[ #g8ZDddlZddlZddlmZddlmZddlmZmZmZm Z ddl m Z m Z m Z mZmZddlmZddlmZddlmZdd lmZdd lmZdd lmZmZdd lmZdd lm Z m!Z!m"Z"ejFe$Z%Gdde jLjNejPZ)y)N)datetime)count)IteratorListOptionalTuple) constants exceptions interfaces rendererssymbols) requirements)array_to_string) format_hints)intermed)versions)pe shimcache) timeliner)modulespslistvadinfoceZdZUdZdZej ddfej ddfejddfejddfejdd fejdd fejdd fejdd fejdd fejddfejddfejddfejddfejddfgZeeej"eefed<gdZdeeeej0effdZedeej:j<fdZe dejBjDdededefdZ#edejBjDdedededee$jJf dZ&edejBjDded ed!ededee$jJf d"Z'edejBjDdededed#e(d$e(d%e(de)e$jJfd&Z*edejBjDded ed!ededee$jJf d'Z+d(Z,d)Z-edejBjDdededed*eed+ede)ee(e(ffd,Z.y-). ShimcacheMemz5Reads Shimcache entries from the ahcache.sys AVL treerrTzshimcache-win10-x64Fzshimcache-win10-x86zshimcache-win8-x64zshimcache-win8-x86zshimcache-win7-x64zshimcache-win7-x86zshimcache-vista-x64zshimcache-vista-x86zshimcache-2003-x86zshimcache-2003-x64zshimcache-xp-sp3-x86zshimcache-xp-sp2-x86zshimcache-xp-2003-x64zshimcache-xp-2003-x86_win_version_file_map)z ntoskrnl.exez ntkrnlpa.exez ntkrnlmp.exez ntkrpamp.exereturnc#K|jD]s\}\}}}}}}t|tr#d|dtjj |ft|tsQd|dtjj |fuyw)NzShimcache: File z executedz modified) _generator isinstancerr TimeLinerTypeACCESSEDMODIFIED)self_ last_modified last_update file_paths d/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/shimcachemem.pygenerate_timelinezShimcacheMem.generate_timeline2sDH??CT ?A?=+q!Y+x0( 9=y?V?V?_?_alll-2( 9=y?V?V?_?_annn DUs A!B $&B ctjddddgtjdtjdtj d t jd tj d tjd gS) NkernelzWindows kernelIntel32Intel64)name description architecturesrr)r0pluginversionr)r0 componentr4r) rModuleRequirementPluginRequirementrPsListVersionRequirementrVadInforModules)clss r*get_requirementszShimcacheMem.get_requirements;s{  * *,()4   * *fmmY   + +'//9   + +'//9   context symbol_table config_pathc jj}tjdi} t fdt j D}tjd|tjj|tjj!dd|t"j$||S#t$r tdwxYw)aCreates a shimcache symbol table Args: context: The context to retrieve required elements (layers, symbol tables) from symbol_table: The name of an existing symbol table containing the kernel symbols config_path: The configuration path within the context of the symbol table to create Returns: The name of the constructed shimcache table nt_symbolsc3HK|]\}}}|k(r|r|yw))r?r@N).0 version_check for_64bitfilenamer?is_64bitr@s r* z6ShimcacheMem.create_shimcache_table..ds1#6M9hy(!' M#s"z)This version of Windows is not supported!zUsing shimcache table windowsr) class_types native_types table_mapping) symbol_spacenativesr symbol_table_is_64bitnextrr StopIterationNotImplementedErrorvollogdebugrIntermediateSymbolTablecreateospathjoinrrM)r?r@rArNrOsymbol_filenamerJs`` @r*create_shimcache_tablez#ShimcacheMem.create_shimcache_tableOs ++L9AA 00,G%|4  S"#:F:\:\#O  -o->?@//66   GGLLK 0 !--%'7   S%&QR R Ss $CC layer_namekernel_symbol_tableshimcache_symbol_tablec#Kd}d}d}d}d} t} tjj|||D]} | j} t j d| ztjj| dD]} | j}|j|} |j| jdd k7r| d k(rt j d c |j!|t"j$zd z|| j|z}||kDr| j|z}t'|D]}|j(j!|t"j$zd z||}|dz }||dz kDrC| j|z| |zz}|j+|sn|j-|}|| vr| j/||j(j!