind": "base", "name": "unsigned long" }, "offset": 48 }, "Order": { "type": { "kind": "base", "name": "unsigned int" }, "offset": 24 } }, "kind": "struct", "size": 120 } }, "metadata": { "producer": { "version": "0.0.1", "name": "vtypes_to_json.py", "datetime": "2019-04-17T13:45:16.417006" }, "format": "4.1.0" } }volatility3-1.0.1/volatility3/framework/symbols/windows/services-vista-x86.json000066400000000000000000000166451405267600400277430ustar00rootroot00000000000000{ "symbols": {}, "enums": { "StateEnum": { "base": "long", "constants": { "SERVICE_START_PENDING": 2, "SERVICE_STOP_PENDING": 3, "SERVICE_STOPPED": 1, "SERVICE_CONTINUE_PENDING": 5, "SERVICE_PAUSE_PENDING": 6, "SERVICE_PAUSED": 7, "SERVICE_RUNNING": 4 }, "size": 4 }, "StartEnum": { "base": "long", "constants": { "SERVICE_DEMAND_START": 3, "SERVICE_AUTO_START": 2, "SERVICE_BOOT_START": 0, "SERVICE_DISABLED": 4, "SERVICE_SYSTEM_START": 1 }, "size": 4 } }, "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "user_types": { "_SERVICE_LIST_ENTRY": { "fields": { "Flink": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_LIST_ENTRY" } }, "offset": 4 }, "Blink": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_LIST_ENTRY" } }, "offset": 0 } }, "kind": "struct", "size": 8 }, "_SERVICE_PROCESS": { "fields": { "BinaryPath": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 8 }, "ProcessId": { "type": { "kind": "base", "name": "unsigned int" }, "offset": 12 } }, "kind": "struct", "size": 12 }, "_SERVICE_HEADER": { "fields": { "Tag": { "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" }, "offset": 0 }, "ServiceRecord": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_RECORD" } }, "offset": 12 } }, "kind": "struct", "size": 12 }, "_SERVICE_RECORD": { "fields": { "ServiceList": { "type": { "kind": "struct", "name": "_SERVICE_LIST_ENTRY" }, "offset": 92 }, "DisplayName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 8 }, "ServiceProcess": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_PROCESS" } }, "offset": 28 }, "ServiceName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 4 }, "PrevEntry": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_RECORD" } }, "offset": 0 }, "Start": { "type": { "kind": "enum", "name": "StartEnum" }, "offset": 60 }, "State": { "type": { "kind": "enum", "name": "StateEnum" }, "offset": 36 }, "Tag": { "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" }, "offset": 24 }, "DriverName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 28 }, "Type": { "type": { "kind": "base", "name": "unsigned long" }, "offset": 32 }, "Order": { "type": { "kind": "base", "name": "unsigned int" }, "offset": 12 } }, "kind": "struct", "size": 92 } }, "metadata": { "producer": { "version": "0.0.1", "name": "vtypes_to_json.py", "datetime": "2019-04-17T13:45:16.417006" }, "format": "4.1.0" } } volatility3-1.0.1/volatility3/framework/symbols/windows/services-win10-15063-x64.json000066400000000000000000000170011405267600400302060ustar00rootroot00000000000000{ "symbols": {}, "enums": { "StateEnum": { "base": "long", "constants": { "SERVICE_START_PENDING": 2, "SERVICE_STOP_PENDING": 3, "SERVICE_STOPPED": 1, "SERVICE_CONTINUE_PENDING": 5, "SERVICE_PAUSE_PENDING": 6, "SERVICE_PAUSED": 7, "SERVICE_RUNNING": 4 }, "size": 4 }, "StartEnum": { "base": "long", "constants": { "SERVICE_DEMAND_START": 3, "SERVICE_AUTO_START": 2, "SERVICE_BOOT_START": 0, "SERVICE_DISABLED": 4, "SERVICE_SYSTEM_START": 1 }, "size": 4 } }, "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 8, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "user_types": { "_SERVICE_LIST_ENTRY": { "fields": { "Flink": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_LIST_ENTRY" } }, "offset": 16 }, "Blink": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_LIST_ENTRY" } }, "offset": 0 } }, "kind": "struct", "size": 16 }, "_SERVICE_PROCESS": { "fields": { "BinaryPath": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 24 }, "ProcessId": { "type": { "kind": "base", "name": "unsigned int" }, "offset": 32 } }, "kind": "struct", "size": 32 }, "_SERVICE_HEADER": { "fields": { "Tag": { "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" }, "offset": 0 }, "ServiceRecord": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_RECORD" } }, "offset": 16 } }, "kind": "struct", "size": 16 }, "_SERVICE_RECORD": { "fields": { "ServiceList": { "type": { "kind": "struct", "name": "_SERVICE_LIST_ENTRY" }, "offset": 0 }, "Tag": { "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" }, "offset": 32 }, "DisplayName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 64 }, "ServiceProcess": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_PROCESS" } }, "offset": 232 }, "PrevEntry": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_RECORD" } }, "offset": 16 }, "Start": { "type": { "kind": "enum", "name": "StartEnum" }, "offset": 36 }, "State": { "type": { "kind": "enum", "name": "StateEnum" }, "offset": 76 }, "ServiceName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 56 }, "DriverName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 232 }, "Type": { "type": { "kind": "base", "name": "unsigned long" }, "offset": 72 }, "Order": { "type": { "kind": "base", "name": "unsigned int" }, "offset": 32 } }, "kind": "struct", "size": 232 } }, "metadata": { "producer": { "version": "0.0.1", "name": "vtypes_to_json.py", "datetime": "2019-04-17T13:45:16.417006" }, "format": "4.1.0" } }volatility3-1.0.1/volatility3/framework/symbols/windows/services-win10-15063-x86.json000066400000000000000000000164131405267600400302200ustar00rootroot00000000000000{ "symbols": {}, "enums": { "StateEnum": { "base": "long", "constants": { "SERVICE_START_PENDING": 2, "SERVICE_STOP_PENDING": 3, "SERVICE_STOPPED": 1, "SERVICE_CONTINUE_PENDING": 5, "SERVICE_PAUSE_PENDING": 6, "SERVICE_PAUSED": 7, "SERVICE_RUNNING": 4 }, "size": 4 }, "StartEnum": { "base": "long", "constants": { "SERVICE_DEMAND_START": 3, "SERVICE_AUTO_START": 2, "SERVICE_BOOT_START": 0, "SERVICE_DISABLED": 4, "SERVICE_SYSTEM_START": 1 }, "size": 4 } }, "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "user_types": { "_SERVICE_LIST_ENTRY": { "fields": { "Flink": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_LIST_ENTRY" } }, "offset": 4 }, "Blink": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_LIST_ENTRY" } }, "offset": 0 } }, "kind": "struct", "size": 8 }, "_SERVICE_PROCESS": { "fields": { "BinaryPath": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 12 }, "ProcessId": { "type": { "kind": "base", "name": "unsigned int" }, "offset": 16 } }, "kind": "struct", "size": 16 }, "_SERVICE_HEADER": { "fields": { "Tag": { "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" }, "offset": 0 }, "ServiceRecord": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_RECORD" } }, "offset": 12 } }, "kind": "struct", "size": 12 }, "_SERVICE_RECORD": { "fields": { "DisplayName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 48 }, "ServiceProcess": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_PROCESS" } }, "offset": 156 }, "PrevEntry": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_RECORD" } }, "offset": 12 }, "Start": { "type": { "kind": "enum", "name": "StartEnum" }, "offset": 24 }, "State": { "type": { "kind": "enum", "name": "StateEnum" }, "offset": 56 }, "ServiceName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 44 }, "Tag": { "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" }, "offset": 0 }, "DriverName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 156 }, "Type": { "type": { "kind": "base", "name": "unsigned long" }, "offset": 52 }, "Order": { "type": { "kind": "base", "name": "unsigned int" }, "offset": 20 } }, "kind": "struct", "size": 156 } }, "metadata": { "producer": { "version": "0.0.1", "name": "vtypes_to_json.py", "datetime": "2019-04-17T13:45:16.417006" }, "format": "4.1.0" } }volatility3-1.0.1/volatility3/framework/symbols/windows/services-win10-16299-x64.json000066400000000000000000000170021405267600400302230ustar00rootroot00000000000000{ "symbols": {}, "enums": { "StateEnum": { "base": "long", "constants": { "SERVICE_START_PENDING": 2, "SERVICE_STOP_PENDING": 3, "SERVICE_STOPPED": 1, "SERVICE_CONTINUE_PENDING": 5, "SERVICE_PAUSE_PENDING": 6, "SERVICE_PAUSED": 7, "SERVICE_RUNNING": 4 }, "size": 4 }, "StartEnum": { "base": "long", "constants": { "SERVICE_DEMAND_START": 3, "SERVICE_AUTO_START": 2, "SERVICE_BOOT_START": 0, "SERVICE_DISABLED": 4, "SERVICE_SYSTEM_START": 1 }, "size": 4 } }, "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 8, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "user_types": { "_SERVICE_LIST_ENTRY": { "fields": { "Flink": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_LIST_ENTRY" } }, "offset": 16 }, "Blink": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_LIST_ENTRY" } }, "offset": 0 } }, "kind": "struct", "size": 16 }, "_SERVICE_PROCESS": { "fields": { "BinaryPath": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 24 }, "ProcessId": { "type": { "kind": "base", "name": "unsigned int" }, "offset": 40 } }, "kind": "struct", "size": 40 }, "_SERVICE_HEADER": { "fields": { "Tag": { "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" }, "offset": 0 }, "ServiceRecord": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_RECORD" } }, "offset": 16 } }, "kind": "struct", "size": 16 }, "_SERVICE_RECORD": { "fields": { "ServiceList": { "type": { "kind": "struct", "name": "_SERVICE_LIST_ENTRY" }, "offset": 0 }, "Tag": { "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" }, "offset": 32 }, "DisplayName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 64 }, "ServiceProcess": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_PROCESS" } }, "offset": 232 }, "PrevEntry": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_RECORD" } }, "offset": 16 }, "Start": { "type": { "kind": "enum", "name": "StartEnum" }, "offset": 36 }, "State": { "type": { "kind": "enum", "name": "StateEnum" }, "offset": 76 }, "ServiceName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 56 }, "DriverName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 232 }, "Type": { "type": { "kind": "base", "name": "unsigned long" }, "offset": 72 }, "Order": { "type": { "kind": "base", "name": "unsigned int" }, "offset": 32 } }, "kind": "struct", "size": 232 } }, "metadata": { "producer": { "version": "0.0.1", "name": "vtypes_to_json.py", "datetime": "2019-04-17T13:45:16.417006" }, "format": "4.1.0" } }volatility3-1.0.1/volatility3/framework/symbols/windows/services-win10-16299-x86.json000066400000000000000000000164161405267600400302370ustar00rootroot00000000000000{ "symbols": {}, "enums": { "StateEnum": { "base": "long", "constants": { "SERVICE_START_PENDING": 2, "SERVICE_STOP_PENDING": 3, "SERVICE_STOPPED": 1, "SERVICE_CONTINUE_PENDING": 5, "SERVICE_PAUSE_PENDING": 6, "SERVICE_PAUSED": 7, "SERVICE_RUNNING": 4 }, "size": 4 }, "StartEnum": { "base": "long", "constants": { "SERVICE_DEMAND_START": 3, "SERVICE_AUTO_START": 2, "SERVICE_BOOT_START": 0, "SERVICE_DISABLED": 4, "SERVICE_SYSTEM_START": 1 }, "size": 4 } }, "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "user_types": { "_SERVICE_LIST_ENTRY": { "fields": { "Flink": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_LIST_ENTRY" } }, "offset": 4 }, "Blink": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_LIST_ENTRY" } }, "offset": 0 } }, "kind": "struct", "size": 8 }, "_SERVICE_PROCESS": { "fields": { "BinaryPath": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 12 }, "ProcessId": { "type": { "kind": "base", "name": "unsigned int" }, "offset": 20 } }, "kind": "struct", "size": 20 }, "_SERVICE_HEADER": { "fields": { "Tag": { "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" }, "offset": 0 }, "ServiceRecord": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_RECORD" } }, "offset": 12 } }, "kind": "struct", "size": 12 }, "_SERVICE_RECORD": { "fields": { "DisplayName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 48 }, "ServiceProcess": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_PROCESS" } }, "offset": 156 }, "PrevEntry": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_RECORD" } }, "offset": 12 }, "Start": { "type": { "kind": "enum", "name": "StartEnum" }, "offset": 24 }, "State": { "type": { "kind": "enum", "name": "StateEnum" }, "offset": 56 }, "ServiceName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 44 }, "Tag": { "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" }, "offset": 0 }, "DriverName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 156 }, "Type": { "type": { "kind": "base", "name": "unsigned long" }, "offset": 52 }, "Order": { "type": { "kind": "base", "name": "unsigned int" }, "offset": 20 } }, "kind": "struct", "size": 156 } }, "metadata": { "producer": { "version": "0.0.1", "name": "vtypes_to_json.py", "datetime": "2019-04-17T13:45:16.417006" }, "format": "4.1.0" } }volatility3-1.0.1/volatility3/framework/symbols/windows/services-win8-x64.json000066400000000000000000000167751405267600400275020ustar00rootroot00000000000000{ "symbols": {}, "enums": { "StateEnum": { "base": "long", "constants": { "SERVICE_START_PENDING": 2, "SERVICE_STOP_PENDING": 3, "SERVICE_STOPPED": 1, "SERVICE_CONTINUE_PENDING": 5, "SERVICE_PAUSE_PENDING": 6, "SERVICE_PAUSED": 7, "SERVICE_RUNNING": 4 }, "size": 4 }, "StartEnum": { "base": "long", "constants": { "SERVICE_DEMAND_START": 3, "SERVICE_AUTO_START": 2, "SERVICE_BOOT_START": 0, "SERVICE_DISABLED": 4, "SERVICE_SYSTEM_START": 1 }, "size": 4 } }, "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 8, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "user_types": { "_SERVICE_LIST_ENTRY": { "fields": { "Flink": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_LIST_ENTRY" } }, "offset": 16 }, "Blink": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_LIST_ENTRY" } }, "offset": 0 } }, "kind": "struct", "size": 16 }, "_SERVICE_PROCESS": { "fields": { "BinaryPath": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 24 }, "ProcessId": { "type": { "kind": "base", "name": "unsigned int" }, "offset": 32 } }, "kind": "struct", "size": 32 }, "_SERVICE_HEADER": { "fields": { "Tag": { "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" }, "offset": 0 }, "ServiceRecord": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_RECORD" } }, "offset": 16 } }, "kind": "struct", "size": 16 }, "_SERVICE_RECORD": { "fields": { "ServiceList": { "type": { "kind": "struct", "name": "_SERVICE_LIST_ENTRY" }, "offset": 0 }, "DisplayName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 24 }, "ServiceProcess": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_PROCESS" } }, "offset": 56 }, "ServiceName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 16 }, "PrevEntry": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_RECORD" } }, "offset": 8 }, "Start": { "type": { "kind": "enum", "name": "StartEnum" }, "offset": 92 }, "State": { "type": { "kind": "enum", "name": "StateEnum" }, "offset": 68 }, "Tag": { "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" }, "offset": 32 }, "DriverName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 56 }, "Type": { "type": { "kind": "base", "name": "unsigned long" }, "offset": 64 }, "Order": { "type": { "kind": "base", "name": "unsigned int" }, "offset": 32 } }, "kind": "struct", "size": 92 } }, "metadata": { "producer": { "version": "0.0.1", "name": "vtypes_to_json.py", "datetime": "2019-04-17T13:45:16.417006" }, "format": "4.1.0" } }volatility3-1.0.1/volatility3/framework/symbols/windows/services-win8-x86.json000066400000000000000000000164171405267600400274770ustar00rootroot00000000000000{ "symbols": {}, "enums": { "StateEnum": { "base": "long", "constants": { "SERVICE_START_PENDING": 2, "SERVICE_STOP_PENDING": 3, "SERVICE_STOPPED": 1, "SERVICE_CONTINUE_PENDING": 5, "SERVICE_PAUSE_PENDING": 6, "SERVICE_PAUSED": 7, "SERVICE_RUNNING": 4 }, "size": 4 }, "StartEnum": { "base": "long", "constants": { "SERVICE_DEMAND_START": 3, "SERVICE_AUTO_START": 2, "SERVICE_BOOT_START": 0, "SERVICE_DISABLED": 4, "SERVICE_SYSTEM_START": 1 }, "size": 4 } }, "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "user_types": { "_SERVICE_LIST_ENTRY": { "fields": { "Flink": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_LIST_ENTRY" } }, "offset": 4 }, "Blink": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_LIST_ENTRY" } }, "offset": 0 } }, "kind": "struct", "size": 8 }, "_SERVICE_PROCESS": { "fields": { "BinaryPath": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 12 }, "ProcessId": { "type": { "kind": "base", "name": "unsigned int" }, "offset": 16 } }, "kind": "struct", "size": 16 }, "_SERVICE_HEADER": { "fields": { "Tag": { "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" }, "offset": 0 }, "ServiceRecord": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_RECORD" } }, "offset": 12 } }, "kind": "struct", "size": 12 }, "_SERVICE_RECORD": { "fields": { "DisplayName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 12 }, "ServiceProcess": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_PROCESS" } }, "offset": 36 }, "ServiceName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 8 }, "PrevEntry": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_RECORD" } }, "offset": 4 }, "Start": { "type": { "kind": "enum", "name": "StartEnum" }, "offset": 68 }, "State": { "type": { "kind": "enum", "name": "StateEnum" }, "offset": 44 }, "Tag": { "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" }, "offset": 0 }, "DriverName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 36 }, "Type": { "type": { "kind": "base", "name": "unsigned long" }, "offset": 40 }, "Order": { "type": { "kind": "base", "name": "unsigned int" }, "offset": 16 } }, "kind": "struct", "size": 68 } }, "metadata": { "producer": { "version": "0.0.1", "name": "vtypes_to_json.py", "datetime": "2019-04-17T13:45:16.417006" }, "format": "4.1.0" } }volatility3-1.0.1/volatility3/framework/symbols/windows/services-xp-2003-x64.json000066400000000000000000000162461405267600400276170ustar00rootroot00000000000000{ "symbols": {}, "enums": { "StateEnum": { "base": "long", "constants": { "SERVICE_START_PENDING": 2, "SERVICE_STOP_PENDING": 3, "SERVICE_STOPPED": 1, "SERVICE_CONTINUE_PENDING": 5, "SERVICE_PAUSE_PENDING": 6, "SERVICE_PAUSED": 7, "SERVICE_RUNNING": 4 }, "size": 4 }, "StartEnum": { "base": "long", "constants": { "SERVICE_DEMAND_START": 3, "SERVICE_AUTO_START": 2, "SERVICE_BOOT_START": 0, "SERVICE_DISABLED": 4, "SERVICE_SYSTEM_START": 1 }, "size": 4 } }, "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 8, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "user_types": { "_SERVICE_LIST_ENTRY": { "fields": { "Flink": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_LIST_ENTRY" } }, "offset": 16 }, "Blink": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_LIST_ENTRY" } }, "offset": 0 } }, "kind": "struct", "size": 16 }, "_SERVICE_PROCESS": { "fields": { "BinaryPath": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 16 }, "ProcessId": { "type": { "kind": "base", "name": "unsigned int" }, "offset": 24 } }, "kind": "struct", "size": 24 }, "_SERVICE_HEADER": { "fields": { "Tag": { "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" }, "offset": 0 }, "ServiceRecord": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_RECORD" } }, "offset": 16 } }, "kind": "struct", "size": 16 }, "_SERVICE_RECORD": { "fields": { "ServiceList": { "type": { "kind": "struct", "name": "_SERVICE_LIST_ENTRY" }, "offset": 0 }, "Tag": { "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" }, "offset": 32 }, "DisplayName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 16 }, "ServiceProcess": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_PROCESS" } }, "offset": 48 }, "Start": { "type": { "kind": "enum", "name": "StartEnum" }, "offset": 84 }, "State": { "type": { "kind": "enum", "name": "StateEnum" }, "offset": 60 }, "ServiceName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 8 }, "DriverName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 48 }, "Type": { "type": { "kind": "base", "name": "unsigned long" }, "offset": 56 }, "Order": { "type": { "kind": "base", "name": "unsigned int" }, "offset": 24 } }, "kind": "struct", "size": 84 } }, "metadata": { "producer": { "version": "0.0.1", "name": "vtypes_to_json.py", "datetime": "2019-04-17T13:45:16.417006" }, "format": "4.1.0" } }volatility3-1.0.1/volatility3/framework/symbols/windows/services-xp-x86.json000066400000000000000000000161651405267600400272410ustar00rootroot00000000000000{ "symbols": {}, "enums": { "StateEnum": { "base": "long", "constants": { "SERVICE_START_PENDING": 2, "SERVICE_STOP_PENDING": 3, "SERVICE_STOPPED": 1, "SERVICE_CONTINUE_PENDING": 5, "SERVICE_PAUSE_PENDING": 6, "SERVICE_PAUSED": 7, "SERVICE_RUNNING": 4 }, "size": 4 }, "StartEnum": { "base": "long", "constants": { "SERVICE_DEMAND_START": 3, "SERVICE_AUTO_START": 2, "SERVICE_BOOT_START": 0, "SERVICE_DISABLED": 4, "SERVICE_SYSTEM_START": 1 }, "size": 4 } }, "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, "endian": "little" }, "pointer": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned int": { "kind": "int", "size": 