WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-07 10:17:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Catch exceptions triggered during testing

Browse Source
This commit is contained in:
atcuno
2021-03-19 12:49:54 -05:00
parent d3b407515a
commit 21b59e9458
1 changed files with 19 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/skeleton_key_check.py
+19 -4
View File
@@ -145,7 +145,11 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface):
cryptdll_module = self.context.module(cryptdll_symbols, layer_name = proc_layer_name, offset = cryptdll_base)
count_address = cryptdll_module.get_symbol("cCSystems").address
count = cryptdll_types.object(object_type = "unsigned long", offset = count_address)
try:
count = cryptdll_types.object(object_type = "unsigned long", offset = count_address)
except exceptions.InvalidAddressException:
count = 16
array_start = cryptdll_module.get_symbol("CSystems").address + cryptdll_base
@@ -258,13 +262,17 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface):
return None, None, None
array_start, count, rc4HmacInitialize, rc4HmacDecrypt = self._find_array_with_pdb_symbols(cryptdll_symbols, cryptdll_types, proc_layer_name, cryptdll_base)
array = cryptdll_types.object(object_type = "array",
try:
array = cryptdll_types.object(object_type = "array",
offset = array_start,
subtype = cryptdll_types.get_type("_KERB_ECRYPT"),
count = count,
absolute = True)
except exceptions.InvalidAddressException:
return None, None, None
return array, rc4HmacInitialize, rc4HmacDecrypt
def _get_rip_relative_target(self, inst) -> int:
@@ -410,12 +418,16 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface):
break
if array_start:
array = cryptdll_types.object(object_type = "array",
try:
array = cryptdll_types.object(object_type = "array",
offset = array_start,
subtype = cryptdll_types.get_type("_KERB_ECRYPT"),
count = count,
absolute = True)
except exceptions.InvalidAddressException:
return None, None, None
return array, None, None
def _find_csystems_with_scanning(self, proc_layer_name: str,
@@ -525,6 +537,9 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface):
found_target = False
for csystem in csystems:
if not self.context.layers[proc_layer_name].is_valid(csystem.vol.offset, csystem.vol.size):
continue
# filter for RC4 HMAC
if csystem.EncryptionType != 0x17:
continue