/usr/lib/python2.7/dist-packages/rekall/plugins/renderers/linux.py is in python-rekall-core 1.6.0+dfsg-2.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 | # Rekall Memory Forensics
# Copyright 2014 Google Inc. All Rights Reserved.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or (at
# your option) any later version.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#
"""This module implements renderers specific to Linux structures."""
import os
from rekall.ui import json_renderer
from rekall.ui import text
from rekall.plugins.addrspaces import amd64
from rekall.plugins.renderers import base_objects
from rekall.plugins.renderers import data_export
class kuid_t_TextObjectRenderer(text.TextObjectRenderer):
renders_type = "kuid_t"
renderers = ["TextRenderer", "TestRenderer", "WideTextRenderer"]
def render_row(self, target, **_):
return text.Cell(unicode(target))
class kgid_t_TextObjectRenderer(kuid_t_TextObjectRenderer):
renders_type = "kgid_t"
class kuid_t_JsonObjectRenderer(json_renderer.JsonObjectRenderer):
renders_type = ["kuid_t", "kgid_t"]
renderers = ["JsonRenderer", "DataExportRenderer"]
def EncodeToJsonSafe(self, task, **_):
return task.val.v()
class XenM2PMapperObjectRenderer(json_renderer.JsonObjectRenderer):
renders_type = "XenM2PMapper"
def EncodeToJsonSafe(self, item, **_):
result = {}
result["m2p_map"] = dict(item)
result["mro"] = ":".join(self.get_mro(item))
return result
def DecodeFromJsonSafe(self, value, _):
return amd64.XenM2PMapper(value["m2p_map"])
class TaskStruct_TextObjectRenderer(base_objects.StructTextRenderer):
renders_type = "task_struct"
COLUMNS = [
dict(style="address", name="obj_offset"),
dict(width=20, align="l", name="name"),
dict(width=6, align="r", name="pid")
]
class TaskStruct_DataExport(data_export.DataExportBaseObjectRenderer):
renders_type = "task_struct"
def EncodeToJsonSafe(self, task, **_):
result = super(TaskStruct_DataExport, self).EncodeToJsonSafe(task)
fullpath = task.get_path(task.mm.m("exe_file"))
result["Cybox"] = dict(
type=u"ProcessObj:ProcessObjectType",
Name=task.name,
PID=task.pid,
Creation_Time=task.task_start_time,
Parent_PID=task.parent.pid,
Image_Info=dict(
type=u"ProcessObj:ImageInfoType",
Path=fullpath,
Command_Line=task.commandline,
TrustedPath=fullpath,
File_Name=os.path.basename(fullpath),
)
)
res = json_renderer.JsonObjectRenderer.EncodeToJsonSafe(self, result)
return res
def Summary(self, item, **_):
return "%s (%s)" % (item.get("Cybox", {}).get("Name", ""),
item.get("Cybox", {}).get("PID", ""))
|