From 2c72439334500f67d25a6d4a237fa62734d3b7bb Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 13 Dec 2018 22:59:21 +0000 Subject: [PATCH] Add in protections for the crashdump layer. --- volatility/framework/layers/crash.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/volatility/framework/layers/crash.py b/volatility/framework/layers/crash.py index 42fcc4c98..3312e6aca 100644 --- a/volatility/framework/layers/crash.py +++ b/volatility/framework/layers/crash.py @@ -19,7 +19,7 @@ class WindowsCrashDump32FormatException(exceptions.LayerException): class WindowsCrashDump32Layer(segmented.SegmentedLayer): - """A Windows crash format TranslationLayer. This TranslationLayer supports + """A Windows crash format TranslationLayer. This TranslationLayer supports Microsoft complete memory dump files. It currently does not support kernel or small memory dump files.""" @@ -78,7 +78,7 @@ class WindowsCrashDump32Layer(segmented.SegmentedLayer): x.PageCount * 0x1000)) # print("Segments {:x} {:x} {:x}".format(x.BasePage * 0x1000, # offset * 0x1000, - # x.PageCount * 0x1000)) + # x.PageCount * 0x1000)) offset += x.PageCount if len(segments) == 0: @@ -92,7 +92,10 @@ class WindowsCrashDump32Layer(segmented.SegmentedLayer): offset: int = 0) -> typing.Tuple[int, int]: # Verify the Window's crash dump file magic - header_data = base_layer.read(offset, cls._magic_struct.size) + try: + header_data = base_layer.read(offset, cls._magic_struct.size) + except exceptions.InvalidAddressException: + raise WindowsCrashDump32FormatException("Crashdump header not found at offset {}".format(offset)) (signature, validdump) = cls._magic_struct.unpack(header_data) if signature != cls.SIGNATURE: