WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-29 19:29:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

issue #306 - _POOL_HEADER class based on OS

Browse Source
This commit is contained in:
Dave Lassalle
2020-08-22 22:27:46 +01:00
committed by ikelos
parent 288a017178
commit 09ca2ecb40
3 changed files with 40 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/poolscanner.py
+13 -4
View File
@@ -85,11 +85,11 @@ class PoolHeaderScanner(interfaces.layers.ScannerInterface):
if constraint.page_type is not None:
checks_pass = False
if (constraint.page_type & PoolType.FREE) and header.PoolType == 0:
if (constraint.page_type & PoolType.FREE) and header.is_free_pool():
checks_pass = True
elif (constraint.page_type & PoolType.PAGED) and header.PoolType % 2 == 0 and header.PoolType > 0:
elif (constraint.page_type & PoolType.NONPAGED) and header.is_nonpaged_pool():
checks_pass = True
elif (constraint.page_type & PoolType.NONPAGED) and header.PoolType % 2 == 1:
elif (constraint.page_type & PoolType.PAGED) and header.is_paged_pool:
checks_pass = True
if not checks_pass:
@@ -202,6 +202,9 @@ class PoolScanner(plugins.PluginInterface):
fallback_checks = [("_OBJECT_HEADER", "TypeIndex", True),
("_HANDLE_TABLE", "HandleCount", True)])
is_vista_or_later = os_distinguisher(version_check = lambda x: x >= (6, 0),
fallback_checks = [("KdCopyDataBlock", None, True)])
def _generator(self):
symbol_table = self.config["nt_symbols"]
@@ -445,13 +448,19 @@ class PoolScanner(plugins.PluginInterface):
else:
pool_header_json_filename = "poolheader-x86"
is_vista_or_later = cls.is_vista_or_later(context, symbol_table)
if is_vista_or_later:
class_type = extensions.pool.POOL_HEADER_VISTA
else:
class_type = extensions.pool.POOL_HEADER
new_table_name = intermed.IntermediateSymbolTable.create(
context = context,
config_path = configuration.path_join(context.symbol_space[symbol_table].config_path, "poolheader"),
sub_path = "windows",
filename = pool_header_json_filename,
table_mapping = {'nt_symbols': symbol_table},
class_types = {'_POOL_HEADER': extensions.pool.POOL_HEADER})
class_types = {'_POOL_HEADER': class_type})
module = context.module(new_table_name, layer_name, offset = 0)
return module