WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-26 16:12:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix get_sids function

Browse Source 
fix get_sids function in broken images
This commit is contained in:
memoryforensics1
2020-09-22 18:30:54 +01:00
committed by ikelos
parent 31080ad416
commit 30be4ee2ec
1 changed files with 20 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/symbols/windows/extensions/__init__.py
+20 -17
View File
@@ -768,23 +768,26 @@ class TOKEN(objects.StructType):
subtype = ntkrnlmp.get_type("_SID_AND_ATTRIBUTES"),
count=self.UserAndGroupCount)
for sid_and_attr in UserAndGroups:
sid = sid_and_attr.Sid.dereference().cast("_SID")
# catch invalid pointers (UserAndGroupCount is too high)
if sid is None:
return
# this mimics the windows API IsValidSid
if sid.Revision & 0xF != 1 or sid.SubAuthorityCount > 15:
return
id_auth = ""
for i in sid.IdentifierAuthority.Value:
id_auth = i
SubAuthority = ntkrnlmp.object(object_type="array",
offset=sid.SubAuthority.vol.offset - kvo,
subtype = ntkrnlmp.get_type("unsigned long"),
count= int(sid.SubAuthorityCount))
yield "S-" + "-".join(str(i) for i in (sid.Revision, id_auth) +
tuple(SubAuthority))
try:
sid = sid_and_attr.Sid.dereference().cast("_SID")
# catch invalid pointers (UserAndGroupCount is too high)
if sid is None:
return
# this mimics the windows API IsValidSid
if sid.Revision & 0xF != 1 or sid.SubAuthorityCount > 15:
return
id_auth = ""
for i in sid.IdentifierAuthority.Value:
id_auth = i
SubAuthority = ntkrnlmp.object(object_type="array",
offset=sid.SubAuthority.vol.offset - kvo,
subtype = ntkrnlmp.get_type("unsigned long"),
count= int(sid.SubAuthorityCount))
yield "S-" + "-".join(str(i) for i in (sid.Revision, id_auth) +
tuple(SubAuthority))
except exceptions.InvalidAddressException:
pass
def privileges(self):
"Return a list of privileges for the current token object."