diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 5d319a946..9d3f10b8e 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -77,9 +77,9 @@ class _POOL_HEADER(objects.StructType): # were no optional headers in the first place (ie, if we read too much for headers that don't exist, # but the bit we could read were valid) infomask_data = self._context.layers[self.vol.layer_name].read( - start_offset + infomask_offset, addr_limit, pad = True) + start_offset, addr_limit + infomask_offset, pad = True) - for addr in range(0, addr_limit, alignment): + for addr in range(infomask_offset, addr_limit + infomask_offset, alignment): infomask_value = infomask_data[addr] optional_headers_length = 0 @@ -87,7 +87,28 @@ class _POOL_HEADER(objects.StructType): if infomask_value & (1 << i): optional_headers_length += lengths_of_optional_headers[i] - if optional_headers_length != addr: + # PADDING_INFO is a special case (4 bytes that contain the total padding length) + padding_length = 0 + if 0x80 & infomask_value: + # Read the four bytes from just before the next optional_headers_length minus the padding_info size + # + # --------------- + # POOL_HEADER + # --------------- + # + # start of PADDING_INFO + # --------------- + # End of other optional headers + # --------------- + # OBJECT_HEADER + # --------------- + optional_headers_length -= lengths_of_optional_headers[7] + if optional_headers_length < 4: + continue + padding_length = struct.unpack( + " List[int]: sizes = [] for header in [ - 'CREATOR_INFO', 'NAME_INFO', 'HANDLE_INFO', 'QUOTA_INFO', 'PROCESS_INFO', 'AUDIT_INFO', 'PADDING_INFO', - 'EXTENDED_INFO', 'HANDLE_REVOCATION_INFO' + 'CREATOR_INFO', 'NAME_INFO', 'HANDLE_INFO', 'QUOTA_INFO', 'PROCESS_INFO', 'AUDIT_INFO', 'EXTENDED_INFO', + 'HANDLE_REVOCATION_INFO', 'PADDING_INFO' ]: try: type_name = "{}{}_OBJECT_HEADER_{}".format(symbol_table_name, constants.BANG, header)