X fWddlZddlZddlZddlmZmZmZmZmZddl m Z m Z m Z m Z mZddlmZddlmZddlmZddlmZddlmZdd lmZdd lmZmZmZeje Z!Gd d e j"j#ej$Z%dS) N)IterableListOptionalTupleType) constants exceptions interfaces rendererssymbols) requirements) format_hints)intermed)versions)network) timeliner)info poolscannerverinfoc eZdZdZdZdZedZede j j de de ejfdZede j j d e d e dee effd Zede j j d e d e d e de f d Zede j j d e d e de dee jjf dZddeefdZdZdZdS)NetScanzGScans for network objects present in a particular windows memory image.)rrrrc $tjddddgtjdtjdtjd t jdtjd tjdtj d d d dgS)NkernelzWindows kernelIntel32Intel64)name description architecturesrr)r componentversionrrinclude-corruptzRadically eases result validation. This will show partially overwritten data. WARNING: the results are likely to include garbage and/or corrupt data. Be cautious!FT)rr defaultoptional) r ModuleRequirementVersionRequirementr PoolScannerrInforVerInfoBooleanRequirement)clss _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/netscan.pyget_requirementszNetScan.get_requirementss  *,()4     +"k.Ey     +ty)     +'/9     +&A      context symbol_tablereturnc |j|tjzdzj}|j|tjzdzj}|j|tjzdzj}t jd|tjzdz|dft jjt jj zt jd|tjzdz|dft jjt jj zt jd|tjzdz|dft jjt jj zgS) aVCreates a list of Pool Tag Constraints for network objects. Args: context: The context to retrieve required elements (layers, symbol tables) from symbol_table: The name of an existing symbol table containing the symbols / types Returns: The list containing the built constraints. _TCP_LISTENER _TCP_ENDPOINT _UDP_ENDPOINTsTcpLN) type_namesize page_typesTcpEsUdpA) symbol_spaceget_typerBANGr9rPoolConstraintPoolTypeNONPAGEDFREE)r1r2 tcpl_size tcpe_size udpa_sizes r.create_netscan_constraintsz"NetScan.create_netscan_constraints5sh(11 9> )O ;   (11 9> )O ;   (11 9> )O ;     &&7/I&%.7+:N:SS      &&7/I&%.7+:N:SS      &&7/I&%.7+:N:SS    !  r0 layer_nament_symbol_tablec2tj||}tj||}|rd}nd}tj|||}tj|||} t|j t|j t|j n1#t$rtdtjdxYwt d|j |j |j|j dkr|dkr t(j} n t(j} |dkr:idd d d d d d d d dddddddddddddddddddddd dd!dd"di} n;idd#d d$d d$d d$d d%dd%dd%dd&dd'd(d)dd*dd*dd*dd+dd,dd-d d.d/d0d1d2} d3d4kr|rt d5d6fd7| Drt d8|j|jd9d:} | rtt4j|| d;} | r6| d<t d=n5t d>nt d?| f} | sfd@| D}||r;|dA}| |} t dB| n*tdC|jt dD| | | fS)EaTries to determine which symbol filename to use for the image's tcpip driver. The logic is partially taken from the info plugin. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate nt_symbol_table: The name of the table containing the kernel symbols Returns: The filename of the symbol table to use. )r1r2x64x86z4Kernel Debug Structure version format not supported!z\Kernel Debug Structure missing VERSION/KUSER structure, unable to determine Windows version!z"Determined OS Version: {}.{} {}.{} )riprznetscan-vista-x86)rLriqr)rLrirr)rLrisr)rLrirznetscan-win7-x86)rLrir)rLri r)rLri#rznetscan-win8-x86)rL%rznetscan-win81-x86)rKri(rznetscan-win10-10240-x86)rKriZ)rznetscan-win10-10586-x86)rKri98rznetscan-win10-14393-x86)rKri:rznetscan-win10-15063-x86)rKri?r)rKriBrznetscan-win10-17134-x86)rKricErrKrGrrKrGrznetscan-vista-x64znetscan-vista-sp12-x64znetscan-win7-x64znetscan-win8-x64znetscan-win81-x64)rLrMrNiMznetscan-win81-19935-x64znetscan-win10-x64znetscan-win10-15063-x64znetscan-win10-16299-x64znetscan-win10-17134-x64znetscan-win10-17763-x64znetscan-win10-18362-x64znetscan-win10-18363-x64znetscan-win10-19041-x64)rOrQ)rKriaJrrrPz@Detected 18363 data structures: working with 18363 symbol table.rRcJg|]\}}}}|||ffkr |dk||||f S)r).0abcdnt_major_versionnt_minor_versionvers_minor_versions r. z3NetScan.determine_tcpip_version..sW   1a1ay-/?ASTTTQ1aLr0zaRequiring further version inspection due to OS version by checking tcpip.sys's FileVersion header memory_layerNz tcpip.sysrMz&Determined tcpip.sys's FileVersion: {}z,Could not determine tcpip.sys's FileVersion.zEUnable to retrieve physical memory layer, skipping FileVersion check.cJg|]\}}}}|kr|kr |k||||f SrTrT)rUnt_majnt_minvers_min tcpip_verrZr[tcpip_mod_versions r.r]z3NetScan.determine_tcpip_version..sZ   7FFHi---...!222 95322r0z>Unable to find exact matching symbol file, going with latest: z6This version of Windows is not supported: {}.