WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-08 02:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

print human readable dump type in crashinfo, along with bitmap header size, bitmap size, and page count

Browse Source
This commit is contained in:
iMHLv2
2021-03-31 09:52:12 -05:00
parent fb54a2cade
commit 00db33e0fe
2 changed files with 30 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/layers/crash.py
+6 -3
View File
@@ -78,6 +78,11 @@ class WindowsCrashDump32Layer(segmented.SegmentedLayer):
offset=0,
layer_name=self._base_layer)
def get_summary_header(self) -> interfaces.objects.ObjectInterface:
return self.context.object(self._crash_common_table_name + constants.BANG + "_SUMMARY_DUMP",
offset=0x1000 * self.headerpages,
layer_name=self._base_layer)
def _load_segments(self) -> None:
"""Loads up the segments from the meta_layer."""
@@ -85,9 +90,7 @@ class WindowsCrashDump32Layer(segmented.SegmentedLayer):
# instead of hard coding 0x2000, use 0x1000 * self.headerpages so this works for
# both 32- and 64-bit dumps
summary_header = self.context.object(self._crash_common_table_name + constants.BANG + "_SUMMARY_DUMP",
offset=0x1000 * self.headerpages,
layer_name=self._base_layer)
summary_header = self.get_summary_header()
if self.dump_type == 0x1:
header = self.context.object(self._crash_table_name + constants.BANG + self.dump_header_name,
offset=0,
volatility3/framework/plugins/windows/crashinfo.py
+24 -2
View File
@@ -26,6 +26,22 @@ class Crashinfo(interfaces.plugins.PluginInterface):
header = layer.get_header()
uptime = datetime.timedelta(microseconds=int(header.SystemUpTime) / 10)
if header.DumpType == 0x1:
dump_type = "Full Dump (0x1)"
elif header.DumpType == 0x5:
dump_type = "Bitmap Dump (0x5)"
else:
# this should never happen since the crash layer only accepts 0x1 and 0x5
dump_type = "Unknown/Unsupported ({:#x})".format(header.DumpType)
if header.DumpType == 0x5:
summary_header = layer.get_summary_header()
bitmap_header_size = format_hints.Hex(summary_header.HeaderSize)
bitmap_size = format_hints.Hex(summary_header.BitmapSize)
bitmap_pages = format_hints.Hex(summary_header.Pages)
else:
bitmap_header_size = bitmap_size = bitmap_pages = renderers.NotApplicableValue()
yield(0, (utility.array_to_string(header.Signature),
header.MajorVersion,
header.MinorVersion,
@@ -36,10 +52,13 @@ class Crashinfo(interfaces.plugins.PluginInterface):
header.MachineImageType,
header.NumberProcessors,
format_hints.Hex(header.KdDebuggerDataBlock),
header.DumpType,
dump_type,
str(uptime),
utility.array_to_string(header.Comment),
conversion.wintime_to_datetime(header.SystemTime),
bitmap_header_size,
bitmap_size,
bitmap_pages,
))
def run(self):
@@ -54,8 +73,11 @@ class Crashinfo(interfaces.plugins.PluginInterface):
("MachineImageType", int),
("NumberProcessors", int),
("KdDebuggerDataBlock", format_hints.Hex),
("DumpType", int),
("DumpType", str),
("SystemUpTime", str),
("Comment", str),
("SystemTime", datetime.datetime),
("BitmapHeaderSize", format_hints.Hex),
("BitmapSize", format_hints.Hex),
("BitmapPages", format_hints.Hex),
], self._generator(layer))