|t"j$zdz||}|j+|j0j2s|j+s|y#tj$rYwxYw#tj$rYwxYww)aAttempts to find the shimcache in a Windows XP memory image :param context: The context to retrieve required elements (layers, symbol tables) from :param layer_name: The name of the memory layer on which to operate. :param kernel_symbol_table: The name of an existing symbol table containing the kernel symbols :param shimcache_symbol_table: The name of a symbol table containing the hand-crafted shimcache symbols `ii(zchecking process %dcJ|jdk(xr|jdk(S)NsVad )get_tag Protection)xs r*z4ShimcacheMem.find_shimcache_win_xp..s 199;'#9#Oalla>O#Or>rgsﾭipz$VAD magic bytes don't match DEADBEEFz unsigned intz unsigned longSHIM_CACHE_ENTRYN)setrr8list_processesUniqueProcessIdrVrWrr: list_vadsadd_process_layerlayersr InvalidAddressExceptionread get_startobjectr BANGranger?is_valid translateaddvoloffset)r<r?r_r`raSHIM_NUM_ENTRIES_OFFSETSHIM_MAX_ENTRIESSHIM_LRU_OFFSETSHIM_HEADER_SIZESHIM_CACHE_ENTRY_SIZEseenprocesspidvadproc_layer_name proc_layer num_entries cache_idx_ptrr& cache_idx_valshim_entry_offset physical_addr shim_entrys r*find_shimcache_win_xpz"ShimcacheMem.find_shimcache_win_xpys #&  %u}}33 Z!4 G))C LL.4 500O&-&?&?&AO!(!@J!s}}:>QQ#:"LL)OP R&nn*Y^^;nL#MMO&== !11 # / A {+A$.$6$6$=$=.?/Q'%%M "Q&M$'7!';;  *+0=@B& &../@A $.$8$89J$KM$, HH]+!+!3!3!:!:.?BTT')"J &..z~~/D/DE %..0 $$K,9  "99"99sIBJI &=I&#E)J I#J"I##J&I=9J<I==Jkernel_layer_nament_symbol_tablec #K|j|||||jd}|j|||||jd}|r|sy|\}} |\} } tj||rdnd} d} t ||| z| D] }|j ||||| | | z|} | s n| sy| j j|tjzdzdD]}|yw)aImplements the algorithm to search for the shim cache on Windows 2000 (x64) through Windows 7 / 2008 R2. The algorithm consists of the following: 1) Find the NT kernel module's .data and PAGE sections 2) Iterate over every 4/8 bytes (depending on OS bitness) in the .data section and test for the following: a) offset represents a valid RTL_AVL_TABLE object b) RTL_AVL_TABLE is preceeded by an ERESOURCE object c) RTL_AVL_TABLE is followed by the beginning of the SHIM LRU list :param context: The context to retrieve required elements (layers, symbol tables) from :param layer_name: The name of the memory layer on which to operate. :param kernel_symbol_table: The name of an existing symbol table containing the kernel symbols :param shimcache_symbol_table: The name of a symbol table containing the hand-crafted shimcache symbols .dataPAGENrcrgrm ListEntry) get_module_section_range NT_KRNL_MODSr rRrytry_get_shim_head_at_offsetrto_listr rx)r<r?rArrradata_secmod_pagedata_sec_offset data_sec_sizemod_page_offset mod_page_size addr_size shim_headr~rs r*find_shimcache_win_2k3_to_7z(ShimcacheMem.find_shimcache_win_2k3_to_7s"2//          //          X)1&)1& 66wPAVW   _}> ),< /*QR!$55 3c:J6KKLNN ).. 0< ?   !!# LL, -!M$5$5$:$::~~j)223CDNN 9>> ),> >   !!# LL, - LL. / r>c#:Ktj||xstj||}|rdgn |j}tj d||j |||||d}|j |||||d} |r| sy| \} } |\} } g}tj dt| tj dt| |jj|tjzdz}t| | | ztj||rd nd D]}tj d t||j|tjzd z||| }|j!| | | zsc|j"Ptj dt|j$j&|j)|j"t+|dk(snt+|dk7rtj dytj||s|s|d}n |s|d}n|d}|j,j/|tjzdzdD]}|j!s|yw)aAttempts to locate and yield shimcache entries from a Windows 8 or later memory image. :param context: The context to retrieve required elements (layers, symbol tables) from :param layer_name: The name of the memory layer on which to operate. :param kernel_symbol_table: The name of an existing symbol table containing the kernel symbols :param shimcache_symbol_table: The name of a symbol table containing the hand-crafted shimcache symbols z ahcache.syszSearching for modules rrNz PAGE offset: z.data offset: SHIM_CACHE_HANDLErcrgz Building shim handle pointer at pointer) object_typer_subtyper~zFound valid shim handle @ rz9Failed to identify two valid SHIM_CACHE_HANDLE structuresrlrrmr)ris_windows_8_1_or_lateris_win10rrVrWrrrPrr rxryr rRrwrzheadr}r~appendlenrr)r<r?rArrrais_8_1_or_later module_namesrrrrrr shim_heads handle_typer~ shim_handle valid_headrs r*find_shimcache_win_8_or_laterz*ShimcacheMem.find_shimcache_win_8_or_laterls"#:: _ 9   w 8 +: s?O?O  -l^<=//        //        X)1&)1&  }S%9$:;< ~c/&:%;<=**33 "Y^^ 36I I   m +..wHAa F LL;CK=I J!..2Y^^CiO,# )K##O_}5TU##/LL4S9O9O5P4QR%%k&6&67z?a') , z?a  LLT U  --gG##AJ #AJ#AJ$..66 "Y^^ 36H H+ J""$   sFJA*J>BJJc#`K|jj|jd}|j|j|j|j }t }tj|j|jrTtjd|j|j|j |j|j|}ntj|j|jsTtj|j|js*tj |j|jrStjd|j#|j|j |j|j|}ntj$|j|js*tj&|j|jrHtjd|j)|j|j|j|}ntj+dy|D]} tj-d|j.