{} {}.{}!zDetermined symbol filename: )r symbol_table_is_64bitris_win10_18363_or_laterrr*get_version_structureget_kuser_structureint MinorVersionNtMajorVersionNtMinorVersion ValueErrorNotImplementedErrorr VolatilityExceptionvollogdebugformat MajorVersionrwin10_x64_class_types class_typeslayersconfiggetrr+find_version_infosort)r-r1rFrGis_64bitis_18363_or_laterarchverskuserrv version_dictphysical_layer_nameverfilenamecurrent_versionslatest_versionrZr[rdr\s @@@@r.determine_tcpip_versionzNetScan.determine_tcpip_versiongs00/JJ$</     DDDy..w OTT --gz?SS !$T%6!7!7 "5#788 "5#788     %F  0n   0 7 7$$!!       r ! !demm!7KK"-K 5==!4!4 !4 !4   !3   !3  !3 !3 !4"#<"#<"#<"#<"#<"#< "#"#6"#6"#6"#<"#< "#H>>???$$s :Scans for network objects using the poolscanner module and constraints. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate nt_symbol_table: The name of the table containing the kernel symbols netscan_symbol_table: The name of the table containing the network object symbols (_TCP_LISTENER etc.) Returns: A list of network objects found by scanning the `layer_name` layer for network pool signatures N)rErr)generate_pool_scan) r-r1rFrGr constraintsresult _constraint mem_object_headers r.scanz NetScan.scanasp(44W>RSS !-@@ Z+    F06 ,KW       r0Nshow_corrupt_resultsc#V K|jj|jd}||j|j|j|j}||j|j|j|D]4}t d|j j ddt||s| sRt|tjrt d|j j d|D]\}}}dt%j|j j d|z||jddd |pt-j|pt-j|pt-jf fVTt|tjrt d |j j d|tjkrd }n'|tjkrd }nd } |jj} n##t@$rt-j} YnwxYwdt%j|j j ||!pt-j|j"|#pt-j|j$| |pt-j|pt-j|pt-jf fVt|tj%rt d|j j d|D]\}}} dt%j|j j d|z||j| dd|pt-j|pt-j|pt-jf fVt d|dt|6dS)z3Generates the network objects for use in rendering.rzFound netw obj @ 0x2xz of assumed type zFound UDP_ENDPOINT @ 0xrUDP*zFound _TCP_ENDPOINT @ 0xTCPv4TCPv6zTCPv?zFound _TCP_LISTENER @ 0xTCP LISTENINGz)Found network object unsure of its type: z of type N)&r1modulesrxrrFsymbol_table_namerrrqrrvoloffsettypeis_valid isinstancerr7dual_stack_socketsrHexPort get_owner_pidr UnreadableValueget_owner_procnameget_create_timer6get_address_familyAF_INETAF_INET6Stater rnget_local_address LocalPortget_remote_address RemotePortr5) selfrrrnetw_objrladdr_protostateraddrs r. _generatorzNetScan._generator}s%dk(&;<#?? L&+V-EtGW   L    $   [ [ H LL_hl&9___tT\~~__   ( 0A0A0C0C (G$9::N  Ox|7JOOOPPP&.%@%@%B%BMC(,X\-@AA!CK!$M$2244S 8Q8S8S$7799;(8::$4466U):S:U:U $Hg&;<<8  P 8KPPPQQQ..00GOCC#EE0022g6FFF#EE#E8$N6EE!888%577EEE8$()<== 2244S 8Q8S8S * 3355T9R9T9T + ..00OI4M4O4O 3355T9R9T9T 0022Qi6O6Q6Q "Hg&;<<  P 8KPPPQQQ*2)D)D)F)F%C(,X\-@AA!CK!$M!'$2244S 8Q8S8S$7799;(8::$4466U):S:U:U & cccSWX`SaSaccs[ [ s I$$JJc #lK|D]}|\}}t|dtjs(d|D}d|d|d|d|d|d|d |d |d }|tjj|dfVdS) N c~g|]:}t|tjst|tjrdn|;S)zN/A)rr rUnparsableValue)rUis r.r]z-NetScan.generate_timeline..sZ "!Y%>??!!Y%>??EE r0z`Network connection: Process {} {} Local Address {}:{} Remote Address {}:{} State {} Protocol {} rrMrLr)rrdatetimersr TimeLinerTypeCREATED)rrow_depthrow_datar s r.generate_timelinezNetScan.generate_timelines??$$ N NC" FHhqk8+<== "H==CVQKQKQKQKQKQKQKQK > >  7 ?!M M M M M7 N Nr0c >|jdd}tjdtjfdt fdt fdtfdt fdtfdt fd tfd t fd tjfg | | S) Nr$OffsetProto LocalAddrr ForeignAddr ForeignPortrPIDOwnerCreated)r) rxryr TreeGridrrstrrjrr)rrs r.runz NetScan.runs#{/@$GG!<+,#c"c"$$# #H-.  OO1EO F F   r0)N)__name__ __module__ __qualname____doc___required_framework_version_version classmethodr/ staticmethodr r1ContextInterfacerrrr>rErrrrrobjectsObjectInterfacerrboolrrrrTr0r.rrsQQ"+H  [ 0/ #4/ DG/ k( )/ / / \/ bS%#4S%S% S% sDy  S%S%S%[S%j! #4! !  !  ! ! ! ! [! F#4  "  *$4 5 [6ddx~ddddLNNN<     r0r)&rloggingrtypingrrrrrvolatility3.frameworkrr r r r #volatility3.framework.configurationr volatility3.framework.renderersrvolatility3.framework.symbolsr%volatility3.framework.symbols.windowsr0volatility3.framework.symbols.windows.extensionsrvolatility3.pluginsrvolatility3.plugins.windowsrrr getLoggerrrqpluginsPluginInterfaceTimeLinerInterfacerrTr0r.rs[  88888888888888WWWWWWWWWWWWWW<<<<<<888888222222::::::DDDDDD))))))BBBBBBBBBB  8 $ $| | | | | j 0)2N| | | | | r0