[ #gW ddlZddlmZmZmZddlmZmZmZddlm Z ddl m Z ddl m Z ddlmZmZej"eZedd efd efgZed d efgZGd d ej.j0Zy)N) NamedTupleDict Generator) interfaces exceptions constants) renderers) requirements)utility)pslistvadinfoVadData protectionpathDLLDatac ^eZdZdZdZedZdejjde e e ffdZ dejjde e effdZdejjde fdZdeed d ffd Zd e e e fdeed d ffd Zd e e e fd e e efdeed d ffdZdZdZy )HollowProcesseszLists hollowed processes)rctjddddgtjdtdd tjd t j d tjd tjd gS)NkernelzWindows kernelIntel32Intel64)name description architecturespidz9Process IDs to include (all other processes are excluded)T)r element_typeroptionalr )rrr)r componentversionr ) r ModuleRequirementListRequirementintVersionRequirementr PsListr VadInfo)clss g/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/hollowprocesses.pyget_requirementsz HollowProcesses.get_requirements(s|  * *,()4   ( ( W    + +    + +'//9   procreturnci}|jj|jd}|jj D]}|j t jj|j|j|jt j}|j}|rt|tsd}t||||j!<|S)a Returns a dictionary of: base address -> (protection string, file name) For each mapped VAD in the process. This is used for quick lookups of data and matching the DLL at the same base address as the VAD rz)contextmodulesconfig get_vad_roottraverseget_protectionr r'protect_values layer_namesymbol_table_namewinnt_protections get_file_name isinstancestrr get_start)selfr,vadsrvadprotection_stringfns r)_get_vads_datazHollowProcesses._get_vads_data?s%%dkk(&;<$$&//1C # 2 2..LL&"3"3V5M5M)) ! ""$BZC0/$+,=r$BD !2 r+c,i}|jD]8} |j} |jj }t|||<:|S#tj$rYRwxYw#tj$rt j}YTwxYw)a  Returns a dictionary of: base address -> path for each DLL loaded in the process This is used to cross compare with the corresponding VAD and to have a backup path source in case of smear in the VAD ) load_order_modulesDllBaserInvalidAddressException FullDllName get_stringr UnreadableValuer)r=r,dllsentrybaserGs r) _get_dlls_mapzHollowProcesses._get_dlls_map]s,,.E }} :#//::< !-DJ/ 55   55 :'779  :s" AA)A&%A&)'BBcF|jj|jd} |j}|jj |j t jzdz||j}|jS#tj$rYywxYw)zC Uses the PEB to get the image base of the process r_PEB)r6offsetN) r/r0r1add_process_layerobjectr7rBANGPebImageBaseAddressrrF)r=r,rproc_layer_namepebs r)_get_image_basezHollowProcesses._get_image_base{s%%dkk(&;< "446O,,%%((9>>9FB*xx&C '' '11  sA!B B B Nc#K|j|}|/||jk7rdj||jyyyw)aD Detects when the image base in the PEB, which is writable by process malware, does not match the section base address - whose value lives in kernel memory. Many malware samples will manipulate their image base to fool AVs/EDRs and as a necessary part of certain hollowing techniques NzhThe ImageBaseAddress reported from the PEB ({:#x}) does not match the process SectionBaseAddress ({:#x}))rXSectionBaseAddressformat)r=r,___ image_bases r)_check_load_addressz#HollowProcesses._check_load_addresssX))$/  !jD4K4K&K|DDD33 'L !sAAr>c#K|j}||vrdj|y||jdk7r0dj||j|||jyyw)a Legitimately mapped application executables and DLLs will have a VAD present and its initial protection will be PAGE_EXECUTE_WRITECOPY. Many process hollowing and code injection techniques will unmap the real executable and/or map in executables with incorrect permissions. This check verifies the VAD for the application exe. `_check_dlls_protection` checks for DLLs mapped in the process. zNThere is no VAD starting at the base address of the process executable ({:#x})PAGE_EXECUTE_WRITECOPYzVUnexpected protection ({}) for VAD hosting the process executable ({:#x}) with path {}N)rZr[rr)r=r,r>r]rLs r)_check_exe_protectionz%HollowProcesses._check_exe_protectionsw&& t bii $Z " "&> >jqqT %%tT$Z__ ?sA(A*rJc#K|D]I}||vr||jdk7sdj||j|||jKyw)NrazTUnexpected protection ({}) for DLL in the PEB's load order list ({:#x}) with path {})rr[r)r=r\r>rJdll_bases r)_check_dlls_protectionz&HollowProcesses._check_dlls_protections`Ht#H~((,DDlssN--xh9L9Ls A2Ac#tK|j|j|jg}|D]}|j|}t |dkr#|j |}t |dkrCt j|j}|j}|D]}||||D] } d||| ff yw)Nr) r_rbrerMlenrBr array_to_string ImageFileNameUniqueProcessId) r=procschecksr,rJr> proc_namerchecknotes r) _generatorzHollowProcesses._generators  $ $  & &  ' '  D%%d+D4y1}&&t,D4y1}//0B0BCI&&C!$d3D!4 sB6B8c tjj|jj dd}|j j |jd}tjdtfdtfdtfg|jtjj|j |j|j|S)NrrPIDProcessNotes)r/r6 symbol_table filter_func)r r&create_pid_filterr1getr/r0r TreeGridr$r;rrlist_processesr6r7)r=rxrs r)runzHollowProcesses.runsmm55dkkooeT6RS %%dkk(&;<!! C #  OO ,, LL%00!'!9!9 + -    r+)__name__ __module__ __qualname____doc___required_framework_version classmethodr*robjectsObjectInterfacerr$rrBrrMrXrr;r_rbrerrr}r+r)rr#s""+  ,&&66 c7l <&&66 c7l <J$6$6$F$F3" )CtO2L sG|, 3d? #0 CL) 15c7l1C  3d? # 8 r+r)loggingtypingrrrvolatility3.frameworkrrrr #volatility3.framework.configurationr volatility3.framework.objectsr volatility3.plugins.windowsr r getLoggerr~vollogr;rrpluginsPluginInterfacerrr+r)rs..CC+<17   8 $  s       J j((88J r+