diff --git a/volatility3/framework/automagic/pdbscan.py b/volatility3/framework/automagic/pdbscan.py index 7d289bcb6..f9c0d853d 100644 --- a/volatility3/framework/automagic/pdbscan.py +++ b/volatility3/framework/automagic/pdbscan.py @@ -376,26 +376,6 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): valid_kernel = (virtual_layer_name, address, res[0]) return valid_kernel - class LowStubLayout: - """ - Represents the layout of the Low Stub which exists only on x64 machines with no virtualization/emulation, - responsible for transitioning from Real Mode(16 bit) to Protected Mode(32 bit) and Long Mode(64 bit) on boot/return from sleep. - Contains offsets to fields and structures within the undocumented structure _PROCESSOR_START_BLOCK. - Here's a reference: https://github.com/mic101/windows/blob/master/WRK-v1.2/base/ntos/inc/amd64.h#L3334 - """ - - # Expected signature for validation, constructed from: - # PROCESSOR_START_BLOCK->Jmp->OpCode | PROCESSOR_START_BLOCK->Jmp->Offset | PROCESSOR_START_BLOCK->CompletionFlag - JMP_AND_COMPLETION_SIGNATURE = 0x00000001000600E9 - - # Address of LmTarget (Long Mode target) - PROCESSOR_START_BLOCK_LM_TARGET_OFFSET = ( - 0x70 # PROCESSOR_START_BLOCK->LmTarget, PVOID 8 bytes - ) - - # CR3 register within structures describing initial processor state to be started - PROCESSOR_START_BLOCK_CR3_OFFSET = 0xA0 # PROCESSOR_START_BLOCK->ProcessorState->SpecialRegisters->Cr3, ULONG64 8 bytes - def method_low_stub_offset( self, context: interfaces.context.ContextInterface, @@ -417,12 +397,12 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): ) if ( 0xFFFFFFFFFFFF00FF & jmp_and_completion_values - != self.LowStubLayout.JMP_AND_COMPLETION_SIGNATURE + != constants.windows.JMP_AND_COMPLETION_SIGNATURE ): continue cr3_value = int.from_bytes( physical_layer.read( - offset + self.LowStubLayout.PROCESSOR_START_BLOCK_CR3_OFFSET, 0x8 + offset + constants.windows.PROCESSOR_START_BLOCK_CR3_OFFSET, 0x8 ), "little", ) @@ -434,7 +414,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): continue potential_kernel_hint = int.from_bytes( physical_layer.read( - offset + self.LowStubLayout.PROCESSOR_START_BLOCK_LM_TARGET_OFFSET, + offset + constants.windows.PROCESSOR_START_BLOCK_LM_TARGET_OFFSET, 0x8, ), "little", diff --git a/volatility3/framework/constants/windows/__init__.py b/volatility3/framework/constants/windows/__init__.py index 7face984a..6f37acd2d 100644 --- a/volatility3/framework/constants/windows/__init__.py +++ b/volatility3/framework/constants/windows/__init__.py @@ -10,3 +10,21 @@ KERNEL_MODULE_NAMES = ["ntkrnlmp", "ntkrnlpa", "ntkrpamp", "ntoskrnl"] """The list of names that kernel modules can have within the windows OS""" PE_MAX_EXTRACTION_SIZE = 1024 * 1024 * 256 + +""" +The following constants represent the layout of the Low Stub which exists only on x64 machines with no virtualization/emulation, +responsible for transitioning from Real Mode(16 bit) to Protected Mode(32 bit) and Long Mode(64 bit) on boot/return from sleep. +Contains offsets to fields and structures within the undocumented structure _PROCESSOR_START_BLOCK. +Here's a reference: https://github.com/mic101/windows/blob/master/WRK-v1.2/base/ntos/inc/amd64.h#L3334 +""" +# Expected signature for validation, constructed from: +# PROCESSOR_START_BLOCK->Jmp->OpCode | PROCESSOR_START_BLOCK->Jmp->Offset | PROCESSOR_START_BLOCK->CompletionFlag +JMP_AND_COMPLETION_SIGNATURE = 0x00000001000600E9 + +# Address of LmTarget (Long Mode target) +PROCESSOR_START_BLOCK_LM_TARGET_OFFSET = ( + 0x70 # PROCESSOR_START_BLOCK->LmTarget, PVOID 8 bytes +) + +# CR3 register within structures describing initial processor state to be started +PROCESSOR_START_BLOCK_CR3_OFFSET = 0xA0 # PROCESSOR_START_BLOCK->ProcessorState->SpecialRegisters->Cr3, ULONG64 8 bytes