4, "signed": false, "endian": "little" }, "unsigned short": { "kind": "int", "size": 2, "signed": false, "endian": "little" }, "long": { "kind": "int", "size": 4, "signed": false, "endian": "little" } }, "user_types": { "_SERVICE_LIST_ENTRY": { "fields": { "Flink": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_LIST_ENTRY" } }, "offset": 4 }, "Blink": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_LIST_ENTRY" } }, "offset": 0 } }, "kind": "struct", "size": 8 }, "_SERVICE_PROCESS": { "fields": { "BinaryPath": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 8 }, "ProcessId": { "type": { "kind": "base", "name": "unsigned int" }, "offset": 12 } }, "kind": "struct", "size": 12 }, "_SERVICE_HEADER": { "fields": { "Tag": { "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" }, "offset": 0 }, "ServiceRecord": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_RECORD" } }, "offset": 12 } }, "kind": "struct", "size": 12 }, "_SERVICE_RECORD": { "fields": { "ServiceList": { "type": { "kind": "struct", "name": "_SERVICE_LIST_ENTRY" }, "offset": 0 }, "Tag": { "type": { "count": 4, "subtype": { "kind": "base", "name": "unsigned char" }, "kind": "array" }, "offset": 24 }, "DisplayName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 12 }, "ServiceProcess": { "type": { "kind": "pointer", "subtype": { "kind": "struct", "name": "_SERVICE_PROCESS" } }, "offset": 36 }, "Start": { "type": { "kind": "enum", "name": "StartEnum" }, "offset": 68 }, "State": { "type": { "kind": "enum", "name": "StateEnum" }, "offset": 44 }, "ServiceName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 8 }, "DriverName": { "type": { "kind": "pointer", "subtype": { "kind": "base", "name": "unsigned short" } }, "offset": 36 }, "Type": { "type": { "kind": "base", "name": "unsigned long" }, "offset": 40 }, "Order": { "type": { "kind": "base", "name": "unsigned int" }, "offset": 16 } }, "kind": "struct", "size": 68 } }, "metadata": { "producer": { "version": "0.0.1", "name": "vtypes_to_json.py", "datetime": "2019-04-17T13:45:16.417006" }, "format": "4.1.0" } }volatility3-1.0.1/volatility3/framework/symbols/windows/versions.py000066400000000000000000000147101405267600400256670ustar00rootroot00000000000000import logging from typing import Callable, Tuple, List, Optional from volatility3.framework import interfaces, constants, exceptions vollog = logging.getLogger(__name__) class OsDistinguisher: """Distinguishes a symbol table as being above a particular version or point. This will primarily check the version metadata first and foremost. If that metadata isn't available then each item in the fallback_checks is tested. If invert is specified then the result will be true if the version is less than that specified, or in the case of fallback, if any of the fallback checks is successful. A fallback check is made up of: * a symbol or type name * a member name (implying that the value before was a type name) * whether that symbol, type or member must be present or absent for the symbol table to be more above the required point Note: Specifying that a member must not be present includes the whole type not being present too (ie, either will pass the test) Args: version_check: Function that takes a 4-tuple version and returns whether whether the provided version is above a particular point fallback_checks: A list of symbol/types/members of types, and whether they must be present to be above the required point Returns: A function that takes a context and a symbol table name and determines whether that symbol table passes the distinguishing checks """ def __init__(self, version_check: Callable[[Tuple[int, ...]], bool], fallback_checks: List[Tuple[str, Optional[str], bool]]) -> None: self._version_check = version_check self._fallback_checks = fallback_checks # try the primary method based on the pe version in the ISF def __call__(self, context: interfaces.context.ContextInterface, symbol_table: str) -> bool: """ Args: context: The context that contains the symbol table named `symbol_table` symbol_table: Name of the symbol table within the context to distinguish the version of Returns: True if the symbol table is of the required version """ try: pe_version = context.symbol_space[symbol_table].metadata.pe_version major, minor, revision, build = pe_version return self._version_check((major, minor, revision, build)) except (AttributeError, ValueError, TypeError): vollog.log(constants.LOGLEVEL_VVV, "Windows PE version data is not available") # fall back to the backup method, if necessary for name, member, response in self._fallback_checks: if member is None: if (context.symbol_space.has_symbol(symbol_table + constants.BANG + name) or context.symbol_space.has_type(symbol_table + constants.BANG + name)) != response: return False else: try: symbol_type = context.symbol_space.get_type(symbol_table + constants.BANG + name) if symbol_type.has_member(member) != response: return False except exceptions.SymbolError: if not response: return False return True is_windows_8_1_or_later = OsDistinguisher(version_check = lambda x: x >= (6, 3), fallback_checks = [("_KPRCB", "PendingTickFlags", True)]) is_vista_or_later = OsDistinguisher(version_check = lambda x: x >= (6, 0), fallback_checks = [("KdCopyDataBlock", None, True)]) is_win10 = OsDistinguisher(version_check = lambda x: (10, 0) <= x, fallback_checks = [("ObHeaderCookie", None, True), ("_HANDLE_TABLE", "HandleCount", False)]) is_windows_xp = OsDistinguisher(version_check = lambda x: (5, 1) <= x < (5, 2), fallback_checks = [("KdCopyDataBlock", None, False), ("_HANDLE_TABLE", "HandleCount", True)]) is_xp_or_2003 = OsDistinguisher(version_check = lambda x: (5, 1) <= x < (6, 0), fallback_checks = [("KdCopyDataBlock", None, False), ("_HANDLE_TABLE", "HandleCount", True)]) is_win10_up_to_15063 = OsDistinguisher(version_check = lambda x: (10, 0) <= x < (10, 0, 15063), fallback_checks = [("ObHeaderCookie", None, True), ("_HANDLE_TABLE", "HandleCount", False), ("_EPROCESS", "KeepAliveCounter", True)]) is_win10_15063 = OsDistinguisher(version_check = lambda x: x == (10, 0, 15063), fallback_checks = [("ObHeaderCookie", None, True), ("_HANDLE_TABLE", "HandleCount", False), ("_EPROCESS", "KeepAliveCounter", False), ("_EPROCESS", "ControlFlowGuardEnabled", True)]) is_win10_16299_or_later = OsDistinguisher(version_check = lambda x: x >= (10, 0, 16299), fallback_checks = [("ObHeaderCookie", None, True), ("_HANDLE_TABLE", "HandleCount", False), ("_EPROCESS", "KeepAliveCounter", False), ("_EPROCESS", "ControlFlowGuardEnabled", False)]) is_win10_18363_or_later = OsDistinguisher(version_check = lambda x: x >= (10, 0, 18363), fallback_checks = [("_KQOS_GROUPING_SETS", None, True)]) is_windows_10 = OsDistinguisher(version_check = lambda x: x >= (10, 0), fallback_checks = [("ObHeaderCookie", None, True)]) is_windows_8_or_later = OsDistinguisher(version_check = lambda x: x >= (6, 2), fallback_checks = [("_HANDLE_TABLE", "HandleCount", False)]) # Technically, this is win7 or less is_windows_7 = OsDistinguisher(version_check = lambda x: x == (6, 1), fallback_checks = [("_OBJECT_HEADER", "TypeIndex", True), ("_HANDLE_TABLE", "HandleCount", True)]) volatility3-1.0.1/volatility3/framework/symbols/wrappers.py000066400000000000000000000015111405267600400241630ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from typing import List, Mapping from volatility3.framework import interfaces class Flags: """Object that converts an integer into a set of flags based on their masks.""" def __init__(self, choices: Mapping[str, int]) -> None: self._choices = interfaces.objects.ReadOnlyMapping(choices) @property def choices(self) -> interfaces.objects.ReadOnlyMapping: return self._choices def __call__(self, value: int) -> List[str]: """Return the appropriate Flags.""" result = [] for k, v in self.choices.items(): if value & v: result.append(k) return result volatility3-1.0.1/volatility3/plugins/000077500000000000000000000000001405267600400177445ustar00rootroot00000000000000volatility3-1.0.1/volatility3/plugins/__init__.py000066400000000000000000000013651405267600400220620ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """Defines the plugin architecture. This is the namespace for all volatility plugins, and determines the path for loading plugins NOTE: This file is important for core plugins to run (which certain components such as the windows registry layers) are dependent upon, please DO NOT alter or remove this file unless you know the consequences of doing so. The framework is configured this way to allow plugin developers/users to override any plugin functionality whether existing or new. """ from volatility3.framework import constants __path__ = constants.PLUGINS_PATH volatility3-1.0.1/volatility3/plugins/linux/000077500000000000000000000000001405267600400211035ustar00rootroot00000000000000volatility3-1.0.1/volatility3/plugins/linux/__init__.py000066400000000000000000000017301405267600400232150ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """All Linux-related plugins. NOTE: This file is important for core plugins to run (which certain components such as the windows registry layers) are dependent upon, please DO NOT alter or remove this file unless you know the consequences of doing so. The framework is configured this way to allow plugin developers/users to override any plugin functionality whether existing or new. When overriding the plugins directory, you must include a file like this in any subdirectories that may be necessary. """ import os import sys # This is necessary to ensure the core plugins are available, whilst still be overridable parent_module, module_name = ".".join(__name__.split(".")[:-1]), __name__.split(".")[-1] __path__ = [os.path.join(x, module_name) for x in sys.modules[parent_module].__path__] volatility3-1.0.1/volatility3/plugins/mac/000077500000000000000000000000001405267600400205045ustar00rootroot00000000000000volatility3-1.0.1/volatility3/plugins/mac/__init__.py000066400000000000000000000017261405267600400226230ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """All Mac-related plugins. NOTE: This file is important for core plugins to run (which certain components such as the windows registry layers) are dependent upon, please DO NOT alter or remove this file unless you know the consequences of doing so. The framework is configured this way to allow plugin developers/users to override any plugin functionality whether existing or new. When overriding the plugins directory, you must include a file like this in any subdirectories that may be necessary. """ import os import sys # This is necessary to ensure the core plugins are available, whilst still be overridable parent_module, module_name = ".".join(__name__.split(".")