|j0|j2|j4t7|j8t:rt=j>|j8n |j8|j@f}dtG|g|fy#tBjD$rYwxYww)Nr-z*Finding shimcache entries for Windows 8.0+z1Finding shimcache entries for Windows 2k3/Vista/7z#Finding shimcache entries for WinXPz:Cannot parse shimcache entries for this version of WindowszSHIM_CACHE_ENTRY type: r)$r?rconfigr^symbol_table_namerArris_windows_8_or_later_contextrVinforr_is_2003is_vista_or_later is_windows_7ris_windows_xp_sp2is_windows_xp_sp3rwarnrW __class__r'r( exec_flagr! file_sizeintrHexr)r rtrS)r%r-shimcache_table_namecentriesentryrs r*r zShimcacheMem._generatorsw%%dkk(&;<#:: LL&22D4D4D  G  ) )$--9Q9Q R KKD E88   !!(($ G   T\\6+C+C D))$,,8P8PQ$$T\\63K3KL KKK L66   !!(($ G ' ' MM633  ' ' f6N6N O KK= >00 !!(($ G KKT U E  6u6GHI''%%OO&eoos;%((9"__OO  a&:& #55  s+I(L.+BL?L.L+(L.*L++L.c tjdtfdtfdtfdtfdt j fdtfg|jS)NOrderz Last Modifiedz Last Updatez Exec Flagz File Sizez File Path) r TreeGridrrboolrrstrr )r%s r*runzShimcacheMem.runs[!!# (+)d#l../c"   OO   r> module_list section_namec tfdtjj|||D}t j j|tjj|dddtj}|j|tjzdz||j } | sy| j#} tfd| j%D} |j | j&z} | j(j*} | | fS#t$rYywxYw#t$rYywxYw) aLocates the size and offset of the first found module section specified by name from the list of modules. :param context: The context to operate on :param layer_name: The memory layer to read from :param module_list: A list of module names to search for the given section :param section_name: The name of the section to search for. :return: The offset and size of the module, if found; Otherwise, returns `None` c3RK|]}|jjvr| ywN) BaseDllNameString)rFmodulers r*rKz8ShimcacheMem.get_module_section_range..8s/%%,, ; s$'NrrL)rM_IMAGE_DOS_HEADER)r~c3K|]:}jt|jjk(r|<ywr)lowerrName)rFsecrs r*rKz8ShimcacheMem.get_module_section_range..Ws<%%'?388+D+J+J+LLsAA)rSrr; list_modulesrTrrXrYr configuration path_joinrrMrwr rxDllBase get_nt_header get_sectionsVirtualAddressMisc VirtualSize)r<r?rAr_r@rrkrnl_mod pe_table_name dos_header nt_headersectionsection_offset section_sizes `` r*rz%ShimcacheMem.get_module_section_range"sA* %oo::ZH!88??   $ $ . .{D A   @ ^^ INN *-@ @ ##$ ,,.  $113G"))G,B,BB||// |++G  :  s#3D" "D1" D.-D.1 D=<D=N)/__name__ __module__ __qualname____doc___required_framework_versionrrrrrrrr is_xp_or_2003rrrOsDistinguisherrr__annotations__rrrr"rr+ classmethodr rRequirementInterfacer= staticmethodr?ContextInterfacer^rrmrrrrrrr rrrEr>r*rrs?"+   D"78   E#89  ' '/CD  ' '0DE   &:;   ';<  # #T+@A  # #U,AB   5"67   4!56  # #U,BC  # #U,BC   '>?   (?@O4h&>&>c&I JK"TLo %Y44h>? @o j&>&>&S&S!T  &' ##44' ' '  ' ' R]%##44]%]%! ]% !$ ]% ),, - ]%]%~I##44II I  I !$ I ),, -IIVD##44DD! D  D  DDD ),, -DDLa!##44a!a! a!  a! !$ a! ),, -a!a!FCJ  ?,##44?,?, ?,  ?, #Y ?,?, %S/ "?,?,r>r)*loggingrZr itertoolsrtypingrrrrvolatility3.frameworkr r r r r #volatility3.framework.configurationr%volatility3.framework.objects.utilityrvolatility3.framework.renderersrvolatility3.framework.symbolsr%volatility3.framework.symbols.windowsr0volatility3.framework.symbols.windows.extensionsrrvolatility3.pluginsrvolatility3.plugins.windowsrrr getLoggerrrVpluginsPluginInterfaceTimeLinerInterfacerrEr>r*rsp 22WW<A82:J)@@   8 $I ,:%%55y7S7SI ,r>