WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-17 20:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Virtmap: Improve debugging messages and issues ignoring unused memory.

Browse Source
This commit is contained in:
Mike Auty
2019-12-05 00:20:53 +00:00
parent f4522c07d9
commit 4295401afd
2 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/poolscanner.py
+2 -1
View File
@@ -367,10 +367,11 @@ class PoolScanner(plugins.PluginInterface):
sections = None
if quick:
vollog.debug("Locating windows allocated sections to scan")
scan_module = context.module(module_name = symbol_table,
layer_name = scan_layer,
offset = context.layers[scan_layer].config['kernel_virtual_offset'])
sections = virtmap.VirtMap.scannable_sections(scan_module)
sections = list(virtmap.VirtMap.scannable_sections(scan_module))
is_windows_10 = cls.is_windows_10(context, symbol_table)
if not is_windows_10:
volatility/framework/plugins/windows/virtmap.py
+8 -5
View File
@@ -5,7 +5,7 @@
import logging
from typing import List, Tuple, Dict, Generator
from volatility.framework import interfaces, renderers, exceptions
from volatility.framework import interfaces, renderers, exceptions, constants
from volatility.framework.configuration import requirements
from volatility.framework.layers import intel
from volatility.framework.renderers import format_hints
@@ -54,6 +54,7 @@ class VirtMap(interfaces.plugins.PluginInterface):
offset = symbol.address,
subtype = module.get_type('_MI_VISIBLE_STATE')).dereference()
if hasattr(visible_state, 'SystemVaRegions'):
vollog.log(constants.LOGLEVEL_VVVV, "Using MiVisibleState - SystemVaRegions")
for i in range(visible_state.SystemVaRegions.count):
lookup = system_va_type.lookup(i)
region_range = result.get(lookup, [])
@@ -61,6 +62,7 @@ class VirtMap(interfaces.plugins.PluginInterface):
(visible_state.SystemVaRegions[i].BaseAddress, visible_state.SystemVaRegions[i].NumberOfBytes))
result[lookup] = region_range
elif hasattr(visible_state, 'SystemVaType'):
vollog.log(constants.LOGLEVEL_VVVV, "Using MiVisibleState - SystemVaType")
system_range_start = module.object(object_type = "pointer",
offset = module.get_symbol("MmSystemRangeStart").address)
result = cls._enumerate_system_va_type(large_page_size, system_range_start, module,
@@ -68,6 +70,7 @@ class VirtMap(interfaces.plugins.PluginInterface):
else:
raise exceptions.SymbolError(None, module.name, "Required structures not found")
elif module.has_symbol('MiSystemVaType'):
vollog.log(constants.LOGLEVEL_VVVV, "Using SystemVaType")
system_range_start = module.object(object_type = "pointer",
offset = module.get_symbol("MmSystemRangeStart").address)
symbol = module.get_symbol('MiSystemVaType')
@@ -79,7 +82,7 @@ class VirtMap(interfaces.plugins.PluginInterface):
result = cls._enumerate_system_va_type(large_page_size, system_range_start, module, type_array)
else:
raise exceptions.SymbolError(None, module.name, "Required structures not found")
raise exceptions.SymbolError(None, module.name, "Required Mi structures not found")
return result
@@ -110,9 +113,9 @@ class VirtMap(interfaces.plugins.PluginInterface):
def scannable_sections(cls, module: interfaces.context.ModuleInterface) -> Generator[Tuple[int, int], None, None]:
mapping = cls.determine_map(module)
for entry in mapping:
if 'Unused' not in entry:
for value in mapping[entry]:
yield value
# Excluding 'Unused' appears to include kernel memory in certain versions of windows?
for value in mapping[entry]:
yield value
def run(self):
layer = self.context.layers[self.config['primary']]