diff --git a/volatility/framework/layers/intel.py b/volatility/framework/layers/intel.py new file mode 100644 index 000000000..e6474debc --- /dev/null +++ b/volatility/framework/layers/intel.py @@ -0,0 +1,58 @@ +''' +Created on 7 May 2013 + +@author: mike +''' + +import struct +from volatility.framework import interfaces + +class Intel(interfaces.layers.TranslationLayerInterface): + """Translation Layer for the Intel IA32 memory mapping""" + + def __init__(self, context, name, memory_layer, pagefile_layer = None, page_map_offset = None): + interfaces.layers.TranslationLayerInterface.__init__(self, context, name) + self._basename = memory_layer + self._pagefile = pagefile_layer + + # AMD64 + #self._structure = [('pml4', 51, 40, None, 47, 9, 11, None, None, None), + # ('pdpt', 51, 40, None, 38, 9, 11, None, None, None), + # ('pd', 51, 40, None, 29, 9, 11, None, None, None), + # ('pt', 51, 40, None, 20, 9, 11, None, None, None)] + self._structure = [('pd', 31, 20, None, 31, 10, 11, None, None, None), + ('pt', 31, 20, None, 21, 10, 11, None, None, None), + ('p', 31, 20, None, 11, 10, 11, None, None, None) ] + + self._page_map_offset = page_map_offset + + def translate(self, offset): + """Translates a specific offset based on the paging tables""" + entry = self._page_map_offset + for (name, entry_start, entry_len, entry_map, offset_start, offset_len, offset_map, page_start, page_len, page_map) in self._structure: + # Check page is present + # Check for large pages + if page_start is not None and (entry & (0x1 << 7)): + return self._entry(entry, offset, entry_start, entry_len, entry_map, page_start, page_len, page_map) + index = self._entry(entry, offset, entry_start, entry_len, entry_map, offset_start, offset_len, offset_map) + # print(name, "index", hex(index)) + entry = struct.unpack("> (value_start - value_length + 1)) << (value_map - value_length + 1) + return (value & value_mask) + + +