WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-31 12:19:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #421 from volatilityfoundation/issue_368_windows_handles_x86_win8

Browse Source 
refs #368 fix handles on 32-bit windows 8 and 10 - finding SAR is not necessary on these platforms
This commit is contained in:
ikelos
2021-01-13 00:27:12 +00:00
committed by GitHub
parent 53169b15ab 2c3b6668d5
commit 1bfaf960ef
1 changed files with 21 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/handles.py
+21 -12
View File
@@ -5,7 +5,7 @@
import logging
from typing import List, Optional, Dict
from volatility.framework import constants, exceptions, renderers, interfaces
from volatility.framework import constants, exceptions, renderers, interfaces, symbols
from volatility.framework.configuration import requirements
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
@@ -80,20 +80,29 @@ class Handles(interfaces.plugins.PluginInterface):
object_header.GrantedAccess = handle_table_entry.GrantedAccess
except AttributeError:
# starting with windows 8
if handle_table_entry.LowValue == 0:
return None
is_64bit = symbols.symbol_table_is_64bit(self.context, self.config["nt_symbols"])
magic = self.find_sar_value()
if is_64bit:
if handle_table_entry.LowValue == 0:
return None
# is this the right thing to raise here?
if magic is None:
if has_capstone:
raise AttributeError("Unable to find the SAR value for decoding handle table pointers")
else:
raise exceptions.MissingModuleException(
"capstone", "Requires capstone to find the SAR value for decoding handle table pointers")
magic = self.find_sar_value()
# is this the right thing to raise here?
if magic is None:
if has_capstone:
raise AttributeError("Unable to find the SAR value for decoding handle table pointers")
else:
raise exceptions.MissingModuleException(
"capstone", "Requires capstone to find the SAR value for decoding handle table pointers")
offset = self._decode_pointer(handle_table_entry.LowValue, magic)
else:
if handle_table_entry.InfoTable == 0:
return None
offset = handle_table_entry.InfoTable & ~7
offset = self._decode_pointer(handle_table_entry.LowValue, magic)
# print("LowValue: {0:#x} Magic: {1:#x} Offset: {2:#x}".format(handle_table_entry.InfoTable, magic, offset))
object_header = self.context.object(self.config["nt_symbols"] + constants.BANG + "_OBJECT_HEADER",
virtual,