X f^HdZddlZddlZddlmZmZmZmZmZm Z ddl m Z m Z m Z ddlmZddlmZejeZGddZGd d eZGd d eZGd deZGddeZGdde j jZGdde jjZGdde jjZ dS)aModule to identify the Directory Table Base and architecture of windows memory images. This module contains a PageMapScanner that scans a physical layer to identify self-referential pointers. All windows versions include a self-referential pointer in their Directory Table Base's top table, in order to have a single offset that will allow manipulation of the page tables themselves. In older windows version the self-referential pointer was at a specific fixed index within the table, which was different for each architecture. In very recent Windows versions, the self-referential pointer index has been randomized, so a different heuristic must be used. In these versions of windows it was found that the physical offset for the DTB was always within the range of 0x1a0000 to 0x1b0000. As such, a search for any self-referential pointer within these pages gives a high probability of being an accurate DTB. The self-referential indices for older versions of windows are listed below: +--------------+-------+ | Architecture | Index | +==============+=======+ | x86 | 0x300 | +--------------+-------+ | PAE | 0x3 | +--------------+-------+ | x64 | 0x1ED | +--------------+-------+ N) GeneratorIterableListOptionalTupleType) constants interfaceslayers) requirements)intelc eZdZdZdeejjdede de e de ddf d Z d e d e d e de ee e ffd ZdS)DtbSelfReferentialzaA generic DTB test which looks for a self-referential pointer at *any* index within the page. layer_type ptr_structmask valid_range reserved_bitsreturnNc||_||_tj||_||_|j|_||_||_dSN) rrstructcalcsizeptr_sizer page_sizerr)selfrrrrrs Y/home/panchajanya/Development/work/volatility3/volatility3/framework/automagic/windows.py__init__zDtbSelfReferential.__init__,sJ%$ 33  (2&*data data_offset page_offsetc||||jz}|sdSt}td|j|jD]v}||||jz}t j|j|\}||jzr|dzrdS||jz||zkr#||zdkr|dzr| |wt|dkr,| } | |jz|j vr||z| fSdS)Nr) rsetrangerrunpackrrraddlenpopr) rr r!r"page ref_pagesrefptr_dataptrref_pages r__call__zDtbSelfReferential.__call__<s/K+">>? 4EE DNDM:: ' 'CC# "556H]4?H==FSd(( sTz tttykK&?@@k)A--:'MM#&&& y>>Q   }}HDM)d.>>>#k1H<<tr)__name__ __module__ __qualname____doc__rr r Intelstrintrrbytesrrr1rrrr(s++,++ + c] +  + ++++ (+:= %S/ "rrceZdZfdZxZS)DtbSelfRef32bitctttjjdddgddS)NIlpirrrrrr)superrr r WindowsIntelr __class__s rrzDtbSelfRef32bit.__init__[sD |0      rr2r3r4r __classcell__rCs@rr<r<Zs8         rr<c eZdZdfd ZxZS)DtbSelfRef64bitrNc ttjjddt ddddS)NQpir?)r@rr r WindowsIntel32er&rBs rrzDtbSelfRef64bit.__init__fsL |3!eU++      rrNrDrFs@rrHrHe=          rrHc eZdZdfd ZxZS)DtbSelfRef64bitOldWindowsrNctttjjdddgddS)NrJrKirMr?)r@rr r rNrBs rrz"DtbSelfRef64bitOldWindows.__init__qsD |3!      rrOrDrFs@rrRrRprPrrRc neZdZd fd ZedZdedededee eefffd Z xZ S) DtbSelfRefPaerNctttjjddgdddS)NrJrKr)rrrrr)r@rr r WindowsIntelPAErBs rrzDtbSelfRefPae.__init__|sD |3!      