[:-1]), __name__.split(".")[-1] __path__ = [os.path.join(x, module_name) for x in sys.modules[parent_module].__path__] volatility3-1.0.1/volatility3/plugins/windows/000077500000000000000000000000001405267600400214365ustar00rootroot00000000000000volatility3-1.0.1/volatility3/plugins/windows/__init__.py000066400000000000000000000017251405267600400235540ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """All Windows OS plugins. NOTE: This file is important for core plugins to run (which certain components such as the windows registry layers) are dependent upon, please DO NOT alter or remove this file unless you know the consequences of doing so. The framework is configured this way to allow plugin developers/users to override any plugin functionality whether existing or new. When overriding the plugins directory, you must include a file like this in any subdirectories that may be necessary. """ import os import sys # This is necessary to ensure the core plugins are available, whilst still be overridable parent_module, module_name = ".".join(__name__.split(".")[:-1]), __name__.split(".")[-1] __path__ = [os.path.join(x, module_name) for x in sys.modules[parent_module].__path__] volatility3-1.0.1/volatility3/plugins/windows/registry/000077500000000000000000000000001405267600400233065ustar00rootroot00000000000000volatility3-1.0.1/volatility3/plugins/windows/registry/__init__.py000066400000000000000000000017271405267600400254260ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """Windows registry plugins. NOTE: This file is important for core plugins to run (which certain components such as the windows registry layers) are dependent upon, please DO NOT alter or remove this file unless you know the consequences of doing so. The framework is configured this way to allow plugin developers/users to override any plugin functionality whether existing or new. When overriding the plugins directory, you must include a file like this in any subdirectories that may be necessary. """ import os import sys # This is necessary to ensure the core plugins are available, whilst still be overridable parent_module, module_name = ".".join(__name__.split(".")[:-1]), __name__.split(".")[-1] __path__ = [os.path.join(x, module_name) for x in sys.modules[parent_module].__path__] volatility3-1.0.1/volatility3/plugins/windows/registry/certificates.py000066400000000000000000000075131405267600400263330ustar00rootroot00000000000000import struct from typing import List, Iterator, Tuple from volatility3.framework import interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.symbols.windows.extensions.registry import RegValueTypes from volatility3.plugins.windows.registry import hivelist, printkey class Certificates(interfaces.plugins.PluginInterface): """Lists the certificates in the registry's Certificate Store.""" _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.PluginRequirement(name = 'hivelist', plugin = hivelist.HiveList, version = (1, 0, 0)), requirements.PluginRequirement(name = 'printkey', plugin = printkey.PrintKey, version = (1, 0, 0)) ] def parse_data(self, data: bytes) -> Tuple[str, bytes]: name = renderers.NotAvailableValue() certificate_data = renderers.NotAvailableValue() while len(data) > 12: ctype, clength = struct.unpack(" Iterator[Tuple[int, Tuple[str, str, str, str]]]: for hive in hivelist.HiveList.list_hives(self.context, base_config_path = self.config_path, layer_name = self.config['primary'], symbol_table = self.config['nt_symbols']): for top_key in [ "Microsoft\\SystemCertificates", "Software\\Microsoft\\SystemCertificates", ]: try: # Walk it node_path = hive.get_key(top_key, return_list = True) for (depth, is_key, last_write_time, key_path, volatility, node) in printkey.PrintKey.key_iterator(hive, node_path, recurse = True): if not is_key and RegValueTypes.get(node.Type).name == "REG_BINARY": name, certificate_data = self.parse_data(node.decode_data()) unique_key_offset = key_path.index(top_key) + len(top_key) + 1 reg_section = key_path[unique_key_offset:key_path.index("\\", unique_key_offset)] key_hash = key_path[key_path.rindex("\\") + 1:] if not isinstance(certificate_data, interfaces.renderers.BaseAbsentValue): with self.open("{} - {} - {}.crt".format(hex(hive.hive_offset), reg_section, key_hash)) as file_data: file_data.write(certificate_data) yield (0, (top_key, reg_section, key_hash, name)) except KeyError: # Key wasn't found in this hive, carry on pass def run(self) -> renderers.TreeGrid: return renderers.TreeGrid([("Certificate path", str), ("Certificate section", str), ("Certificate ID", str), ("Certificate name", str)], self._generator()) volatility3-1.0.1/volatility3/plugins/windows/statistics.py000066400000000000000000000066251405267600400242130ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from typing import List from volatility3.framework import renderers, exceptions, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.layers import intel vollog = logging.getLogger(__name__) class Statistics(plugins.PluginInterface): _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]) ] def _generator(self): # Do mass mapping and determine the number of different layers and how many pages go to each one layer = self.context.layers[self.config['primary']] page_count = swap_count = invalid_page_count = large_page_count = large_swap_count = large_invalid_count = other_invalid = 0 if isinstance(layer, intel.Intel): page_addr = 0 expected_page_size = 1 << layer.bits_per_register while page_addr < layer.maximum_address: try: _, _, _, page_size, layer_name = list(layer.mapping(page_addr, 2 * expected_page_size))[0] if layer_name != layer.config['memory_layer']: swap_count += 1 else: page_count += 1 if page_size > expected_page_size: large_page_count += 1 except exceptions.SwappedInvalidAddressException as excp: swap_count += 1 page_size = (1 << excp.invalid_bits) if page_size != expected_page_size: large_swap_count += 1 except exceptions.PagedInvalidAddressException as excp: invalid_page_count += 1 page_size = (1 << excp.invalid_bits) if page_size != expected_page_size: large_invalid_count += 1 except exceptions.InvalidAddressException as excp: other_invalid += 1 page_size = expected_page_size vollog.debug("A non-page lookup invalid address exception occurred at: {} in layer {}".format( hex(excp.invalid_address), excp.layer_name)) page_addr += page_size self._progress_callback((page_addr * 100) / layer.maximum_address, "Reading memory") yield (0, (page_count, large_page_count, swap_count, large_swap_count, invalid_page_count, large_invalid_count, other_invalid)) def run(self): return renderers.TreeGrid([("Valid pages (all)", int), ("Valid pages (large)", int), ("Swapped Pages (all)", int), ("Swapped Pages (large)", int), ("Invalid Pages (all)", int), ("Invalid Pages (large)", int), ("Other Invalid Pages (all)", int)], self._generator()) volatility3-1.0.1/volatility3/schemas/000077500000000000000000000000001405267600400177065ustar00rootroot00000000000000volatility3-1.0.1/volatility3/schemas/__init__.py000066400000000000000000000056211405267600400220230ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import hashlib import json import logging import os from typing import Set, Any, Dict from volatility3.framework import constants vollog = logging.getLogger(__name__) cached_validation_filepath = os.path.join(constants.CACHE_PATH, "valid_isf.hashcache") def load_cached_validations() -> Set[str]: """Loads up the list of successfully cached json objects, so we don't need to revalidate them.""" validhashes = set() # type: Set if os.path.exists(cached_validation_filepath): with open(cached_validation_filepath, "r") as f: validhashes.update(json.load(f)) return validhashes def record_cached_validations(validations: Set[str]) -> None: """Record the cached validations, so we don't need to revalidate them in future.""" with open(cached_validation_filepath, "w") as f: json.dump(list(validations), f) cached_validations = load_cached_validations() def validate(input: Dict[str, Any], use_cache: bool = True) -> bool: """Validates an input JSON file based upon.""" format = input.get('metadata', {}).get('format', None) if not format: vollog.debug("No schema format defined") return False basepath = os.path.abspath(os.path.dirname(__file__)) schema_path = os.path.join(basepath, 'schema-' + format + '.json') if not os.path.exists(schema_path): vollog.debug("Schema for format not found: {}".format(schema_path)) return False with open(schema_path, 'r') as s: schema = json.load(s) return valid(input, schema, use_cache) def create_json_hash(input: Dict[str, Any], schema: Dict[str, Any]) -> str: """Constructs the hash of the input and schema to create a unique indentifier for a particular JSON file.""" return hashlib.sha1(bytes(json.dumps((input, schema), sort_keys = True), 'utf-8')).hexdigest() def valid(input: Dict[str, Any], schema: Dict[str, Any], use_cache: bool = True) -> bool: """Validates a json schema.""" input_hash = create_json_hash(input, schema) if input_hash in cached_validations and use_cache: return True try: import jsonschema except ImportError: vollog.info("Dependency for validation unavailable: jsonschema") vollog.debug("All validations will report success, even with malformed input") return True try: vollog.debug("Validating JSON against schema...") jsonschema.validate(input, schema) cached_validations.add(input_hash) vollog.debug("JSON validated against schema (result cached)") except jsonschema.exceptions.SchemaError: vollog.debug("Schema validation error", exc_info = True) return False record_cached_validations(cached_validations) return True volatility3-1.0.1/volatility3/schemas/schema-0.1.0.json000066400000000000000000000141141405267600400224740ustar00rootroot00000000000000{ "$schema": "http://json-schema.org/schema#", "id": "http://volatilityfoundation.org/intermediate-format/schema", "title": "Symbol Container", "type": "object", "definitions": { "element_metadata": { "type": "object", "properties": { "format": { "type": "string", "pattern": "^0.[1-9]+.