Source Code for Module rekall.plugins.common.memmap

  1   
  2  # Rekall Memory Forensics 
  3  # Copyright 2015 Google Inc. All Rights Reserved. 
  4  # 
  5  # This program is free software; you can redistribute it and/or modify 
  6  # it under the terms of the GNU General Public License as published by 
  7  # the Free Software Foundation; either version 2 of the License, or (at 
  8  # your option) any later version. 
  9  # 
 10  # This program is distributed in the hope that it will be useful, but 
 11  # WITHOUT ANY WARRANTY; without even the implied warranty of 
 12  # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 
 13  # General Public License for more details. 
 14  # 
 15  # You should have received a copy of the GNU General Public License 
 16  # along with this program; if not, write to the Free Software 
 17  # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 
 18  # 
 19   
 20  """This module implements core memmap/memdump plugins.""" 
 21   
 22  __author__ = "Michael Cohen <scudette@gmail.com>" 
 23   
 24  from rekall import plugin 
 25  from rekall.ui import text 
 26  from rekall.plugins import core 
 27  from rekall_lib import utils 
 28   
 29   
 30 -class MemmapMixIn(object): 
 31      """A Mixin to create the memmap plugins for all the operating systems.""" 
 32   
 33      @classmethod 
 34 -    def args(cls, parser): 
 35          """Declare the command line args we need.""" 
 36          super(MemmapMixIn, cls).args(parser) 
 37          parser.add_argument( 
 38              "--coalesce", default=False, type="Boolean", 
 39              help="Merge contiguous pages into larger ranges.") 
 40   
 41          parser.add_argument( 
 42              "--all", default=False, type="Boolean", 
 43              help="Use the entire range of address space.") 
 44   
 45 -    def __init__(self, *pos_args, **kwargs): 
 46          """Calculates the memory regions mapped by a process or the kernel. 
 47   
 48          If no process filtering directives are provided, enumerates the kernel 
 49          address space. 
 50          """ 
 51          self.coalesce = kwargs.pop("coalesce", False) 
 52          self.all = kwargs.pop("all", False) 
 53          super(MemmapMixIn, self).__init__(*pos_args, **kwargs) 
 54   
 55 -    def _render_map(self, task_space, renderer, highest_address): 
 56          renderer.format(u"Dumping address space at DTB {0:#x}\n\n", 
 57                          task_space.dtb) 
 58   
 59          renderer.table_header([("Virtual", "offset_v", "[addrpad]"), 
 60                                 ("Physical", "offset_p", "[addrpad]"), 
 61                                 ("Size", "process_size", "[addr]")]) 
 62   
 63          if self.coalesce: 
 64              ranges = task_space.merge_base_ranges() 
 65          else: 
 66              ranges = task_space.get_mappings() 
 67   
 68          for run in ranges: 
 69              # When dumping out processes do not dump the kernel. 
 70              if not self.all and run.start > highest_address: 
 71                  break 
 72   
 73              renderer.table_row(run.start, run.file_offset, run.length) 
 74   
 75 -    def render(self, renderer): 
 76          if not self.filtering_requested: 
 77              # Dump the entire kernel address space. 
 78              return self._render_map(self.kernel_address_space, renderer, 2**64) 
 79   
 80          max_memory = self.session.GetParameter("highest_usermode_address") 
 81          for task in self.filter_processes(): 
 82              renderer.section() 
 83              renderer.RenderProgress("Dumping pid {0}".format(task.pid)) 
 84   
 85              task_space = task.get_process_address_space() 
 86              renderer.format(u"Process: '{0}' pid: {1:6}\n\n", 
 87                              task.name, task.pid) 
 88   
 89              if not task_space: 
 90                  renderer.write("Unable to read pages for task.\n") 
 91                  continue 
 92   
 93              self._render_map(task_space, renderer, max_memory) 
 94   
 95   
 96 -class MemDumpMixin(core.DirectoryDumperMixin, MemmapMixIn): 
 97      """Dump the addressable memory for a process. 
 98   
 99      Note that because the addressable memory is sparse we do not maintain 
100      alignment in the output file. Instead, we also write an index file which 
101      describes all the sparse runs in the dump - but the dump file has all the 
102      data concatenated. 
103      """ 
104   
105      name = "memdump" 
106   
107 -    def dump_process(self, eprocess, fd, index_fd): 
108          task_as = eprocess.get_process_address_space() 
109          temp_renderer = text.TextRenderer(session=self.session, 
110                                            fd=index_fd) 
111          with temp_renderer.start(): 
112              temp_renderer.table_header([ 
113                  ("File Address", "file_addr", "[addrpad]"), 
114                  ("Length", "length", "[addrpad]"), 
115                  ("Virtual Addr", "virtual", "[addrpad]")]) 
116   
117              # Only dump the userspace portion of addressable memory. 
118              max_memory = self.session.GetParameter("highest_usermode_address") 
119              blocksize = 1024 * 1024 
120   
121              for run in task_as.get_address_ranges(end=max_memory): 
122                  for offset in utils.xrange(run.start, run.end, blocksize): 
123                      to_read = min(blocksize, run.end - offset) 
124                      if to_read == 0: 
125                          break 
126   
127                      data = task_as.read(offset, to_read) 
128                      file_offset = fd.tell() 
129                      fd.write(data) 
130   
131                      # Write the index file. 
132                      temp_renderer.table_row(file_offset, to_read, offset) 
133   
134   
135 -    def render(self, renderer): 
136          if self.dump_dir is None: 
137              raise plugin.PluginError("Dump directory not specified.") 
138   
139          for task in self.filter_processes(): 
140              renderer.section() 
141              filename = u"{0}_{1:d}.dmp".format(task.name, task.pid) 
142   
143              renderer.format(u"Writing {0} to {1}\n", 
144                              task, filename) 
145   
146              with renderer.open(directory=self.dump_dir, 
147                                 filename=filename, 
148                                 mode='wb') as fd: 
149                  with renderer.open(directory=self.dump_dir, 
150                                     filename=filename + ".idx", 
151                                     mode='wb') as index_fd: 
152                      self.dump_process(task, fd, index_fd) 
153