From 2c3b6668d5d9269ab0bc8c065bf3d3e8643bfa71 Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Wed, 6 Jan 2021 10:10:51 -0600 Subject: [PATCH] refs #368 fix handles on 32-bit windows 8 and 10 - finding SAR is not necessary on these versions --- .../framework/plugins/windows/handles.py | 33 ++++++++++++------- 1 file changed, 21 insertions(+), 12 deletions(-) diff --git a/volatility/framework/plugins/windows/handles.py b/volatility/framework/plugins/windows/handles.py index d09536868..5f697bc23 100644 --- a/volatility/framework/plugins/windows/handles.py +++ b/volatility/framework/plugins/windows/handles.py @@ -5,7 +5,7 @@ import logging from typing import List, Optional, Dict -from volatility.framework import constants, exceptions, renderers, interfaces +from volatility.framework import constants, exceptions, renderers, interfaces, symbols from volatility.framework.configuration import requirements from volatility.framework.objects import utility from volatility.framework.renderers import format_hints @@ -80,20 +80,29 @@ class Handles(interfaces.plugins.PluginInterface): object_header.GrantedAccess = handle_table_entry.GrantedAccess except AttributeError: # starting with windows 8 - if handle_table_entry.LowValue == 0: - return None + is_64bit = symbols.symbol_table_is_64bit(self.context, self.config["nt_symbols"]) - magic = self.find_sar_value() + if is_64bit: + if handle_table_entry.LowValue == 0: + return None - # is this the right thing to raise here? - if magic is None: - if has_capstone: - raise AttributeError("Unable to find the SAR value for decoding handle table pointers") - else: - raise exceptions.MissingModuleException( - "capstone", "Requires capstone to find the SAR value for decoding handle table pointers") + magic = self.find_sar_value() + + # is this the right thing to raise here? + if magic is None: + if has_capstone: + raise AttributeError("Unable to find the SAR value for decoding handle table pointers") + else: + raise exceptions.MissingModuleException( + "capstone", "Requires capstone to find the SAR value for decoding handle table pointers") + + offset = self._decode_pointer(handle_table_entry.LowValue, magic) + else: + if handle_table_entry.InfoTable == 0: + return None + + offset = handle_table_entry.InfoTable & ~7 - offset = self._decode_pointer(handle_table_entry.LowValue, magic) # print("LowValue: {0:#x} Magic: {1:#x} Offset: {2:#x}".format(handle_table_entry.InfoTable, magic, offset)) object_header = self.context.object(self.config["nt_symbols"] + constants.BANG + "_OBJECT_HEADER", virtual,