From 2c3b6668d5d9269ab0bc8c065bf3d3e8643bfa71 Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Wed, 6 Jan 2021 10:10:51 -0600 Subject: [PATCH 1/3] refs #368 fix handles on 32-bit windows 8 and 10 - finding SAR is not necessary on these versions --- .../framework/plugins/windows/handles.py | 33 ++++++++++++------- 1 file changed, 21 insertions(+), 12 deletions(-) diff --git a/volatility/framework/plugins/windows/handles.py b/volatility/framework/plugins/windows/handles.py index d09536868..5f697bc23 100644 --- a/volatility/framework/plugins/windows/handles.py +++ b/volatility/framework/plugins/windows/handles.py @@ -5,7 +5,7 @@ import logging from typing import List, Optional, Dict -from volatility.framework import constants, exceptions, renderers, interfaces +from volatility.framework import constants, exceptions, renderers, interfaces, symbols from volatility.framework.configuration import requirements from volatility.framework.objects import utility from volatility.framework.renderers import format_hints @@ -80,20 +80,29 @@ class Handles(interfaces.plugins.PluginInterface): object_header.GrantedAccess = handle_table_entry.GrantedAccess except AttributeError: # starting with windows 8 - if handle_table_entry.LowValue == 0: - return None + is_64bit = symbols.symbol_table_is_64bit(self.context, self.config["nt_symbols"]) - magic = self.find_sar_value() + if is_64bit: + if handle_table_entry.LowValue == 0: + return None - # is this the right thing to raise here? - if magic is None: - if has_capstone: - raise AttributeError("Unable to find the SAR value for decoding handle table pointers") - else: - raise exceptions.MissingModuleException( - "capstone", "Requires capstone to find the SAR value for decoding handle table pointers") + magic = self.find_sar_value() + + # is this the right thing to raise here? + if magic is None: + if has_capstone: + raise AttributeError("Unable to find the SAR value for decoding handle table pointers") + else: + raise exceptions.MissingModuleException( + "capstone", "Requires capstone to find the SAR value for decoding handle table pointers") + + offset = self._decode_pointer(handle_table_entry.LowValue, magic) + else: + if handle_table_entry.InfoTable == 0: + return None + + offset = handle_table_entry.InfoTable & ~7 - offset = self._decode_pointer(handle_table_entry.LowValue, magic) # print("LowValue: {0:#x} Magic: {1:#x} Offset: {2:#x}".format(handle_table_entry.InfoTable, magic, offset)) object_header = self.context.object(self.config["nt_symbols"] + constants.BANG + "_OBJECT_HEADER", virtual, From 53169b15ab9d47b8ac97bb48f3e9821431505dd7 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 8 Jan 2021 17:40:52 +0000 Subject: [PATCH 2/3] Intel: Fix PAE typo --- volatility/framework/layers/intel.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/framework/layers/intel.py b/volatility/framework/layers/intel.py index 86bf26de7..cdff9ce7e 100644 --- a/volatility/framework/layers/intel.py +++ b/volatility/framework/layers/intel.py @@ -247,7 +247,7 @@ class IntelPAE(Intel): _maxphyaddr = 40 _maxvirtaddr = 32 _structure = [('page directory pointer', 2, False), ('page directory', 9, True), ('page table', 9, True)] - _direct_metadata = collections.ChainMap({'pae', True}, Intel._direct_metadata) + _direct_metadata = collections.ChainMap({'pae': True}, Intel._direct_metadata) class Intel32e(Intel): From 89a3d441ff58e9fa5c5cb9ffb157edb851a666cf Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 13 Jan 2021 00:54:50 +0000 Subject: [PATCH 3/3] Layerwriter: Ensure we autochoose by default --- volatility/framework/plugins/layerwriter.py | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/volatility/framework/plugins/layerwriter.py b/volatility/framework/plugins/layerwriter.py index 571079f6f..5b4492c6c 100644 --- a/volatility/framework/plugins/layerwriter.py +++ b/volatility/framework/plugins/layerwriter.py @@ -34,11 +34,12 @@ class LayerWriter(plugins.PluginInterface): description = 'List available layers', default = False, optional = True), - requirements.ListRequirement(name = 'layers', - element_type = str, - description = 'Names of layer to write', - default = None, - optional = True) + requirements.ListRequirement( + name = 'layers', + element_type = str, + description = 'Names of layers to write (defaults to the highest non-mapped layer)', + default = None, + optional = True) ] @classmethod @@ -83,7 +84,7 @@ class LayerWriter(plugins.PluginInterface): yield 0, (name, ) else: # Choose the most recently added layer that isn't virtual - if self.config['layers'] is None: + if not self.config['layers']: self.config['layers'] = [] for name in self.context.layers: if not self.context.layers[name].metadata.get('mapped', False):