1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23 from rekall import addrspace
24 from rekall import kb
25 from rekall import obj
26 from rekall.plugins.overlays.windows import common
27 from rekall.plugins.overlays.windows import win7
28 from rekall_lib import utils
29
30
32 if x.obj_profile.metadata("arch") == "AMD64":
33 return x.obj_offset - 12
34 return x.obj_offset - 4
35
36
37
38
39
40
41
42
43
44
45
46
47
48 win8_overlays = {
49 '_EPROCESS': [None, {
50
51 'RealVadRoot': lambda x: x.VadRoot.BalancedRoot
52 }],
53
54 '_MM_AVL_NODE': [None, {
55 'Tag': [TagOffset, ['String', dict(length=4)]],
56 }],
57
58 '_RTL_BALANCED_NODE': [None, {
59 'Tag': [TagOffset, ['String', dict(length=4)]],
60 }],
61
62 '_MMVAD_SHORT': [None, {
63 'Tag': [TagOffset, ['String', dict(length=4)]],
64 'Start': lambda x: (
65 x.StartingVpn + ((x.m("StartingVpnHigh") or 0) << 32)) << 12,
66
67 'End': lambda x: (
68 (x.EndingVpn + ((x.m("EndingVpnHigh") or 0) << 32))<<12)+0xFFF,
69
70 'Length': lambda x: x.End - x.Start + 1,
71 'CommitCharge': lambda x: x.u1.VadFlags1.CommitCharge,
72 'LeftChild': lambda x: x.VadNode.Left,
73 'RightChild': lambda x: x.VadNode.Right,
74 }],
75
76 '_MMVAD': [None, {
77 'Tag': [TagOffset, ['String', dict(length=4)]],
78 'ControlArea': lambda x: x.Subsection.ControlArea,
79
80
81 'Start': lambda x: x.Core.Start,
82 'End': lambda x: x.Core.End,
83 'Length': lambda x: x.Core.Length,
84 'CommitCharge': lambda x: x.Core.CommitCharge,
85 'u': lambda x: x.Core.u,
86 'LeftChild': lambda x: x.Core.LeftChild,
87 'RightChild': lambda x: x.Core.RightChild,
88 }],
89
90 '_MMVAD_LONG': [None, {
91 'Tag': [TagOffset, ['String', dict(length=4)]],
92 'ControlArea': lambda x: x.Subsection.ControlArea,
93
94
95 'Start': lambda x: x.Core.Start,
96 'End': lambda x: x.Core.End,
97 'Length': lambda x: x.Core.Length,
98 'CommitCharge': lambda x: x.Core.CommitCharge,
99 'u': lambda x: x.Core.u,
100 'LeftChild': lambda x: x.Core.LeftChild,
101 'RightChild': lambda x: x.Core.RightChild,
102 }],
103
104 "_CONTROL_AREA": [None, {
105 'FilePointer': [None, ['_EX_FAST_REF', dict(
106 target="_FILE_OBJECT"
107 )]],
108 }],
109
110 '_HANDLE_TABLE_ENTRY' : [None, {
111
112 'Object': lambda x: x.obj_profile.Pointer(
113 target="_OBJECT_HEADER",
114 value=(x.ObjectPointerBits << 4 | 0xFFFFE00000000000),
115 vm=x.obj_vm, parent=x)
116 }],
117
118 '_OBJECT_HEADER': [None, {
119 "InfoMask": [None, ["Flags", dict(
120 maskmap=utils.Invert({
121 0x1: "CreatorInfo",
122 0x2: "NameInfo",
123 0x4: "HandleInfo",
124 0x8: "QuotaInfo",
125 0x10: "ProcessInfo",
126 0x20: "AuditInfo",
127 0x40: "PaddingInfo",
128 }),
129 target="unsigned char",
130 )]],
131
132 'GrantedAccess': lambda x: x.obj_parent.GrantedAccessBits