[0-9]+$" }, "source": { "type": "object", "properties": { "type": { "type": "string" } } }, "producer": { "type": "object", "properties": { "name": { "type": "string" }, "version": { "type": "string" }, "datetime": { "type": "string", "format": "date-time" } } } }, "required": [ "format" ], "additionalProperties": false }, "element_enum": { "properties": { "length": { "type": "integer" }, "base": { "type": "string" }, "constants": { "type": "object", "additionalProperties": { "type": "integer" } } }, "required": [ "length", "base", "constants" ], "additionalProperties": false }, "element_symbol": { "properties": { "address": { "type": "number" }, "linkage_name": { "type": "string" } }, "required": [ "address" ], "additionalProperties": false }, "element_base_type": { "properties": { "length": { "type": "integer" } }, "required": [ "length" ], "additionalProperties": false }, "element_user_type": { "properties": { "kind": { "type": "string", "pattern": "^(struct|union|class)$" }, "length": { "type": "integer" }, "fields": { "type": "object", "additionalProperties": { "$ref": "#/definitions/field" } } }, "required": [ "kind", "length", "fields" ], "additionalProperties": false }, "field": { "properties": { "type": { "$ref": "#/definitions/type_descriptor" }, "offset": { "type": "integer" } }, "required": [ "type", "offset" ], "additionalProperties": false }, "type_descriptor": { "oneOf": [ { "$ref": "#/definitions/type_pointer" }, { "$ref": "#/definitions/type_base" }, { "$ref": "#/definitions/type_array" }, { "$ref": "#/definitions/type_struct" }, { "$ref": "#/definitions/type_enum" }, { "$ref": "#/definitions/type_function" }, { "$ref": "#/definitions/type_bitfield" } ] }, "type_pointer": { "properties": { "kind": { "type": "string", "pattern": "^pointer$" }, "subtype": { "$ref": "#/definitions/type_descriptor" } }, "required": [ "kind", "subtype" ], "additionalProperties": false }, "type_base": { "properties": { "kind": { "type": "string", "pattern": "^base$" }, "name": { "type": "string" } }, "required": [ "kind", "name" ], "additionalProperties": false }, "type_array": { "properties": { "kind": { "type": "string", "pattern": "^array$" }, "subtype": { "$ref": "#/definitions/type_descriptor" }, "count": { "type": "integer" } }, "required": [ "kind", "subtype", "count" ], "additionalProperties": false }, "type_struct": { "properties": { "kind": { "type": "string", "pattern": "^(struct|class|union)$" }, "name": { "type": "string" } }, "required": [ "kind", "name" ], "additionalProperties": false }, "type_enum": { "properties": { "kind": { "type": "string", "pattern": "^enum$" }, "name": { "type": "string" } }, "required": [ "kind", "name" ], "additionalProperties": false }, "type_function": { "properties": { "kind": { "type": "string", "pattern": "^function$" } }, "required": [ "kind" ], "additionalProperties": false }, "type_bitfield": { "properties": { "kind": { "type": "string", "pattern": "^bitfield$" }, "bit_position": { "type": "integer" }, "bit_length": { "type": "integer" }, "type": { "$ref": "#/definitions/type_base" } }, "required": [ "kind", "bit_position", "bit_length", "type" ], "additionalProperties": false } }, "properties": { "metadata": { "$ref": "#/definitions/element_metadata" }, "base_types": { "additionalProperties": { "$ref": "#/definitions/element_base_type" } }, "user_types": { "additionalProperties": { "$ref": "#/definitions/element_user_type" } }, "enums": { "additionalProperties": { "$ref": "#/definitions/element_enum" } }, "symbols": { "additionalProperties": { "$ref": "#/definitions/element_symbol" } } }, "required": [ "metadata", "base_types", "user_types", "enums", "symbols" ], "additionalProperties": false } volatility3-1.0.1/volatility3/schemas/schema-2.0.0.json000066400000000000000000000141001405267600400224700ustar00rootroot00000000000000{ "$schema": "http://json-schema.org/schema#", "id": "http://volatilityfoundation.org/intermediate-format/schema", "title": "Symbol Container", "type": "object", "definitions": { "element_metadata": { "type": "object", "properties": { "format": { "type": "string", "pattern": "^2.[0-9]+.[0-9]+$" }, "source": { "type": "object", "properties": { "type": { "type": "string" } } }, "producer": { "type": "object", "properties": { "name": { "type": "string" }, "version": { "type": "string" }, "datetime": { "type": "string", "format": "date-time" } } } }, "required": [ "format" ], "additionalProperties": false }, "element_enum": { "properties": { "size": { "type": "integer" }, "base": { "type": "string" }, "constants": { "type": "object", "additionalProperties": { "type": "integer" } } }, "required": [ "size", "base", "constants" ], "additionalProperties": false }, "element_symbol": { "properties": { "address": { "type": "number" }, "linkage_name": { "type": "string" } }, "required": [ "address" ], "additionalProperties": false }, "element_base_type": { "properties": { "size": { "type": "integer" } }, "required": [ "size" ], "additionalProperties": false }, "element_user_type": { "properties": { "kind": { "type": "string", "pattern": "^(struct|union|class)$" }, "size": { "type": "integer" }, "fields": { "type": "object", "additionalProperties": { "$ref": "#/definitions/field" } } }, "required": [ "kind", "size", "fields" ], "additionalProperties": false }, "field": { "properties": { "type": { "$ref": "#/definitions/type_descriptor" }, "offset": { "type": "integer" } }, "required": [ "type", "offset" ], "additionalProperties": false }, "type_descriptor": { "oneOf": [ { "$ref": "#/definitions/type_pointer" }, { "$ref": "#/definitions/type_base" }, { "$ref": "#/definitions/type_array" }, { "$ref": "#/definitions/type_struct" }, { "$ref": "#/definitions/type_enum" }, { "$ref": "#/definitions/type_function" }, { "$ref": "#/definitions/type_bitfield" } ] }, "type_pointer": { "properties": { "kind": { "type": "string", "pattern": "^pointer$" }, "subtype": { "$ref": "#/definitions/type_descriptor" } }, "required": [ "kind", "subtype" ], "additionalProperties": false }, "type_base": { "properties": { "kind": { "type": "string", "pattern": "^base$" }, "name": { "type": "string" } }, "required": [ "kind", "name" ], "additionalProperties": false }, "type_array": { "properties": { "kind": { "type": "string", "pattern": "^array$" }, "subtype": { "$ref": "#/definitions/type_descriptor" }, "count": { "type": "integer" } }, "required": [ "kind", "subtype", "count" ], "additionalProperties": false }, "type_struct": { "properties": { "kind": { "type": "string", "pattern": "^(struct|class|union)$" }, "name": { "type": "string" } }, "required": [ "kind", "name" ], "additionalProperties": false }, "type_enum": { "properties": { "kind": { "type": "string", "pattern": "^enum$" }, "name": { "type": "string" } }, "required": [ "kind", "name" ], "additionalProperties": false }, "type_function": { "properties": { "kind": { "type": "string", "pattern": "^function$" } }, "required": [ "kind" ], "additionalProperties": false }, "type_bitfield": { "properties": { "kind": { "type": "string", "pattern": "^bitfield$" }, "bit_position": { "type": "integer" }, "bit_length": { "type": "integer" }, "type": { "$ref": "#/definitions/type_base" } }, "required": [ "kind", "bit_position", "bit_length", "type" ], "additionalProperties": false } }, "properties": { "metadata": { "$ref": "#/definitions/element_metadata" }, "base_types": { "additionalProperties": { "$ref": "#/definitions/element_base_type" } }, "user_types": { "additionalProperties": { "$ref": "#/definitions/element_user_type" } }, "enums": { "additionalProperties": { "$ref": "#/definitions/element_enum" } }, "symbols": { "additionalProperties": { "$ref": "#/definitions/element_symbol" } } }, "required": [ "metadata", "base_types", "user_types", "enums", "symbols" ], "additionalProperties": false } volatility3-1.0.1/volatility3/schemas/schema-2.1.0.json000066400000000000000000000144351405267600400225040ustar00rootroot00000000000000{ "$schema": "http://json-schema.org/schema#", "id": "http://volatilityfoundation.org/intermediate-format/schema", "title": "Symbol Container", "type": "object", "definitions": { "element_metadata": { "type": "object", "properties": { "format": { "type": "string", "pattern": "^2.[1-9]+.[0-9]+$" }, "source": { "type": "object", "properties": { "type": { "type": "string" } } }, "producer": { "type": "object", "properties": { "name": { "type": "string" }, "version": { "type": "string" }, "datetime": { "type": "string", "format": "date-time" } } } }, "required": [ "format" ], "additionalProperties": false }, "element_enum": { "properties": { "size": { "type": "integer" }, "base": { "type": "string" }, "constants": { "type": "object", "additionalProperties": { "type": "integer" } } }, "required": [ "size", "base", "constants" ], "additionalProperties": false }, "element_symbol": { "properties": { "address": { "type": "number" }, "linkage_name": { "type": "string" }, "type": { "$ref": "#/definitions/type_descriptor" } }, "required": [ "address" ], "additionalProperties": false }, "element_base_type": { "properties": { "size": { "type": "integer" } }, "required": [ "size" ], "additionalProperties": false }, "element_user_type": { "properties": { "kind": { "type": "string", "pattern": "^(struct|union|class)$" }, "size": { "type": "integer" }, "fields": { "type": "object", "additionalProperties": { "$ref": "#/definitions/field" } } }, "required": [ "kind", "size", "fields" ], "additionalProperties": false }, "field": { "properties": { "type": { "$ref": "#/definitions/type_descriptor" }, "offset": { "type": "integer" } }, "required": [ "type", "offset" ], "additionalProperties": false }, "type_descriptor": { "oneOf": [ { "$ref": "#/definitions/type_pointer" }, { "$ref": "#/definitions/type_base" }, { "$ref": "#/definitions/type_array" }, { "$ref": "#/definitions/type_struct" }, { "$ref": "#/definitions/type_enum" }, { "$ref": "#/definitions/type_function" }, { "$ref": "#/definitions/type_bitfield" } ] }, "type_pointer": { "properties": { "kind": { "type": "string", "pattern": "^pointer$" }, "subtype": { "$ref": "#/definitions/type_descriptor" } }, "required": [ "kind", "subtype" ], "additionalProperties": false }, "type_base": { "properties": { "kind": { "type": "string", "pattern": "^base$" }, "name": { "type": "string" } }, "required": [ "kind", "name" ], "additionalProperties": false }, "type_array": { "properties": { "kind": { "type": "string", "pattern": "^array$" }, "subtype": { "$ref": "#/definitions/type_descriptor" }, "count": { "type": "integer" } }, "required": [ "kind", "subtype", "count" ], "additionalProperties": false }, "type_struct": { "properties": { "kind": { "type": "string", "pattern": "^(struct|class|union)$" }, "name": { "type": "string" } }, "required": [ "kind", "name" ], "additionalProperties": false }, "type_enum": { "properties": { "kind": { "type": "string", "pattern": "^enum$" }, "name": { "type": "string" } }, "required": [ "kind", "name" ], "additionalProperties": false }, "type_function": { "properties": { "kind": { "type": "string", "pattern": "^function$" } }, "required": [ "kind" ], "additionalProperties": false }, "type_bitfield": { "properties": { "kind": { "type": "string", "pattern": "^bitfield$" }, "bit_position": { "type": "integer" }, "bit_length": { "type": "integer" }, "type": { "oneOf": [ { "$ref": "#/definitions/type_base" }, { "$ref": "#/definitions/type_enum" } ] } }, "required": [ "kind", "bit_position", "bit_length", "type" ], "additionalProperties": false } }, "properties": { "metadata": { "$ref": "#/definitions/element_metadata" }, "base_types": { "additionalProperties": { "$ref": "#/definitions/element_base_type" } }, "user_types": { "additionalProperties": { "$ref": "#/definitions/element_user_type" } }, "enums": { "additionalProperties": { "$ref": "#/definitions/element_enum" } }, "symbols": { "additionalProperties": { "$ref": "#/definitions/element_symbol" } } }, "required": [ "metadata", "base_types", "user_types", "enums", "symbols" ], "additionalProperties": false } volatility3-1.0.1/volatility3/schemas/schema-4.0.0.json000066400000000000000000000151321405267600400225000ustar00rootroot00000000000000{ "$schema": "http://json-schema.org/schema#", "id": "http://volatilityfoundation.org/intermediate-format/schema", "title": "Symbol Container", "type": "object", "definitions": { "element_metadata": { "type": "object", "properties": { "format": { "type": "string", "pattern": "^4.