8:24 p.m.
Hiya guys,
A slightly bigger and more complex one this time round. This is the
next module I've attempted to convert into a plugin. It seems a bit
fiddly, because you've got to jump around in memory looking for the
right spot (depending on the sys file that created it), so the error
checking on it could probably do with some improvements, but hopefully
the object model will automatically detect and mark as None any invalid
addresses we might ask for.
Again, any comments or criticisms would be gratefully received, I'm not
sure if I'm allowed to just invent type names like I've done for the
table pointers, and I'd also like to know whether the result of a
calculation can contain types, or whether I should be putting the data
into dicts/lists?
I'm also wondering what could be done about the plugin namespace,
because at the moment, there's no way of extending another plugin from a
different module (because relative addressing only works within a python
module, and we haven't been adding __init__.py files to the
memory_plugins directory). Is there a good way of inheriting from a
plugin, or should we just be putting the main functionality under
forensics.win32 and then make the plugins as empty as possible?
The *scan/scan2 functions look like they'll be trickier to convert, if
anyone with a good understanding of the NewObject model would like to
have a go at converting one of them, it'd help me a lot as a template to
get the others converted. If not, I'll have to wing it... 5;P
Mike 5:)
diff --git a/Volatility/forensics/object2.py b/Volatility/forensics/object2.py
index 29552d8..f4f9181 100644
--- a/Volatility/forensics/object2.py
+++ b/Volatility/forensics/object2.py
@@ -99,6 +99,9 @@ class NoneObject(object):
def __iter__(self):
return self
+ def __len__(self):
+ return 0
+
def next(self):
raise StopIteration()
@@ -588,8 +591,14 @@ class Profile:
system. We parse the abstract_types and join them with
native_types to make everything work together.
"""
- def __init__(self, native_types=x86_native_types, abstract_types=types,
- overlay=xpsp2overlays, strict=False):
+ def __init__(self, native_types=None, abstract_types=None,
+ overlay=None, strict=False):
+ if native_types is None:
+ native_types = x86_native_types
+ if abstract_types is None:
+ abstract_types = types
+ if overlay is None:
+ overlay = xpsp2overlays
self.types = {}
self.strict = strict
diff --git a/Volatility/forensics/win32/network.py
b/Volatility/forensics/win32/network.py
index 5ee84d6..b4598dd 100644
--- a/Volatility/forensics/win32/network.py
+++ b/Volatility/forensics/win32/network.py
@@ -29,6 +29,8 @@
#pylint: disable-msg=C0111
import struct
+import forensics.win32 as win32
+import forensics.object2 as object2
from forensics.object import read_value, read_obj, get_obj_offset
from forensics.win32.datetime import read_time, windows_to_unix_time
from forensics.win32.modules import module_find_baseaddr, modules_list
@@ -60,10 +62,10 @@ module_versions = { \
'AddrObjTableSizeOffset' : [0x48664], \
},
'3394': {
- 'TCBTableOff': [0x49768], \
- 'SizeOff': [0x3F73C], \
- 'AddrObjTableOffset': [0x486E0], \
- 'AddrObjTableSizeOffset': [0x486E4], \
+ 'TCBTableOff': [0x49768], \
+ 'SizeOff': [0x3F73C], \
+ 'AddrObjTableOffset': [0x486E0], \
+ 'AddrObjTableSizeOffset': [0x486E4], \
},
'5625' : { \
'TCBTableOff' : [0x49ae8], \
@@ -80,6 +82,35 @@ module_versions = { \
}
+def determine_connections(addr_space, profile):
+ """Determines all connections for each module"""
+ all_modules = win32.modules.lsmod(addr_space, profile)
+
+ profile.add_types({'_TCPT_OBJECT_POINTER': [0x4,
+ {'Pointer': [0x0,
['pointer', ['_TCPT_OBJECT']]]}
+ ]})
+
+ connections = []
+
+ for m in all_modules:
+ if str(m.ModuleName).lower() == 'tcpip.sys':
+ for attempt in module_versions:
+ table_size = object2.NewObject("unsigned long", m.BaseAddress +
module_versions[attempt]['SizeOff'][0], addr_space, profile=profile)
+ table_addr = object2.NewObject("unsigned long", m.BaseAddress +
module_versions[attempt]['TCBTableOff'][0], addr_space, profile=profile)
+ if int(table_size) > 0:
+ table = object2.Array('Array', table_addr, addr_space,
count=table_size, profile=profile,
+ target=object2.Curry(object2.NewObject,
'_TCPT_OBJECT_POINTER'))
+ for entry in table:
+ if entry is None:
+ break
+ conn = entry.Pointer.dereference()
+ while conn.is_valid():
