def get_symbol_list(): """ Return list of symbols :return: List of symbols, each element is a dictionary with keys: "mod", "name", and "addr" :rtype: list """ import vmi import windows_vmi from utils import pp_print syms = [] diff_modules = {} proc_list = get_process_list() pp_print("[*] Updating symbol list... Be patient, this may take a while\n") for proc in proc_list: proc_pid = proc["pid"] proc_pgd = proc["pgd"] windows_vmi.windows_update_modules(proc_pgd,update_symbols=True) for module in vmi.modules[proc_pid,proc_pgd].values(): c = module.get_checksum() n = module.get_fullname() if (c,n) not in diff_modules: diff_modules[(c,n)] = module for mod in diff_modules.values(): for ordinal,addr,name in mod.get_symbols(): syms.append({"mod": mod.get_name(),"name": name, "addr": addr}) return syms
def get_module_list(pgd): """ Return list of modules for a given PGD :param pgd: The PGD of the process for which we want to extract the modules :type pgd: int :return: List of modules, each element is a dictionary with keys: "name", "base", and "size" :rtype: list """ import vmi import windows_vmi proc_list = get_process_list() mods = [] found = False for proc in proc_list: proc_pid = proc["pid"] proc_pgd = proc["pgd"] if proc_pgd == pgd: found = True windows_vmi.windows_update_modules(proc_pgd,update_symbols=False) for mod in vmi.modules[(proc_pid,proc_pgd)].values(): mods.append({"name": mod.get_name(), "base": mod.get_base(), "size": mod.get_size()}) if found: return mods else: raise ValueError("Process with PGD %x not found" % pgd)
def update_modules(proc_pgd, update_symbols=False): global os_family from windows_vmi import windows_update_modules from linux_vmi import linux_update_modules hook_points = None if os_family == OS_FAMILY_WIN: hook_points = windows_update_modules(proc_pgd, update_symbols) elif os_family == OS_FAMILY_LINUX: hook_points = linux_update_modules(proc_pgd, update_symbols) return hook_points
def update_modules(proc_pgd, update_symbols=False): global os_family from windows_vmi import windows_update_modules from linux_vmi import linux_update_modules hook_points = None if os_family == OS_FAMILY_WIN: hook_points = windows_update_modules(proc_pgd, update_symbols) elif os_family == OS_FAMILY_LINUX: hook_points = linux_update_modules(proc_pgd, update_symbols) return hook_points