[0-9]+.[0-9]+$" }, "source": { "type": "object", "properties": { "type": { "type": "string" } } }, "producer": { "type": "object", "properties": { "name": { "type": "string" }, "version": { "type": "string" }, "datetime": { "type": "string", "format": "date-time" } } } }, "required": [ "format" ], "additionalProperties": false }, "element_enum": { "properties": { "size": { "type": "integer" }, "base": { "type": "string" }, "constants": { "type": "object", "additionalProperties": { "type": "integer" } } }, "required": [ "size", "base", "constants" ], "additionalProperties": false }, "element_symbol": { "properties": { "address": { "type": "number" }, "linkage_name": { "type": "string" }, "type": { "$ref": "#/definitions/type_descriptor" } }, "required": [ "address" ], "additionalProperties": false }, "element_base_type": { "properties": { "size": { "type": "integer" }, "signed": { "type": "boolean" }, "kind": { "type": "string", "pattern": "^(void|int|float|char|bool)$" }, "endian": { "type": "string", "pattern": "^(little|big)$" } }, "required": [ "size", "kind", "signed", "endian" ], "additionalProperties": false }, "element_user_type": { "properties": { "kind": { "type": "string", "pattern": "^(struct|union|class)$" }, "size": { "type": "integer" }, "fields": { "type": "object", "additionalProperties": { "$ref": "#/definitions/field" } } }, "required": [ "kind", "size", "fields" ], "additionalProperties": false }, "field": { "properties": { "type": { "$ref": "#/definitions/type_descriptor" }, "offset": { "type": "integer" } }, "required": [ "type", "offset" ], "additionalProperties": false }, "type_descriptor": { "oneOf": [ { "$ref": "#/definitions/type_pointer" }, { "$ref": "#/definitions/type_base" }, { "$ref": "#/definitions/type_array" }, { "$ref": "#/definitions/type_struct" }, { "$ref": "#/definitions/type_enum" }, { "$ref": "#/definitions/type_function" }, { "$ref": "#/definitions/type_bitfield" } ] }, "type_pointer": { "properties": { "kind": { "type": "string", "pattern": "^pointer$" }, "subtype": { "$ref": "#/definitions/type_descriptor" } }, "required": [ "kind", "subtype" ], "additionalProperties": false }, "type_base": { "properties": { "kind": { "type": "string", "pattern": "^base$" }, "name": { "type": "string" } }, "required": [ "kind", "name" ], "additionalProperties": false }, "type_array": { "properties": { "kind": { "type": "string", "pattern": "^array$" }, "subtype": { "$ref": "#/definitions/type_descriptor" }, "count": { "type": "integer" } }, "required": [ "kind", "subtype", "count" ], "additionalProperties": false }, "type_struct": { "properties": { "kind": { "type": "string", "pattern": "^(struct|class|union)$" }, "name": { "type": "string" } }, "required": [ "kind", "name" ], "additionalProperties": false }, "type_enum": { "properties": { "kind": { "type": "string", "pattern": "^enum$" }, "name": { "type": "string" } }, "required": [ "kind", "name" ], "additionalProperties": false }, "type_function": { "properties": { "kind": { "type": "string", "pattern": "^function$" } }, "required": [ "kind" ], "additionalProperties": false }, "type_bitfield": { "properties": { "kind": { "type": "string", "pattern": "^bitfield$" }, "bit_position": { "type": "integer" }, "bit_length": { "type": "integer" }, "type": { "oneOf": [ { "$ref": "#/definitions/type_base" }, { "$ref": "#/definitions/type_enum" } ] } }, "required": [ "kind", "bit_position", "bit_length", "type" ], "additionalProperties": false } }, "properties": { "metadata": { "$ref": "#/definitions/element_metadata" }, "base_types": { "additionalProperties": { "$ref": "#/definitions/element_base_type" } }, "user_types": { "additionalProperties": { "$ref": "#/definitions/element_user_type" } }, "enums": { "additionalProperties": { "$ref": "#/definitions/element_enum" } }, "symbols": { "additionalProperties": { "$ref": "#/definitions/element_symbol" } } }, "required": [ "metadata", "base_types", "user_types", "enums", "symbols" ], "additionalProperties": false } volatility3-1.0.1/volatility3/schemas/schema-4.1.0.json000066400000000000000000000154021405267600400225010ustar00rootroot00000000000000{ "$schema": "http://json-schema.org/schema#", "id": "http://volatilityfoundation.org/intermediate-format/schema", "title": "Symbol Container", "type": "object", "definitions": { "element_metadata": { "type": "object", "properties": { "format": { "type": "string", "pattern": "^4.[1-9]+.[0-9]+$" }, "source": { "type": "object", "properties": { "type": { "type": "string" } } }, "producer": { "type": "object", "properties": { "name": { "type": "string" }, "version": { "type": "string" }, "datetime": { "type": "string", "format": "date-time" } } } }, "required": [ "format" ], "additionalProperties": false }, "element_enum": { "properties": { "size": { "type": "integer" }, "base": { "type": "string" }, "constants": { "type": "object", "additionalProperties": { "type": "integer" } } }, "required": [ "size", "base", "constants" ], "additionalProperties": false }, "element_symbol": { "properties": { "address": { "type": "number" }, "linkage_name": { "type": "string" }, "type": { "$ref": "#/definitions/type_descriptor" }, "constant_data": { "type": "string", "media": { "binaryEncoding": "base64", "readOnly": true } } }, "required": [ "address" ], "additionalProperties": false }, "element_base_type": { "properties": { "size": { "type": "integer" }, "signed": { "type": "boolean" }, "kind": { "type": "string", "pattern": "^(void|int|float|char|bool)$" }, "endian": { "type": "string", "pattern": "^(little|big)$" } }, "required": [ "size", "kind", "signed", "endian" ], "additionalProperties": false }, "element_user_type": { "properties": { "kind": { "type": "string", "pattern": "^(struct|union|class)$" }, "size": { "type": "integer" }, "fields": { "type": "object", "additionalProperties": { "$ref": "#/definitions/field" } } }, "required": [ "kind", "size", "fields" ], "additionalProperties": false }, "field": { "properties": { "type": { "$ref": "#/definitions/type_descriptor" }, "offset": { "type": "integer" } }, "required": [ "type", "offset" ], "additionalProperties": false }, "type_descriptor": { "oneOf": [ { "$ref": "#/definitions/type_pointer" }, { "$ref": "#/definitions/type_base" }, { "$ref": "#/definitions/type_array" }, { "$ref": "#/definitions/type_struct" }, { "$ref": "#/definitions/type_enum" }, { "$ref": "#/definitions/type_function" }, { "$ref": "#/definitions/type_bitfield" } ] }, "type_pointer": { "properties": { "kind": { "type": "string", "pattern": "^pointer$" }, "subtype": { "$ref": "#/definitions/type_descriptor" } }, "required": [ "kind", "subtype" ], "additionalProperties": false }, "type_base": { "properties": { "kind": { "type": "string", "pattern": "^base$" }, "name": { "type": "string" } }, "required": [ "kind", "name" ], "additionalProperties": false }, "type_array": { "properties": { "kind": { "type": "string", "pattern": "^array$" }, "subtype": { "$ref": "#/definitions/type_descriptor" }, "count": { "type": "integer" } }, "required": [ "kind", "subtype", "count" ], "additionalProperties": false }, "type_struct": { "properties": { "kind": { "type": "string", "pattern": "^(struct|class|union)$" }, "name": { "type": "string" } }, "required": [ "kind", "name" ], "additionalProperties": false }, "type_enum": { "properties": { "kind": { "type": "string", "pattern": "^enum$" }, "name": { "type": "string" } }, "required": [ "kind", "name" ], "additionalProperties": false }, "type_function": { "properties": { "kind": { "type": "string", "pattern": "^function$" } }, "required": [ "kind" ], "additionalProperties": false }, "type_bitfield": { "properties": { "kind": { "type": "string", "pattern": "^bitfield$" }, "bit_position": { "type": "integer" }, "bit_length": { "type": "integer" }, "type": { "oneOf": [ { "$ref": "#/definitions/type_base" }, { "$ref": "#/definitions/type_enum" } ] } }, "required": [ "kind", "bit_position", "bit_length", "type" ], "additionalProperties": false } }, "properties": { "metadata": { "$ref": "#/definitions/element_metadata" }, "base_types": { "additionalProperties": { "$ref": "#/definitions/element_base_type" } }, "user_types": { "additionalProperties": { "$ref": "#/definitions/element_user_type" } }, "enums": { "additionalProperties": { "$ref": "#/definitions/element_enum" } }, "symbols": { "additionalProperties": { "$ref": "#/definitions/element_symbol" } } }, "required": [ "metadata", "base_types", "user_types", "enums", "symbols" ], "additionalProperties": false } volatility3-1.0.1/volatility3/schemas/schema-6.0.0.json000066400000000000000000000221401405267600400224770ustar00rootroot00000000000000{ "$schema": "http://json-schema.org/schema#", "id": "http://volatilityfoundation.org/intermediate-format/schema", "title": "Symbol Container", "type": "object", "definitions": { "metadata_producer": { "type": "object", "properties": { "name": { "type": "string" }, "version": { "type": "string" }, "datetime": { "type": "string", "format": "date-time" } } }, "metadata_windows_pe": { "type": "object", "properties": { "major": { "type": "integer" }, "minor": { "type": "integer" }, "revision": { "type": "integer" }, "build": { "type": "integer" } }, "additionalProperties": false, "required": [ "major", "minor", "revision" ] }, "metadata_windows_pdb": { "type": "object", "properties": { "GUID": { "type": "string" }, "age": { "type": "integer" }, "database": { "type": "string" }, "machine_type": { "type": "integer" } }, "additionalProperties": false, "required": [ "GUID", "age", "database", "machine_type" ] }, "metadata_windows": { "type": "object", "properties": { "pe": { "$ref": "#/definitions/metadata_windows_pe" }, "pdb": { "$ref": "#/definitions/metadata_windows_pdb" } }, "additionalProperties": false }, "metadata_linux": { "type": "object", "$comment": "Reserved for future use" }, "metadata_format": { "type": "string", "pattern": "^6.