rc tdt|ddd|dddDdddS)Ncg|] \}}||z Sr:r:).0abs r z,DtbSelfRefPae._and_bytes..s HHH1a!eHHHr)r9zip)abytesbbytess r _and_byteszDtbSelfRefPae._and_bytessHHHF44R4L&2,(G(GHHH2NOOOrr r!r"cV t|||}|r|ddz d fdtddD}d}| |z |z djzz}||}||kr |dfSdS|S) Nr@rcPg|]"}tjj|dzz#S))rpackr)r[ir top_pae_pages rr^z*DtbSelfRefPae.__call__..s@KV1LMMrr$s )r@r1joinr&rrc) rr r!r"dtbexpected_tablepage_table_mask page_table anded_bytesrjrCs ` @rr1zDtbSelfRefPae.__call__sggt[+>>  q6F?L!XX"1a[[NFO ,!t}$!&&J//*oFFKn,,#SV++4 rrO) r2r3r4r staticmethodrcr9r8rrr1rErFs@rrUrU{s      PP\P(+:= %S/ "rrUc eZdZdZdZdZeeegZ de e e ddffd Z ded edeee efddffd ZxZS) PageMapScannerzWScans through all pages using DTB tests to determine a dtb offset and architecture.reTtestsrNc^t|r ||_dSdSr)r@rrv)rrvrCs rrzPageMapScanner.__init__s6   DJJJ  rr r!c#Ktdt|dD]'}|jD]}||||}| ||dfV(dS)Nrrg)r&r)rv)rr r!r"testresults rr1zPageMapScanner.__call__sx!CIIv66 , ,K  , ,dK==%++++ , , ,r)r2r3r4r5overlap thread_saferHrUr<rvrrrrr9r8rrr1rErFs@rrurusGK _   1B1B CE:ht,>'?@T ,,(+, 5+S014= >,,,,,,,,rruc eZdZdZddgZdegddgfdeeegdgfgZ e dd e j j d ed ejd ee jjfdZd S)WindowsIntelStacker(maclinuxz5Detecting Self-referential pointer for recent windows)r)iei z6Older windows fixed location self-referential pointers)iiNcontext layer_nameprogress_callbackrc |j|}t|tjrdS|jdddvrdSdx}}|jdddkr|jdrd|jdd}|dvrdStj}|dkr tj}n'|jd d r tj}|j d } tj d | }||j tj |d <|jd|j tj |d<|||| ddi}|j tj |d} tdt!| |S|jD]\} } t| ||t'| |} fd}dt(fd}t+t-| |} | D]v\}} || d}t1j|j}||||}||jkrt|jjdt!| |j d } tj d | }||j tj |d <| |j tj |d<|||| ddi}nNtd|jjdt!|dt!|jx||rn|X|rVtd|j tj |d|S)acAttempts to determine and stack an intel layer on a physical layer where possible. Where the DTB scan fails, it attempts a heuristic of checking for the DTB within a specific range. New versions of windows, with randomized self-referential pointers, appear to always load their dtb within a small specific range (`0x1a0000` and `0x1b0000`), so instead we scan for all self-referential pointers in that range, and ignore any that contain multiple self-references (since the DTB is very unlikely to point to itself more than once). Nos)WindowsUnknownrpage_map_offset architecture)Intel32Intel64rpaeF IntelLayer IntelHelper memory_layer) config_pathnamemetadataz#DTB was given to us by base layer: )rv)sectionsrcJ|d|dfS)zKey used to sort by testsrr$)index)xrvs r sort_by_testsz0WindowsIntelStacker.stack..sort_by_testss"{{1Q4((!A$..rrcd}tdt||D]Z}tj|j||||zd}|dzr(|dzs#t |||dzz |jjz}[|S)z&Determines a pointer from a page_tablerr$rMi)r&r)rr'rmaxrmaximum_address)rqryrmax_ptrrpointers rget_max_pointerz2WindowsIntelStacker.stack..get_max_pointer!s"1c*oox@@  E$mEEH## r)keyrgz test succeeded at zMax pointer for hit with test z not met: z > zDTB was found at: 0x{:0x}) r isinstancer r6rgetrArNrXfree_layer_namer configuration path_joinconfigvollogdebughex test_setsscanrur8sortedlistreadrrrrrCr2rformat)clsrrr base_layerlayerrarchrnew_layer_namer descriptionrhitsrrryrqr max_pointerrvs @rstackzWindowsIntelStacker.stacks&^J/ j%+ . . 