133 }],
134
135 '_MM_SESSION_SPACE': [None, {
136
137
138 'ImageIterator': lambda x: x.ImageList.list_of_type(
139 "_IMAGE_ENTRY_IN_SESSION", "Link")
140 }],
141
142 '_IMAGE_ENTRY_IN_SESSION': [None, {
143 'ImageBase': lambda x: x.Address.v() & ~7
144 }],
145 }
146
147 win8_1_overlays = {
148 '_EPROCESS': [None, {
149
150 'RealVadRoot': lambda x: x.VadRoot.Root
151 }],
152
153 '_HANDLE_TABLE': [None, {
154 'HandleCount': lambda x: obj.NoneObject("Unknown")
155 }],
156 }
157
158 win8_undocumented_amd64 = {
159
160
161
162
163 '_IMAGE_ENTRY_IN_SESSION': [None, {
164 'Link': [0, ['_LIST_ENTRY']],
165 'Address': [0x20, ["Pointer"]],
166 }],
167 }
168
169 win8_undocumented_i386 = {
170 '_IMAGE_ENTRY_IN_SESSION': [None, {
171 'Link': [0, ['_LIST_ENTRY']],
172 'Address': [0x10, ["Pointer"]],
173 }],
174 }
175
176
178 """By caching this map we can speed up lookups significantly."""
179
180 name = "ObpInfoMaskToOffset"
181
193
194
196 """Subclass the Windows handle table object for parsing PspCidTable"""
197
199 p = entry.Object.v()
200
201 handle = self.obj_profile.Object(
202 "_OBJECT_HEADER",
203 offset=(p & ~7) - self.obj_profile.get_obj_offset(
204 '_OBJECT_HEADER', 'Body'),
205 vm=self.obj_vm)
206
207 return handle
208
209
211 """All nodes in the Vad tree are treated as _MM_AVL_NODE.
212
213 The Vad structures can be either _MMVAD_SHORT or _MMVAD. At the
214 base of each struct there is an _MM_AVL_NODE which contains the LeftChild
215 and RightChild members. In order to traverse the tree, we follow the
216 _MM_AVL_NODE and create the required _MMVAD type at each point.
217
218 In Windows 8 these behave the same as windows 7's _MMADDRESS_NODE.
219 """
220
221
222
223 tag_map = {'Vadl': '_MMVAD',
224 'VadS': '_MMVAD_SHORT',
225 'Vad ': '_MMVAD',
226 'VadF': '_MMVAD_SHORT',
227 'Vadm': '_MMVAD',
228 }
229
230
232 """Win8.1 renames this type."""
233 left = "Left"
234 right = "Right"
235
236
238 """Initialize windows 8 and 8.1 profiles."""
239 profile.add_overlay(win8_overlays)
240
241 if profile.metadata("arch") == "AMD64":
242 profile.add_overlay(win8_undocumented_amd64)
243 else:
244 profile.add_overlay(win8_undocumented_i386)
245
246
247 if profile.metadata("version") >= 6.3:
248 profile.add_overlay(win8_1_overlays)
249
250 profile.add_classes(dict(
251 _OBJECT_HEADER=win7._OBJECT_HEADER,
252 _PSP_CID_TABLE=_PSP_CID_TABLE,
253 _MM_AVL_NODE=_MM_AVL_NODE,
254 _RTL_BALANCED_NODE=_RTL_BALANCED_NODE,
255 _POOL_HEADER=win7._POOL_HEADER,
256 ))
257
258
259
260 profile.add_constants(dict(
261 DRIVER_POOLTAG="Driv",
262 EPROCESS_POOLTAG="Proc",
263 FILE_POOLTAG="File",
264 SYMLINK_POOLTAG="Symb",
265 MODULE_POOLTAG="MmLd",
266 MUTANT_POOLTAG="Muta",
267 THREAD_POOLTAG='Thre',
268 ))
269