[0-9]+.[0-9]+$" }, "metadata_source": { "type": "object", "properties": { "type": { "type": "string" } } }, "element_metadata": { "type": "object", "oneOf": [ { "properties": { "format": { "$ref": "#/definitions/metadata_format" }, "producer": { "$ref": "#/definitions/metadata_producer" } }, "required": [ "format" ], "additionalProperties": false }, { "properties": { "format": { "$ref": "#/definitions/metadata_format" }, "producer": { "$ref": "#/definitions/metadata_producer" }, "windows": { "$ref": "#/definitions/metadata_windows" } }, "required": [ "format", "windows" ], "additionalProperties": false }, { "properties": { "format": { "$ref": "#/definitions/metadata_format" }, "producer": { "$ref": "#/definitions/metadata_producer" }, "linux": { "$ref": "#/definitions/metadata_linux" } }, "required": [ "format", "linux" ], "additionalProperties": false } ] }, "element_enum": { "properties": { "size": { "type": "integer" }, "base": { "type": "string" }, "constants": { "type": "object", "additionalProperties": { "type": "integer" } } }, "required": [ "size", "base", "constants" ], "additionalProperties": false }, "element_symbol": { "properties": { "address": { "type": "number" }, "linkage_name": { "type": "string" }, "type": { "$ref": "#/definitions/type_descriptor" }, "constant_data": { "type": "string", "media": { "binaryEncoding": "base64", "readOnly": true } } }, "required": [ "address" ], "additionalProperties": false }, "element_base_type": { "properties": { "size": { "type": "integer" }, "signed": { "type": "boolean" }, "kind": { "type": "string", "pattern": "^(void|int|float|char|bool)$" }, "endian": { "type": "string", "pattern": "^(little|big)$" } }, "required": [ "size", "kind", "signed", "endian" ], "additionalProperties": false }, "element_user_type": { "properties": { "kind": { "type": "string", "pattern": "^(struct|union|class)$" }, "size": { "type": "integer" }, "fields": { "type": "object", "additionalProperties": { "$ref": "#/definitions/field" } } }, "required": [ "kind", "size", "fields" ], "additionalProperties": false }, "field": { "properties": { "type": { "$ref": "#/definitions/type_descriptor" }, "offset": { "type": "integer" } }, "required": [ "type", "offset" ], "additionalProperties": false }, "type_descriptor": { "oneOf": [ { "$ref": "#/definitions/type_pointer" }, { "$ref": "#/definitions/type_base" }, { "$ref": "#/definitions/type_array" }, { "$ref": "#/definitions/type_struct" }, { "$ref": "#/definitions/type_enum" }, { "$ref": "#/definitions/type_function" }, { "$ref": "#/definitions/type_bitfield" } ] }, "type_pointer": { "properties": { "kind": { "type": "string", "pattern": "^pointer$" }, "subtype": { "$ref": "#/definitions/type_descriptor" } }, "required": [ "kind", "subtype" ], "additionalProperties": false }, "type_base": { "properties": { "kind": { "type": "string", "pattern": "^base$" }, "name": { "type": "string" } }, "required": [ "kind", "name" ], "additionalProperties": false }, "type_array": { "properties": { "kind": { "type": "string", "pattern": "^array$" }, "subtype": { "$ref": "#/definitions/type_descriptor" }, "count": { "type": "integer" } }, "required": [ "kind", "subtype", "count" ], "additionalProperties": false }, "type_struct": { "properties": { "kind": { "type": "string", "pattern": "^(struct|class|union)$" }, "name": { "type": "string" } }, "required": [ "kind", "name" ], "additionalProperties": false }, "type_enum": { "properties": { "kind": { "type": "string", "pattern": "^enum$" }, "name": { "type": "string" } }, "required": [ "kind", "name" ], "additionalProperties": false }, "type_function": { "properties": { "kind": { "type": "string", "pattern": "^function$" } }, "required": [ "kind" ], "additionalProperties": false }, "type_bitfield": { "properties": { "kind": { "type": "string", "pattern": "^bitfield$" }, "bit_position": { "type": "integer" }, "bit_length": { "type": "integer" }, "type": { "oneOf": [ { "$ref": "#/definitions/type_base" }, { "$ref": "#/definitions/type_enum" } ] } }, "required": [ "kind", "bit_position", "bit_length", "type" ], "additionalProperties": false } }, "properties": { "metadata": { "$ref": "#/definitions/element_metadata" }, "base_types": { "additionalProperties": { "$ref": "#/definitions/element_base_type" } }, "user_types": { "additionalProperties": { "$ref": "#/definitions/element_user_type" } }, "enums": { "additionalProperties": { "$ref": "#/definitions/element_enum" } }, "symbols": { "additionalProperties": { "$ref": "#/definitions/element_symbol" } } }, "required": [ "metadata", "base_types", "user_types", "enums", "symbols" ], "additionalProperties": false } volatility3-1.0.1/volatility3/schemas/schema-6.1.0.json000066400000000000000000000222301405267600400225000ustar00rootroot00000000000000{ "$schema": "http://json-schema.org/schema#", "id": "http://volatilityfoundation.org/intermediate-format/schema", "title": "Symbol Container", "type": "object", "definitions": { "metadata_producer": { "type": "object", "properties": { "name": { "type": "string" }, "version": { "type": "string" }, "datetime": { "type": "string", "format": "date-time" } } }, "metadata_windows_pe": { "type": "object", "properties": { "major": { "type": "integer" }, "minor": { "type": "integer" }, "revision": { "type": "integer" }, "build": { "type": "integer" } }, "additionalProperties": false, "required": [ "major", "minor", "revision" ] }, "metadata_windows_pdb": { "type": "object", "properties": { "GUID": { "type": "string" }, "age": { "type": "integer" }, "database": { "type": "string" }, "machine_type": { "type": "integer" } }, "additionalProperties": false, "required": [ "GUID", "age", "database", "machine_type" ] }, "metadata_windows": { "type": "object", "properties": { "pe": { "$ref": "#/definitions/metadata_windows_pe" }, "pdb": { "$ref": "#/definitions/metadata_windows_pdb" } }, "additionalProperties": false }, "metadata_linux": { "type": "object", "$comment": "Reserved for future use" }, "metadata_format": { "type": "string", "pattern": "^6.[0-9]+.[0-9]+$" }, "metadata_source": { "type": "object", "properties": { "type": { "type": "string" } } }, "element_metadata": { "type": "object", "oneOf": [ { "properties": { "format": { "$ref": "#/definitions/metadata_format" }, "producer": { "$ref": "#/definitions/metadata_producer" } }, "required": [ "format" ], "additionalProperties": false }, { "properties": { "format": { "$ref": "#/definitions/metadata_format" }, "producer": { "$ref": "#/definitions/metadata_producer" }, "windows": { "$ref": "#/definitions/metadata_windows" } }, "required": [ "format", "windows" ], "additionalProperties": false }, { "properties": { "format": { "$ref": "#/definitions/metadata_format" }, "producer": { "$ref": "#/definitions/metadata_producer" }, "linux": { "$ref": "#/definitions/metadata_linux" } }, "required": [ "format", "linux" ], "additionalProperties": false } ] }, "element_enum": { "properties": { "size": { "type": "integer" }, "base": { "type": "string" }, "constants": { "type": "object", "additionalProperties": { "type": "integer" } } }, "required": [ "size", "base", "constants" ], "additionalProperties": false }, "element_symbol": { "properties": { "address": { "type": "number" }, "linkage_name": { "type": "string" }, "type": { "$ref": "#/definitions/type_descriptor" }, "constant_data": { "type": "string", "media": { "binaryEncoding": "base64", "readOnly": true } } }, "required": [ "address" ], "additionalProperties": false }, "element_base_type": { "properties": { "size": { "type": "integer" }, "signed": { "type": "boolean" }, "kind": { "type": "string", "pattern": "^(void|int|float|char|bool)$" }, "endian": { "type": "string", "pattern": "^(little|big)$" } }, "required": [ "size", "kind", "signed", "endian" ], "additionalProperties": false }, "element_user_type": { "properties": { "kind": { "type": "string", "pattern": "^(struct|union|class)$" }, "size": { "type": "integer" }, "fields": { "type": "object", "additionalProperties": { "$ref": "#/definitions/field" } } }, "required": [ "kind", "size", "fields" ], "additionalProperties": false }, "field": { "properties": { "type": { "$ref": "#/definitions/type_descriptor" }, "offset": { "type": "integer" } }, "required": [ "type", "offset" ], "additionalProperties": false }, "type_descriptor": { "oneOf": [ { "$ref": "#/definitions/type_pointer" }, { "$ref": "#/definitions/type_base" }, { "$ref": "#/definitions/type_array" }, { "$ref": "#/definitions/type_struct" }, { "$ref": "#/definitions/type_enum" }, { "$ref": "#/definitions/type_function" }, { "$ref": "#/definitions/type_bitfield" } ] }, "type_pointer": { "properties": { "kind": { "type": "string", "pattern": "^pointer$" }, "base": { "type": "string" }, "subtype": { "$ref": "#/definitions/type_descriptor" } }, "required": [ "kind", "subtype" ], "additionalProperties": false }, "type_base": { "properties": { "kind": { "type": "string", "pattern": "^base$" }, "name": { "type": "string" } }, "required": [ "kind", "name" ], "additionalProperties": false }, "type_array": { "properties": { "kind": { "type": "string", "pattern": "^array$" }, "subtype": { "$ref": "#/definitions/type_descriptor" }, "count": { "type": "integer" } }, "required": [ "kind", "subtype", "count" ], "additionalProperties": false }, "type_struct": { "properties": { "kind": { "type": "string", "pattern": "^(struct|class|union)$" }, "name": { "type": "string" } }, "required": [ "kind", "name" ], "additionalProperties": false }, "type_enum": { "properties": { "kind": { "type": "string", "pattern": "^enum$" }, "name": { "type": "string" } }, "required": [ "kind", "name" ], "additionalProperties": false }, "type_function": { "properties": { "kind": { "type": "string", "pattern": "^function$" } }, "required": [ "kind" ], "additionalProperties": false }, "type_bitfield": { "properties": { "kind": { "type": "string", "pattern": "^bitfield$" }, "bit_position": { "type": "integer" }, "bit_length": { "type": "integer" }, "type": { "oneOf": [ { "$ref": "#/definitions/type_base" }, { "$ref": "#/definitions/type_enum" } ] } }, "required": [ "kind", "bit_position", "bit_length", "type" ], "additionalProperties": false } }, "properties": { "metadata": { "$ref": "#/definitions/element_metadata" }, "base_types": { "additionalProperties": { "$ref": "#/definitions/element_base_type" } }, "user_types": { "additionalProperties": { "$ref": "#/definitions/element_user_type" } }, "enums": { "additionalProperties": { "$ref": "#/definitions/element_enum" } }, "symbols": { "additionalProperties": { "$ref": "#/definitions/element_symbol" } } }, "required": [ "metadata", "base_types", "user_types", "enums", "symbols" ], "additionalProperties": false } volatility3-1.0.1/volatility3/schemas/schema-6.2.0.json000066400000000000000000000244471405267600400225150ustar00rootroot00000000000000{ "$schema": "http://json-schema.org/schema#", "id": "http://volatilityfoundation.org/intermediate-format/schema", "title": "Symbol Container", "type": "object", "definitions": { "metadata_producer": { "type": "object", "properties": { "name": { "type": "string" }, "version": { "type": "string" }, "datetime": { "type": "string", "format": "date-time" } } }, "metadata_windows_pe": { "type": "object", "properties": { "major": { "type": "integer" }, "minor": { "type": "integer" }, "revision": { "type": "integer" }, "build": { "type": "integer" } }, "additionalProperties": false, "required": [ "major", "minor", "revision" ] }, "metadata_windows_pdb": { "type": "object", "properties": { "GUID": { "type": "string" }, "age": { "type": "integer" }, "database": { "type": "string" }, "machine_type": { "type": "integer" } }, "additionalProperties": false, "required": [ "GUID", "age", "database", "machine_type" ] }, "metadata_windows": { "type": "object", "properties": { "pe": { "$ref": "#/definitions/metadata_windows_pe" }, "pdb": { "$ref": "#/definitions/metadata_windows_pdb" } }, "additionalProperties": false }, "metadata_nix": { "type": "object", "properties": { "symbols": { "type": "array", "items": { "$ref": "#/definitions/metadata_nix_item" } }, "types": { "type": "array", "items": { "$ref": "#/definitions/metadata_nix_item" } } }, "additionalProperties": false }, "metadata_format": { "type": "string", "pattern": "^6.[0-9]+.[0-9]+$" }, "metadata_nix_item": { "type": "object", "properties": { "kind": { "type": "string", "pattern": "^(dwarf|symtab|system-map)$" }, "name": { "type": "string" }, "hash_type": { "type": "string", "pattern": "^(sha256)$" }, "hash_value": { "type": "string", "pattern": "^[a-fA-F0-9]+$" } }, "additionalProperties": false }, "element_metadata": { "type": "object", "oneOf": [ { "properties": { "format": { "$ref": "#/definitions/metadata_format" }, "producer": { "$ref": "#/definitions/metadata_producer" } }, "required": [ "format" ], "additionalProperties": false }, { "properties": { "format": { "$ref": "#/definitions/metadata_format" }, "producer": { "$ref": "#/definitions/metadata_producer" }, "windows": { "$ref": "#/definitions/metadata_windows" } }, "required": [ "format", "windows" ], "additionalProperties": false }, { "properties": { "format": { "$ref": "#/definitions/metadata_format" }, "producer": { "$ref": "#/definitions/metadata_producer" }, "linux": { "$ref": "#/definitions/metadata_nix" } }, "required": [ "format", "linux" ], "additionalProperties": false }, { "properties": { "format": { "$ref": "#/definitions/metadata_format" }, "producer": { "$ref": "#/definitions/metadata_producer" }, "mac": { "$ref": "#/definitions/metadata_nix" } }, "required": [ "format", "mac" ], "additionalProperties": false } ] }, "element_enum": { "properties": { "size": { "type": "integer" }, "base": { "type": "string" }, "constants": { "type": "object", "additionalProperties": { "type": "integer" } } }, "required": [ "size", "base", "constants" ], "additionalProperties": false }, "element_symbol": { "properties": { "address": { "type": "number" }, "linkage_name": { "type": "string" }, "type": { "$ref": "#/definitions/type_descriptor" }, "constant_data": { "type": "string", "media": { "binaryEncoding": "base64", "readOnly": true } } }, "required": [ "address" ], "additionalProperties": false }, "element_base_type": { "properties": { "size": { "type": "integer" }, "signed": { "type": "boolean" }, "kind": { "type": "string", "pattern": "^(void|int|float|char|bool)$" }, "endian": { "type": "string", "pattern": "^(little|big)$" } }, "required": [ "size", "kind", "signed", "endian" ], "additionalProperties": false }, "element_user_type": { "properties": { "kind": { "type": "string", "pattern": "^(struct|union|class)$" }, "size": { "type": "integer" }, "fields": { "type": "object", "additionalProperties": { "$ref": "#/definitions/field" } } }, "required": [ "kind", "size", "fields" ], "additionalProperties": false }, "field": { "properties": { "type": { "$ref": "#/definitions/type_descriptor" }, "offset": { "type": "integer" }, "anonymous": { "type": "boolean" } }, "required": [ "type", "offset" ], "additionalProperties": false }, "type_descriptor": { "oneOf": [ { "$ref": "#/definitions/type_pointer" }, { "$ref": "#/definitions/type_base" }, { "$ref": "#/definitions/type_array" }, { "$ref": "#/definitions/type_struct" }, { "$ref": "#/definitions/type_enum" }, { "$ref": "#/definitions/type_function" }, { "$ref": "#/definitions/type_bitfield" } ] }, "type_pointer": { "properties": { "kind": { "type": "string", "pattern": "^pointer$" }, "base": { "type": "string" }, "subtype": { "$ref": "#/definitions/type_descriptor" } }, "required": [ "kind", "subtype" ], "additionalProperties": false }, "type_base": { "properties": { "kind": { "type": "string", "pattern": "^base$" }, "name": { "type": "string" } }, "required": [ "kind", "name" ], "additionalProperties": false }, "type_array": { "properties": { "kind": { "type": "string", "pattern": "^array$" }, "subtype": { "$ref": "#/definitions/type_descriptor" }, "count": { "type": "integer" } }, "required": [ "kind", "subtype", "count" ], "additionalProperties": false }, "type_struct": { "properties": { "kind": { "type": "string", "pattern": "^(struct|class|union)$" }, "name": { "type": "string" } }, "required": [ "kind", "name" ], "additionalProperties": false }, "type_enum": { "properties": { "kind": { "type": "string", "pattern": "^enum$" }, "name": { "type": "string" } }, "required": [ "kind", "name" ], "additionalProperties": false }, "type_function": { "properties": { "kind": { "type": "string", "pattern": "^function$" } }, "required": [ "kind" ], "additionalProperties": false }, "type_bitfield": { "properties": { "kind": { "type": "string", "pattern": "^bitfield$" }, "bit_position": { "type": "integer" }, "bit_length": { "type": "integer" }, "type": { "oneOf": [ { "$ref": "#/definitions/type_base" }, { "$ref": "#/definitions/type_enum" } ] } }, "required": [ "kind", "bit_position", "bit_length", "type" ], "additionalProperties": false } }, "properties": { "metadata": { "$ref": "#/definitions/element_metadata" }, "base_types": { "additionalProperties": { "$ref": "#/definitions/element_base_type" } }, "user_types": { "additionalProperties": { "$ref": "#/definitions/element_user_type" } }, "enums": { "additionalProperties": { "$ref": "#/definitions/element_enum" } }, "symbols": { "additionalProperties": { "$ref": "#/definitions/element_symbol" } } }, "required": [ "metadata", "base_types", "user_types", "enums", "symbols" ], "additionalProperties": false } volatility3-1.0.1/volatility3/symbols/000077500000000000000000000000001405267600400177535ustar00rootroot00000000000000volatility3-1.0.1/volatility3/symbols/__init__.py000066400000000000000000000006371405267600400220720ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """Defines the symbols architecture. This is the namespace for all volatility symbols, and determines the path for loading symbol ISF files """ from volatility3.framework import constants __path__ = constants.SYMBOL_BASEPATHS volatility3-1.0.1/volshell.py000066400000000000000000000004511405267600400162020ustar00rootroot00000000000000#!/usr/bin/env python3 # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from volatility3.cli import volshell if __name__ == '__main__': volshell.main() volatility3-1.0.1/volshell.spec000066400000000000000000000056231405267600400165120ustar00rootroot00000000000000# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import os import sys from PyInstaller.building.api import PYZ, EXE from PyInstaller.building.build_main import Analysis from PyInstaller.utils.hooks import collect_submodules, collect_data_files, collect_dynamic_libs block_cipher = None # NOTE: Issues with default pyinstaller build: # jsonschema: # - https://github.com/pyinstaller/pyinstaller/issues/4100 # - https://github.com/pyinstaller/pyinstaller/pull/4168 binaries = [] try: import capstone binaries = collect_dynamic_libs('capstone') except ImportError: pass # Volatility must be findable in sys.path in order for collect_submodules to work # This adds the current working directory, which should usually do the trick sys.path.append(os.getcwd()) vol_analysis = Analysis(['volshell.py'], pathex = [], binaries = binaries, datas = collect_data_files('volatility3.framework') + \ collect_data_files('volatility3.framework.automagic', include_py_files = True) + \ collect_data_files('volatility3.framework.plugins', include_py_files = True) + \ collect_data_files('volatility3.framework.layers', include_py_files = True) + \ collect_data_files('volatility3.cli', include_py_files = True) + \ collect_data_files('volatility3.schemas') + \ collect_data_files('volatility3.plugins', include_py_files = True), hiddenimports = collect_submodules('volatility3.framework.automagic') + \ collect_submodules('volatility3.framework.plugins') + \ collect_submodules('volatility3.framework.symbols'), hookspath = [], runtime_hooks = [], excludes = [], win_no_prefer_redirects = False, win_private_assemblies = False, cipher = block_cipher, noarchive = False) vol_pyz = PYZ(vol_analysis.pure, vol_analysis.zipped_data, cipher = block_cipher) vol_exe = EXE(vol_pyz, vol_analysis.scripts, vol_analysis.binaries, vol_analysis.zipfiles, vol_analysis.datas, [('u', None, 'OPTION')], name = 'volshell', icon = os.path.join('doc', 'source', '_static', 'favicon.ico'), debug = False, bootloader_ignore_signals = False, strip = False, upx = True, runtime_tmpdir = None, console = True)