4   " "4 . .6L L L4""    " "4 . .) ; ; @S@W@W A A ;&**>4@@D111t$1Jy  "2 $((66 3"2 $^;;LIIN$2<<~K  N(22;OO  #$56 N(22;@QRR J'# * E &n(22;@QRRO LLUs??S?SUU V V VL-0MC C  (K LL % % %??U+++!"3 #D / / / / / C     $t**-888D)-  %o'___fEE !?4?;;-oj$II *"<<<LL>2]]s?G[G[]]&-^%C%CL%Q%QN",":"D"D%~##K #N"0::;WW( N"0::'): !OO$/+"& !2 ,E ELLS9PSS\_`k\l\lSSqtuvPrQrQSS [     LL+22N"0::'):    rr)r2r3r4 stack_orderexclusion_listrHrUr<rRr classmethodr rContextInterfacer7r ProgressCallbackrr DataLayerInterfacerr:rrr~r~sKW%N D _    !#6 7 E ]__oo//1J1J1L1L M ! " I 9= MM#4MM%5 M *#6 7 MMM[MMMrr~c eZdZdZddgZ ddejjdedej j de j d df d Z ed edejd eeeejffd Zed eej j fd ZdS) WinSwapLayersz~Class to read swap_layers filenames from single-swap-layers, create the layers and populate the single-layers swap_layers.rrNrr requirementrrctjj}||||tjd|_|jD]\}}t|tjs!|||\}} d} tj |} | rB| || r+|j dgD]} | j t| z} ||| }||d}||d}| dz } | rk| |j |< tj| |j |<n.#t"$r!t$d| d YwxYwd |j |<t j| d d }| || |j ||d <d|j |<| || dS)z9Finds translation layers that can have swap layers added.F)shortcutrsingle_swap_locationslocationclassr$zVolatility swap_location z- could not be validated - swap layer disabledz/volatility3.framework.layers.physical.FileLayerz Swap Layer)rroptionalnumber_of_elementsTN)r rrfind_requirementsr TranslationLayerRequirement_translation_requirementrfind_swap_requirement parent_path unsatisfiedrrrr7URIRequirementlocation_from_file ValueErrorrwarningadd_requirement construct)rrrrrrtrans_sub_config trans_reqswap_sub_configswap_reqcounter swap_config swap_locationcurrent_layer_namecurrent_layer_pathlayer_loc_pathlayer_class_pathnew_reqs rr1zWinSwapLayers.__call__jsi,6 (,(>(>     4 )?) ) %,0+H5 95 9 ' ii)QRR (,(B(B ))) %OXG$2>>OOK* 9H00+FF* 9&*[__5Lb%Q%Q 6 6M)1W)E&)2?DV)W)W&%.Y/A:%N%NN'0y1CW'M'M$qLG%=O'9: % , ; N N$1!"!"$N>:: *%%%"NN xM x x x%H % N '78 +F/$0!&G ,,W5555yy:NOOP37/""7K888k5 95 9s!'E  (E43E4rcd}|jD]7}|j|}t|tjr|jdkr|}78tj|d}||fS)zATakes a Translation layer and returns its swap_layer requirement.N swap_layers)r rLayerListRequirementrr rr)rrrreq_namereqrs rrz#WinSwapLayers.find_swap_requirementsv #0  H*84C3 ABB H -- .88OO H$$rcBtjdtddddgS)z(Returns the requirements of this plugin.rrz@Specifies a list of swap layer URIs for use with single-locationT)r element_type min_elements max_elementsrr)r ListRequirementr7)rs rget_requirementszWinSwapLayers.get_requirementss5  (, ^      rr)r2r3r4r5rr rrr7rRequirementInterfacer rr1rsr rrrrrrrrr:rrrrds::u%N9= F9F9#4F9F9 -B F9 %5 F9  F9F9F9F9P%%"."J% sH\>?? @%%%\%"  j&>&S!T    [    rr)!r5loggingrtypingrrrrrrvolatility3.frameworkr r r #volatility3.framework.configurationr volatility3.framework.layersr getLoggerr2rrr<rHrRrUScannerInterfaceru automagicStackerLayerInterfacer~AutomagicInterfacerr:rrrs*2 CCCCCCCCCCCCCCCC??????????<<<<<<......  8 $ $////////d     (        (        2   +++++&+++\,,,,,Z&7,,,0`````*.D```Fl l l l l J(;l l l l l r