From 99672cbe759f22ff0518014a8c93d05bc2d188ca Mon Sep 17 00:00:00 2001 From: Paul Kermann Date: Mon, 15 Aug 2022 15:27:19 +0300 Subject: [PATCH 1/4] improv commit --- volatility3/framework/symbols/windows/pdbutil.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py index 430ad6a30..9f83ad973 100644 --- a/volatility3/framework/symbols/windows/pdbutil.py +++ b/volatility3/framework/symbols/windows/pdbutil.py @@ -253,7 +253,8 @@ class PDBUtility(interfaces.configuration.VersionableInterface): pdb_names: List[bytes], progress_callback: constants.ProgressCallback = None, start: Optional[int] = None, - end: Optional[int] = None) -> Generator[Dict[str, Optional[Union[bytes, str, int]]], None, None]: + end: Optional[int] = None, + maximum_invalid_count: int = 100) -> Generator[Dict[str, Optional[Union[bytes, str, int]]], None, None]: """Scans through `layer_name` at `ctx` looking for RSDS headers that indicate one of four common pdb kernel names (as listed in `self.pdb_names`) and returns the tuple (GUID, age, pdb_name, @@ -278,10 +279,15 @@ class PDBUtility(interfaces.configuration.VersionableInterface): sections = [(start, end - start)]): mz_offset = None sig_pfn = signature_offset // page_size + current_invalid_counter = 0 for i in range(sig_pfn, min_pfn, -1): - if not ctx.layers[layer_name].is_valid(i * page_size, 2): + if current_invalid_counter > maximum_invalid_count: break + + if not ctx.layers[layer_name].is_valid(i * page_size, 2): + current_invalid_counter += 1 + continue data = ctx.layers[layer_name].read(i * page_size, 2) if data == b'MZ': From afb17dfac8ef35950803e549bb127f920ae7eef0 Mon Sep 17 00:00:00 2001 From: Paul Kermann Date: Wed, 24 Aug 2022 14:14:50 +0300 Subject: [PATCH 2/4] use the maximum_invalid_count --- volatility3/framework/automagic/pdbscan.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/automagic/pdbscan.py b/volatility3/framework/automagic/pdbscan.py index 5cbdbfe0e..0cb01485e 100644 --- a/volatility3/framework/automagic/pdbscan.py +++ b/volatility3/framework/automagic/pdbscan.py @@ -212,7 +212,8 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): start = start_scan_address, page_size = vlayer.page_size, pdb_names = kernel_pdb_names, - progress_callback = progress_callback) + progress_callback = progress_callback, + maximum_invalid_count = constants.windows.PE_MAX_EXTRACTION_SIZE // 0x1000) for kernel in kernels: valid_kernel = test_kernel(physical_layer_name, virtual_layer_name, kernel) if valid_kernel is not None: From 26d15a3ad5069a99702c2d672d8d10c68f64f0b6 Mon Sep 17 00:00:00 2001 From: Paul Kermann Date: Wed, 31 Aug 2022 09:40:22 +0300 Subject: [PATCH 3/4] code review --- volatility3/framework/automagic/pdbscan.py | 3 +-- volatility3/framework/symbols/windows/pdbutil.py | 8 ++++++++ 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/automagic/pdbscan.py b/volatility3/framework/automagic/pdbscan.py index 0cb01485e..5cbdbfe0e 100644 --- a/volatility3/framework/automagic/pdbscan.py +++ b/volatility3/framework/automagic/pdbscan.py @@ -212,8 +212,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): start = start_scan_address, page_size = vlayer.page_size, pdb_names = kernel_pdb_names, - progress_callback = progress_callback, - maximum_invalid_count = constants.windows.PE_MAX_EXTRACTION_SIZE // 0x1000) + progress_callback = progress_callback) for kernel in kernels: valid_kernel = test_kernel(physical_layer_name, virtual_layer_name, kernel) if valid_kernel is not None: diff --git a/volatility3/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py index 9f83ad973..311cc6451 100644 --- a/volatility3/framework/symbols/windows/pdbutil.py +++ b/volatility3/framework/symbols/windows/pdbutil.py @@ -264,6 +264,14 @@ class PDBUtility(interfaces.configuration.VersionableInterface): The UI should always provide the user an opportunity to specify the appropriate types and PDB values themselves + Args: + layer_name: The layer name to scan + page_size: Size of page constant + pdb_names: List of pdb names to scan + progress_callback: Means of providing the user with feedback during long processes + start: Start address to start scanning from the pdb_names + end: Minimum address to scan the pdb_names + maximum_invalid_count: Amount of pages that can be invalid during scanning before aborting signature search """ min_pfn = 0 From 2a3212e77b74d0ab0d8c3aeaebea3d0a55866a29 Mon Sep 17 00:00:00 2001 From: Paul Kermann Date: Wed, 31 Aug 2022 10:26:38 +0300 Subject: [PATCH 4/4] remove whitespace --- volatility3/framework/symbols/windows/pdbutil.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py index 311cc6451..8b58442cc 100644 --- a/volatility3/framework/symbols/windows/pdbutil.py +++ b/volatility3/framework/symbols/windows/pdbutil.py @@ -292,7 +292,7 @@ class PDBUtility(interfaces.configuration.VersionableInterface): for i in range(sig_pfn, min_pfn, -1): if current_invalid_counter > maximum_invalid_count: break - + if not ctx.layers[layer_name].is_valid(i * page_size, 2): current_invalid_counter += 1 continue