/usr/lib/python2.7/dist-packages/rekall/plugins/linux/ifconfig.py is in python-rekall-core 1.6.0+dfsg-2.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 | # Rekall Memory Forensics
#
# Copyright 2013 Google Inc. All Rights Reserved.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or (at
# your option) any later version.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
"""
@author: Andrew Case
@license: GNU General Public License 2.0 or later
@contact: atcuno@gmail.com
@organization: Digital Forensics Solutions
"""
import itertools
from rekall.plugins.linux import common
class Ifconfig(common.LinuxPlugin):
'''Gathers active interfaces.'''
__name = "ifconfig"
table_header = [
dict(name="interface", width=16),
dict(name="ipv4", width=20),
dict(name="MAC", width=18),
dict(name="flags", width=20)
]
def enumerate_devices(self):
"""A generator over devices.
Yields:
a tuple of (name, ip_addr, mac_addr, promisc).
"""
return itertools.chain(self.get_devs_namespace(),
self.get_devs_base())
def get_devs_base(self):
net_device = self.profile.get_constant_object(
"dev_base", target="net_device", vm=self.kernel_address_space)
for net_dev in net_device.walk_list("next"):
yield net_dev
def gather_net_dev_info(self, net_dev):
mac_addr = net_dev.mac_addr
for dev in net_dev.ip_ptr.ifa_list.walk_list("ifa_next"):
yield dev.ifa_label, dev.ifa_address, mac_addr, net_dev.flags
def get_devs_namespace(self):
nethead = self.profile.get_constant_object(
"net_namespace_list", target="list_head",
vm=self.kernel_address_space)
for net in nethead.list_of_type("net", "list"):
for net_dev in net.dev_base_head.list_of_type("net_device",
"dev_list"):
yield net_dev
def collect(self):
for net_dev in self.enumerate_devices():
for name, ipv4, mac, flags in self.gather_net_dev_info(net_dev):
yield dict(interface=name,
ipv4=ipv4,
MAC=mac,
flags=flags)
|