def timer_callback(self, ctx): fe.log("{ctr:<3} TIMER CALLBACK".format(ctr=self.cr3_ctr)) fe.log(" passed: {ctx}".format(ctx=ctx)) self.do_pslist() if self.cr3_ctr and not (self.cr3_ctr % 2) and not self.cr3_event == None: fe.log("clearing CR3 event") fe.event_clear(self.cr3_event) self.cr3_event = None
def be_callback(self, ctx): fe.log(f'BE CALLBACK: {ctx}') self.two_way = True # msg format: {'cmd': 'foo', 'data': 'bar', 'ix': dump_order, 'hash': hash} # ALL ASYNC # FE: hi, waiting, memdump_running, memdump_done, error # BE: memdump_cmd: go, stop msg = json.loads(ctx.message) fe.log(f'JSON message: {msg}') if msg['cmd'] == 'memdump_cmd' and msg['data'] == 'go': if self.did >= 0: fe.log(f'error, dump already in procress (eid={self.did})') fe.notify( json.dumps({ 'cmd': 'error', 'data': 'memdump already running' })) else: fe.log(f'running memdump') fe.notify( json.dumps({ 'cmd': 'memdump_running', 'data': time.time() })) self.did = fe.event_register({ 'event_type': fe.TIMER, 'time_value': 0.0, 'callback': self.memdump_callback }) fe.log(f'registered new event {self.did}') elif msg['cmd'] == 'memdump_cmd' and msg['data'] == 'stop': if self.did >= 0: fe.event_clear(self.did) self.did = -1 fe.log(f'canceled dump') else: fe.log(f'error, no dump in procress (eid={self.did})') elif msg['cmd'] == 'memdump_cmd' and msg['data'] == 'exit': fe.log('was commanded to exit...') fe.exit() fe.log('BE CALLBACK done')
def memdump_callback(self, ctx): fe.log( f'memdump_callback: coff={self.offset}, cttl={self.ttl}, memsize={self.memsize}' ) if self.ttl > 0: self.ttl -= 1 read_size = 0 batch_size = 0 chunk_arr = [] while batch_size < self.bound: try: mem = self.memdump() except IndexError as e: fe.log(f'caught {e}, all done!') self.ttl = 0 break else: zmem = self.zco.compress(mem) batch_size += len(zmem) chunk_arr.append(binascii.b2a_base64(zmem).decode()) fe.log(f'batch {batch_size} {len(mem)} -> {len(zmem)}') #res = self.memdump() #res_utf = binascii.b2a_base64(res).decode() fe.log( f'sending {self.ticks}:{batch_size} B to BE, "{chunk_arr[0][0:16]}"' ) fe.notify( json.dumps({ 'cmd': 'memdump', 'data': chunk_arr, 'ix': self.ticks, })) #'hash': hashlib.sha256(res).hexdigest()})) # TODO: for benchmarking, we do not send a hash to the be else: fe.log('ttl < 1, clearing memdump callback timer') fe.event_clear(self.did) fe.notify(json.dumps({'cmd': 'memdump_done', 'data': time.time()})) self.did = -1 self.ticks += 1
def be_callback(self, ctx): fe.log(f"BE CALLBACK: {ctx}") self.two_way = True # msg format: {'cmd': 'foo', 'data': 'bar', 'ix': dump_order, 'hash': hash} # ALL ASYNC # FE: hi, waiting, memdump_running, memdump_done, error # BE: memdump_cmd: go, stop msg = json.loads(ctx.message) fe.log(f"JSON message: {msg}") if msg["cmd"] == "memdump_cmd" and msg["data"] == "go": if self.did >= 0: fe.log(f"error, dump already in procress (eid={self.did})") fe.notify( json.dumps({"cmd": "error", "data": "memdump already running"}) ) else: fe.log(f"running memdump") fe.notify(json.dumps({"cmd": "memdump_running", "data": time.time()})) self.did = fe.event_register( { "event_type": fe.TIMER, "time_value": 0.0, "callback": self.memdump_callback, } ) fe.log(f"registered new event {self.did}") elif msg["cmd"] == "memdump_cmd" and msg["data"] == "stop": if self.did >= 0: fe.event_clear(self.did) self.did = -1 fe.log(f"canceled dump") else: fe.log(f"error, no dump in procress (eid={self.did})") elif msg["cmd"] == "memdump_cmd" and msg["data"] == "exit": fe.log("was commanded to exit...") fe.exit() fe.log("BE CALLBACK done")
def timer_callback(self, ctx): now = time.time() if self.last + 10 < now: fe.log("refreshing pslist") # pslist[proc.pid] = {'name': proc.name, 'process_block_ptr': proc.process_block_ptr} self.pslist = fe.process_list() # fe.log(f'#procs: {len(self.pslist)}') for pid, proc in self.pslist.items(): if proc["name"] == "sshd": fe.log(f"found sshd: {pid} {proc}") if not self.target_proc: self.target_proc["pid"] = pid for k, v in proc.items(): self.target_proc[k] = v for k, v in self.enumerate_proc( proc["process_block_ptr"]).items(): self.target_proc[k] = v fe.log(f"loading target_proc {self.target_proc}") if self.state == INIT: fe.log(f"installing breakpoint on commit_creds") address = self.l["commit_creds"] e = { "event_type": fe.INT, "sync": fe.SYNC, "bp_pid": fe.KERNEL, "bp_addr": address, "callback": self.commit_creds_callback, } try: eid = fe.event_register(e) except Exception: fe.log(f"could not inject at commit_creds") errors.append("commit_creds") else: self.events[eid] = address fe.log(f"event is {eid}") self.symbols[address] = { "address": address, "t": "T", "func_name": "commit_creds", } self.state = INJECTED if False and self.state == INIT: fe.log(f"injecting against {self.target_proc}") self.state = INJECTED errors = [] for address, info in self.symbols.items(): if "do_log" != info["func_name"]: fe.log(f"skipping {info['func_name']}") continue bp_addr = self.target_proc["text_start"] + address pid = self.target_proc["pid"] fe.log(f"installing bp at {bp_addr:x} for {address}:{info}") e = { "event_type": fe.INT, "sync": fe.SYNC, "bp_pid": pid, "bp_addr": bp_addr, "callback": self.int_callback, } try: eid = fe.event_register(e) except Exception: fe.log(f"could not inject at {info['func_name']}") errors.append(info["func_name"]) else: self.events[eid] = address fe.log(f"event is {eid}") fe.log(f"done, errors: {errors}") if self.tick == 15: fe.log("shutting down") fe.events_stop() for eid, address in self.events.items(): fe.log(f"clearing {eid}: {self.symbols[address]['func_name']}") fe.event_clear(eid) self.events = {} print(f"formats: {self.fmts}") print(f"users: {self.users}") fe.exit() fe.log(f"tick {self.tick}") self.tick += 1 self.last = now
def shutdown(self): # destructor if not self.cr3_event == None: fe.event_clear(self.cr3_event) self.cr3_event = None