+ connections.append(conn)
+ conn = conn.Next
+ return connections
+
+ return object2.NoneObject("Unable to determine connections")
+
def tcb_connections(addr_space, types, symbol_table):
all_modules = modules_list(addr_space, types, symbol_table)
base_addr = module_find_baseaddr(addr_space, types, all_modules,"tcpip")
diff --git a/Volatility/memory_plugins/internal/connections.py
b/Volatility/memory_plugins/internal/connections.py
new file mode 100644
index 0000000..91a1fff
--- /dev/null
+++ b/Volatility/memory_plugins/internal/connections.py
@@ -0,0 +1,40 @@
+'''
+Created on 25 Sep 2009
+
+@author: Mike Auty
+'''
+
+#pylint: disable-msg=C0111
+
+import forensics.commands
+import forensics.win32 as win32
+import forensics.object2 as object2
+import forensics.utils as utils
+
+class connections(forensics.commands.command):
+ """Print list of open connections"""
+
+ def __init__(self, args=None):
+ forensics.commands.command.__init__(self, args)
+ self.profile = None
+
+ def render_text(self, outfd, data):
+ if len(data):
+ outfd.write("%-25s %-25s %-6s\n" % ('Local Address',
'Remote Address', 'Pid'))
+
+ for conn in data:
+ local = "%s:%s" % (conn.LocalIpAddress, conn.LocalPort)
+ remote = "%s:%s" % (conn.RemoteIpAddress, conn.RemotePort)
+ outfd.write("%-25s %-25s %-6d\n" % (local, remote, conn.Pid))
+
+
+ def calculate(self):
+ result = {}
+ self.profile = object2.Profile()
+
+ addr_space = utils.load_as(self.opts)
+
+ # Get the Image Datetime
+ result = win32.network.determine_connections(addr_space, self.profile)
+
+ return result
\ No newline at end of file
diff --git a/Volatility/vmodules.py b/Volatility/vmodules.py
index ec642f8..46bef38 100644
--- a/Volatility/vmodules.py
+++ b/Volatility/vmodules.py
@@ -41,7 +41,6 @@ from forensics.win32.tasks import module_base, module_path, module_size,
create_
from forensics.win32.tasks import process_imagename, process_ldrs, process_list,
process_peb, process_pid, process_handle_table, process_create_time, process_handle_count
from forensics.win32.tasks import process_inherited_from, process_num_active_threads,
process_vadroot
from forensics.win32.modules import modules_list
-from forensics.win32.network import connection_laddr, connection_lport, connection_raddr,
connection_rport, connection_pid, tcb_connections
from forensics.win32.network import socket_create_time, socket_local_port, socket_pid,
socket_protocol, open_sockets
from forensics.win32.handles import handle_entries, handle_process_id, handle_tables,
handle_entry_object, is_object_file, object_data, file_name
from forensics.win32.modules import module_baseaddr, module_imagename, module_imagesize,
module_modulename
@@ -336,39 +335,6 @@ def get_dlllist(cmdname, argv):
print
###################################
-# connections - List open connections
-###################################
-def get_connections(cmdname, argv):
- """
- Function prints a list of open connections
- """
- op = get_standard_parser(cmdname)
- opts, _args = op.parse_args(argv)
-
- (addr_space, symtab, types) = load_and_identify_image(op, opts)
-
- connections = tcb_connections(addr_space, types, symtab)
-
- if len(connections) > 0:
- print "%-25s %-25s %-6s" % ('Local Address', 'Remote
Address', 'Pid')
-
- for connection in connections:
-
- if not addr_space.is_valid_address(connection):
- continue
-
- pid = connection_pid(addr_space, types, connection)
- lport = connection_lport(addr_space, types, connection)
- laddr = connection_laddr(addr_space, types, connection)
- rport = connection_rport(addr_space, types, connection)
- raddr = connection_raddr(addr_space, types, connection)
-
- local = "%s:%d" % (laddr, lport)
- remote = "%s:%d" % (raddr, rport)
-
- print "%-25s %-25s %-6d" % (local, remote, pid)
-
-###################################
# sockets - List open sockets
###################################
def get_sockets(cmdname, argv):
diff --git a/Volatility/volatility.py b/Volatility/volatility.py
index 4e04aeb..ebdf02e 100644
--- a/Volatility/volatility.py
+++ b/Volatility/volatility.py
@@ -56,10 +56,6 @@ modules = {
VolatoolsModule('files',
'Print list of open files for each process',
get_open_files),
- 'connections':
- VolatoolsModule('connections',
- 'Print list of open connections',
- get_connections),
'modules':
VolatoolsModule('modules',
'Print list of loaded modules',