Trees | Indices | Help |
|
---|
|
1 # Rekall Memory Forensics 2 # 3 # Copyright 2015 Google Inc. All Rights Reserved. 4 # 5 # This program is free software; you can redistribute it and/or modify 6 # it under the terms of the GNU General Public License as published by 7 # the Free Software Foundation; either version 2 of the License, or (at 8 # your option) any later version. 9 # 10 # This program is distributed in the hope that it will be useful, but 11 # WITHOUT ANY WARRANTY; without even the implied warranty of 12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 13 # General Public License for more details. 14 # 15 # You should have received a copy of the GNU General Public License 16 # along with this program; if not, write to the Free Software 17 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 18 # 19 20 """Address spaces specific to pmem live here.""" 21 __author__ = "Adam Sindelar <adamsh@google.com>" 22 23 from os import path 24 25 from rekall import addrspace 26 from rekall import yaml_utils 27 from rekall.plugins.addrspaces import standard 28 29 41 4244 """Implements an address space to overlay the new MacPmem device.""" 45 46 name = "MacPmem" 47 order = standard.FileAddressSpace.order - 2 48 __image = True 49 volatile = True 50 fd = None 51 fname = None 52 _writable = True 53123 124 125 # See http://wiki.phoenix.com/wiki/index.php/EFI_MEMORY_TYPE for list of 126 # segment types that become conventional memory after ExitBootServices() 127 # is sent to EFI. 128 EFI_SEGMENTS_SAFETY = { 129 "EfiReservedMemoryType": "", 130 "EfiLoaderCode": "rw", # General use. 131 "EfiLoaderData": "rw", # General use. 132 "EfiBootServicesCode": "rw", # General use. 133 "EfiBootServicesData": "rw", # General use. 134 "EfiRuntimeServicesCode": "r", # Memory to be preserved. 135 "EfiRuntimeServicesData": "r", # Memory to be preserved. 136 "EfiConventionalMemory": "r", # General use. 137 "EfiUnusableMemory": "", # (Hardware) errors - don't use. 138 "EfiACPIReclaimMemory": "rw", # General use after ACPI enabled. 139 "EfiACPIMemoryNVS": "r", # Memory to be preserved. 140 "EfiMemoryMappedIO": "", # ACPI tables. 141 "EfiMemoryMappedIOPortSpace": "", # ACPI tables. 142 "EfiPalCode": "r", # OS-dependent. Largely read-only. 143 "EfiMaxMemoryType": "rw", # No idea (adamsh). Looks like general use? 144 } 145 14655 """Reopen the device if necessary. 56 57 /dev/pmem is open read-only by default. This reopens it if writes are 58 requested. 59 """ 60 if self.session.GetParameter("writable_physical_memory"): 61 expected_mode = "r+" 62 else: 63 raise RuntimeError( 64 "writable_physical_memory is not set in the Session.") 65 66 if self.fd.mode != expected_mode: 67 self.fd.close() 68 self.fd = open(self.fname, expected_mode)6971 super(MacPmemAddressSpace, self).__init__(**kwargs) 72 73 self.as_assert(base == None, 74 "Must be mapped directly over a raw device.") 75 self.fname = filename or (self.session and self.session.GetParameter( 76 "filename")) 77 78 self.as_assert(self.fname, "Filename must be specified.") 79 80 # Open as read-only even if writes are supported and allowed, because 81 # permissions may be set up such that opening for writing would be 82 # disallowed. 83 try: 84 self.fd = open(self.fname, "r") 85 except (OSError, IOError): 86 raise addrspace.ASAssertionError( 87 "Filename does not exist or can not be opened.") 88 89 self.fname_info = "%s_info" % self.fname 90 self.as_assert(path.exists(self.fname_info), 91 "MacPmem would declare a YML device at %s" % 92 self.fname_info) 93 94 self._load_yml(self.fname_info)9597 """Yields all the runs that are safe to read. 98 99 This just trusts the EFI bootmap at the moment. 100 """ 101 for record in records: 102 if record["type"] == "efi_range": 103 if efi_type_readable(record["efi_type"]): 104 yield (record["start"], record["start"], record["length"], 105 _StreamWrapper(self.fd))106108 session_obj.SetCache("dtb", self.pmem_metadata["meta"]["dtb_off"], 109 volatile=False) 110 session_obj.SetCache("vm_kernel_slide", 111 self.pmem_metadata["meta"]["kaslr_slide"], 112 volatile=False)113115 with open(yml_path) as fp: 116 data = self.pmem_metadata = yaml_utils.decode(fp.read()) 117 118 for run in self._get_readable_runs(data["records"]): 119 self.add_run(*run)120148 return "r" in EFI_SEGMENTS_SAFETY[str(efi_type)]149
Trees | Indices | Help |
|
---|
Generated by Epydoc 3.0.1 on Mon Oct 9 03:29:48 2017 | http://epydoc.sourceforge.net |