From 00db33e0feef43e8300c785cc0b0d35e38e753fe Mon Sep 17 00:00:00 2001
From: iMHLv2 <mligh@volexity.com>
Date: Wed, 31 Mar 2021 09:52:12 -0500
Subject: [PATCH] print human readable dump type in crashinfo, along with
 bitmap header size, bitmap size, and page count

---
 volatility3/framework/layers/crash.py         |  9 ++++---
 .../framework/plugins/windows/crashinfo.py    | 26 +++++++++++++++++--
 2 files changed, 30 insertions(+), 5 deletions(-)

diff --git a/volatility3/framework/layers/crash.py b/volatility3/framework/layers/crash.py
index 8d6b479fc..1a15ffde4 100644
--- a/volatility3/framework/layers/crash.py
+++ b/volatility3/framework/layers/crash.py
@@ -78,6 +78,11 @@ class WindowsCrashDump32Layer(segmented.SegmentedLayer):
                                    offset=0,
                                    layer_name=self._base_layer)
 
+    def get_summary_header(self) -> interfaces.objects.ObjectInterface:
+        return self.context.object(self._crash_common_table_name + constants.BANG + "_SUMMARY_DUMP",
+                                   offset=0x1000 * self.headerpages,
+                                   layer_name=self._base_layer)
+
     def _load_segments(self) -> None:
         """Loads up the segments from the meta_layer."""
 
@@ -85,9 +90,7 @@ class WindowsCrashDump32Layer(segmented.SegmentedLayer):
 
         # instead of hard coding 0x2000, use 0x1000 * self.headerpages so this works for
         # both 32- and 64-bit dumps
-        summary_header = self.context.object(self._crash_common_table_name + constants.BANG + "_SUMMARY_DUMP",
-                                             offset=0x1000 * self.headerpages,
-                                             layer_name=self._base_layer)
+        summary_header = self.get_summary_header()
         if self.dump_type == 0x1:
             header = self.context.object(self._crash_table_name + constants.BANG + self.dump_header_name,
                                          offset=0,
diff --git a/volatility3/framework/plugins/windows/crashinfo.py b/volatility3/framework/plugins/windows/crashinfo.py
index 70f4239f5..5ec123b44 100644
--- a/volatility3/framework/plugins/windows/crashinfo.py
+++ b/volatility3/framework/plugins/windows/crashinfo.py
@@ -26,6 +26,22 @@ class Crashinfo(interfaces.plugins.PluginInterface):
         header = layer.get_header()
         uptime = datetime.timedelta(microseconds=int(header.SystemUpTime) / 10)
 
+        if header.DumpType == 0x1:
+            dump_type = "Full Dump (0x1)"
+        elif header.DumpType == 0x5:
+            dump_type = "Bitmap Dump (0x5)"
+        else:
+            # this should never happen since the crash layer only accepts 0x1 and 0x5
+            dump_type = "Unknown/Unsupported ({:#x})".format(header.DumpType)
+
+        if header.DumpType == 0x5:
+            summary_header = layer.get_summary_header()
+            bitmap_header_size = format_hints.Hex(summary_header.HeaderSize)
+            bitmap_size = format_hints.Hex(summary_header.BitmapSize)
+            bitmap_pages = format_hints.Hex(summary_header.Pages)
+        else:
+            bitmap_header_size = bitmap_size = bitmap_pages = renderers.NotApplicableValue()
+
         yield(0, (utility.array_to_string(header.Signature),
                   header.MajorVersion,
                   header.MinorVersion,
@@ -36,10 +52,13 @@ class Crashinfo(interfaces.plugins.PluginInterface):
                   header.MachineImageType,
                   header.NumberProcessors,
                   format_hints.Hex(header.KdDebuggerDataBlock),
-                  header.DumpType,
+                  dump_type,
                   str(uptime),
                   utility.array_to_string(header.Comment),
                   conversion.wintime_to_datetime(header.SystemTime),
+                  bitmap_header_size,
+                  bitmap_size,
+                  bitmap_pages,
                   ))
 
     def run(self):
@@ -54,8 +73,11 @@ class Crashinfo(interfaces.plugins.PluginInterface):
                                    ("MachineImageType", int),
                                    ("NumberProcessors", int),
                                    ("KdDebuggerDataBlock", format_hints.Hex),
-                                   ("DumpType", int),
+                                   ("DumpType", str),
                                    ("SystemUpTime", str),
                                    ("Comment", str),
                                    ("SystemTime", datetime.datetime),
+                                   ("BitmapHeaderSize", format_hints.Hex),
+                                   ("BitmapSize", format_hints.Hex),
+                                   ("BitmapPages", format_hints.Hex),
                                    ], self._generator(layer))
\ No newline at end of file