WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 03:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1632 from volatilityfoundation/fix_poolscanners

Browse Source 
Check Win10+ SlushSize member to support Windows 11 pool scanning. Re…
This commit is contained in:
ikelos
2025-02-23 22:38:32 +00:00
committed by GitHub
parent 2ffb3ac6b1 ba56e42634
commit 37bdb6cb99
2 changed files with 18 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/poolscanner.py
+15 -14
View File
@@ -205,6 +205,7 @@ class PoolScanner(plugins.PluginInterface):
b"AtmT",
type_name=symbol_table + constants.BANG + "_RTL_ATOM_TABLE",
size=(200, None),
# TODO - update this after the GUI code goes on
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
),
# processes on windows before windows 8
@@ -214,7 +215,7 @@ class PoolScanner(plugins.PluginInterface):
object_type="Process",
size=(600, None),
skip_type_test=True,
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
page_type=PoolType.NONPAGED | PoolType.FREE,
),
# processes on windows starting with windows 8
PoolConstraint(
@@ -223,7 +224,7 @@ class PoolScanner(plugins.PluginInterface):
object_type="Process",
size=(600, None),
skip_type_test=True,
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
page_type=PoolType.NONPAGED | PoolType.FREE,
),
# threads on windows before windows8
PoolConstraint(
@@ -232,7 +233,7 @@ class PoolScanner(plugins.PluginInterface):
object_type="Thread",
size=(600, None), # -> 0x0258 - size of struct in win5.1
skip_type_test=True,
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
page_type=PoolType.NONPAGED | PoolType.FREE,
),
# threads on windows starting with windows8
PoolConstraint(
@@ -240,7 +241,7 @@ class PoolScanner(plugins.PluginInterface):
type_name=symbol_table + constants.BANG + "_ETHREAD",
object_type="Thread",
size=(600, None), # -> 0x0258 - size of struct in win5.1
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
page_type=PoolType.NONPAGED | PoolType.FREE,
),
# files on windows before windows 8
PoolConstraint(
@@ -248,7 +249,7 @@ class PoolScanner(plugins.PluginInterface):
type_name=symbol_table + constants.BANG + "_FILE_OBJECT",
object_type="File",
size=(150, None),
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
page_type=PoolType.NONPAGED | PoolType.FREE,
),
# files on windows starting with windows 8
PoolConstraint(
@@ -256,7 +257,7 @@ class PoolScanner(plugins.PluginInterface):
type_name=symbol_table + constants.BANG + "_FILE_OBJECT",
object_type="File",
size=(150, None),
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
page_type=PoolType.NONPAGED | PoolType.FREE,
),
# mutants on windows before windows 8
PoolConstraint(
@@ -264,7 +265,7 @@ class PoolScanner(plugins.PluginInterface):
type_name=symbol_table + constants.BANG + "_KMUTANT",
object_type="Mutant",
size=(64, None),
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
page_type=PoolType.NONPAGED | PoolType.FREE,
),
# mutants on windows starting with windows 8
PoolConstraint(
@@ -272,7 +273,7 @@ class PoolScanner(plugins.PluginInterface):
type_name=symbol_table + constants.BANG + "_KMUTANT",
object_type="Mutant",
size=(64, None),
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
page_type=PoolType.NONPAGED | PoolType.FREE,
),
# drivers on windows before windows 8
PoolConstraint(
@@ -280,7 +281,7 @@ class PoolScanner(plugins.PluginInterface):
type_name=symbol_table + constants.BANG + "_DRIVER_OBJECT",
object_type="Driver",
size=(248, None),
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
page_type=PoolType.NONPAGED | PoolType.FREE,
additional_structures=["_DRIVER_EXTENSION"],
),
# drivers on windows starting with windows 8
@@ -289,14 +290,14 @@ class PoolScanner(plugins.PluginInterface):
type_name=symbol_table + constants.BANG + "_DRIVER_OBJECT",
object_type="Driver",
size=(248, None),
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
page_type=PoolType.NONPAGED | PoolType.FREE,
),
# kernel modules
PoolConstraint(
b"MmLd",
type_name=symbol_table + constants.BANG + "_LDR_DATA_TABLE_ENTRY",
size=(76, None),
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
page_type=PoolType.NONPAGED | PoolType.FREE,
),
# symlinks on windows before windows 8
PoolConstraint(
@@ -304,7 +305,7 @@ class PoolScanner(plugins.PluginInterface):
type_name=symbol_table + constants.BANG + "_OBJECT_SYMBOLIC_LINK",
object_type="SymbolicLink",
size=(72, None),
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
page_type=PoolType.NONPAGED | PoolType.FREE,
),
# symlinks on windows starting with windows 8
PoolConstraint(
@@ -312,14 +313,14 @@ class PoolScanner(plugins.PluginInterface):
type_name=symbol_table + constants.BANG + "_OBJECT_SYMBOLIC_LINK",
object_type="SymbolicLink",
size=(72, None),
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
page_type=PoolType.NONPAGED | PoolType.FREE,
),
# registry hives
PoolConstraint(
b"CM10",
type_name=symbol_table + constants.BANG + "_CMHIVE",
size=(800, None),
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
page_type=PoolType.PAGED | PoolType.FREE,
skip_type_test=True,
),
]
volatility3/framework/symbols/windows/__init__.py
+3 -1
View File
@@ -48,7 +48,9 @@ class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable):
# This doesn't exist in very specific versions of windows
with contextlib.suppress(ValueError):
if self.get_type("_POOL_TRACKER_BIG_PAGES").has_member("PoolType"):
if self.get_type("_POOL_TRACKER_BIG_PAGES").has_member(
"PoolType"
) or self.get_type("_POOL_TRACKER_BIG_PAGES").has_member("SlushSize"):
self.set_type_class("_POOL_HEADER", pool.POOL_HEADER_VISTA)
else:
self.set_type_class("_POOL_HEADER", pool.POOL_HEADER)