WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 19:57:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

run optimized scan before slow scan

Browse Source
This commit is contained in:
Paul Kermann
2022-02-17 16:10:44 +02:00
parent da7dd32271
commit 3036875136
1 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/automagic/pdbscan.py
+9 -3
View File
@@ -146,8 +146,13 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface):
return None
return (virtual_layer_name, kernel['mz_offset'], kernel)
vollog.debug("Kernel base determination - optimized scan virtual layer")
valid_kernel = self._method_layer_pdb_scan(context, vlayer, test_virtual_kernel, True, False, progress_callback)
if valid_kernel != None:
return valid_kernel
vollog.debug("Kernel base determination - slow scan virtual layer")
return self._method_layer_pdb_scan(context, vlayer, test_virtual_kernel, False, progress_callback)
return self._method_layer_pdb_scan(context, vlayer, test_virtual_kernel, False, False, progress_callback)
def method_fixed_mapping(self,
context: interfaces.context.ContextInterface,
@@ -175,12 +180,13 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface):
vollog.debug(f"Potential kernel_virtual_offset caused a page fault: {hex(kvo)}")
vollog.debug("Kernel base determination - testing fixed base address")
return self._method_layer_pdb_scan(context, vlayer, test_physical_kernel, True, progress_callback)
return self._method_layer_pdb_scan(context, vlayer, test_physical_kernel, False, True, progress_callback)
def _method_layer_pdb_scan(self,
context: interfaces.context.ContextInterface,
vlayer: layers.intel.Intel,
test_kernel: Callable,
optimized: bool = False,
physical: bool = True,
progress_callback: constants.ProgressCallback = None) -> Optional[ValidKernelType]:
# TODO: Verify this is a windows image
@@ -193,7 +199,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface):
layer_to_scan = virtual_layer_name
start_scan_address = 0
if not physical and context.layers[layer_to_scan].metadata.architecture in ["Intel64"]:
if optimized and not physical and context.layers[layer_to_scan].metadata.architecture in ["Intel64"]:
# TODO: change this value accordingly when 5-Level paging is supported.
start_scan_address = (0x1f0 << 39)