|
| 1 | +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 |
| 2 | +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 |
| 3 | +# |
| 4 | +import logging |
| 5 | +from typing import List |
| 6 | + |
| 7 | +from volatility3 import framework |
| 8 | +import volatility3.framework.symbols.linux.utilities.module_extract as linux_utilities_module_extract |
| 9 | +from volatility3.framework import interfaces, renderers |
| 10 | +from volatility3.framework.configuration import requirements |
| 11 | +from volatility3.framework.renderers import format_hints |
| 12 | +from volatility3.framework.objects import utility |
| 13 | + |
| 14 | +vollog = logging.getLogger(__name__) |
| 15 | + |
| 16 | + |
| 17 | +class ModuleExtract(interfaces.plugins.PluginInterface): |
| 18 | + """Recreates an ELF file from a specific address in the kernel""" |
| 19 | + |
| 20 | + _version = (1, 0, 0) |
| 21 | + _required_framework_version = (2, 25, 0) |
| 22 | + |
| 23 | + framework.require_interface_version(*_required_framework_version) |
| 24 | + |
| 25 | + @classmethod |
| 26 | + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: |
| 27 | + # Since we're calling the plugin, make sure we have the plugin's requirements |
| 28 | + return [ |
| 29 | + requirements.ModuleRequirement( |
| 30 | + name="kernel", |
| 31 | + description="Windows kernel", |
| 32 | + architectures=["Intel32", "Intel64"], |
| 33 | + ), |
| 34 | + requirements.IntRequirement( |
| 35 | + name="base", |
| 36 | + description="Base virtual address to reconstruct an ELF file", |
| 37 | + optional=False, |
| 38 | + ), |
| 39 | + ] |
| 40 | + |
| 41 | + def _generator(self): |
| 42 | + kernel = self.context.modules[self.config["kernel"]] |
| 43 | + |
| 44 | + base_address = self.config["base"] |
| 45 | + |
| 46 | + kernel_layer = self.context.layers[kernel.layer_name] |
| 47 | + |
| 48 | + if not kernel_layer.is_valid(base_address): |
| 49 | + vollog.error( |
| 50 | + f"Given base address ({base_address:#x}) is not valid in the kernel address space. Unable to extract file." |
| 51 | + ) |
| 52 | + return |
| 53 | + |
| 54 | + module = kernel.object(object_type="module", offset=base_address, absolute=True) |
| 55 | + |
| 56 | + elf_data = linux_utilities_module_extract.ModuleExtract.extract_module( |
| 57 | + self.context, self.config["kernel"], module |
| 58 | + ) |
| 59 | + if not elf_data: |
| 60 | + vollog.error( |
| 61 | + f"Unable to reconstruct the ELF for module struct at {base_address:#x}" |
| 62 | + ) |
| 63 | + return |
| 64 | + |
| 65 | + module_name = utility.array_to_string(module.name) |
| 66 | + file_name = self.open.sanitize_filename( |
| 67 | + f"kernel_module.{module_name}.{base_address:#x}.elf" |
| 68 | + ) |
| 69 | + |
| 70 | + with self.open(file_name) as file_handle: |
| 71 | + file_handle.write(elf_data) |
| 72 | + |
| 73 | + yield 0, ( |
| 74 | + format_hints.Hex(base_address), |
| 75 | + len(elf_data), |
| 76 | + file_handle.preferred_filename, |
| 77 | + ) |
| 78 | + |
| 79 | + def run(self): |
| 80 | + return renderers.TreeGrid( |
| 81 | + [ |
| 82 | + ("Base", format_hints.Hex), |
| 83 | + ("File Size", int), |
| 84 | + ("File output", str), |
| 85 | + ], |
| 86 | + self._generator(), |
| 87 | + ) |
0 commit comments