diff --git a/volatility/framework/automagic/pdbscan.py b/volatility/framework/automagic/pdbscan.py index 42918ec87..837c5bcc1 100644 --- a/volatility/framework/automagic/pdbscan.py +++ b/volatility/framework/automagic/pdbscan.py @@ -8,6 +8,7 @@ import struct from volatility.framework import exceptions, layers from volatility.framework.layers import scanners +from volatility.framework.symbols import native if __name__ == "__main__": import sys @@ -237,7 +238,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): seen = set() for result in results: # TODO: Identify the specific structure we're finding and document this a bit better - pointer = context.object("unsigned long long", offset = (result - 16 - 8), + pointer = context.object("pdbscan!unsigned long long", offset = (result - 16 - 8), layer_name = physical_layer_name) address = pointer & vlayer.address_mask if address in seen: @@ -261,6 +262,8 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): def __call__(self, context, config_path, requirement): # TODO: Check if we really need to search for pdbs + if "pdbscan" not in context.symbol_space: + context.symbol_space.append(native.NativeTable("pdbscan", native.std_ctypes)) self._symbol_requirements = self.recurse_symbol_requirements(context, config_path, requirement) if self._symbol_requirements: potential_kernels = self.recurse_pdb_finder(context, config_path, requirement) diff --git a/volatility/framework/layers/vmware.py b/volatility/framework/layers/vmware.py index cd6076e46..5105226cf 100644 --- a/volatility/framework/layers/vmware.py +++ b/volatility/framework/layers/vmware.py @@ -5,6 +5,7 @@ from urllib import parse from volatility.framework import interfaces from volatility.framework.configuration import requirements from volatility.framework.layers import physical, segmented +from volatility.framework.symbols import native PAGE_SIZE = 0x1000 @@ -30,6 +31,9 @@ class VmwareLayer(segmented.SegmentedLayer): def _read_header(self): """Checks the vmware header to make sure it's valid""" + if "vmware" not in self._context.symbol_space: + self._context.symbol_space.append(native.NativeTable("vmware", native.std_ctypes)) + meta_layer = self.context.memory.get(self._meta_layer, None) header_size = struct.calcsize(self.header_structure) data = meta_layer.read(0, header_size) @@ -54,27 +58,29 @@ class VmwareLayer(segmented.SegmentedLayer): tags_read = False offset = memory tags = {} - index_len = self._context.symbol_space.get_type("unsigned int").size + index_len = self._context.symbol_space.get_type("vmware!unsigned int").size while not tags_read: flags = ord(meta_layer.read(offset, 1)) name_len = ord(meta_layer.read(offset + 1, 1)) tags_read = (flags == 0) and (name_len == 0) if not tags_read: - name = self._context.object("string", layer_name = self._meta_layer, offset = offset + 2, + name = self._context.object("vmware!string", layer_name = self._meta_layer, offset = offset + 2, max_length = name_len) indicies_len = (flags >> 6) & 3 indicies = [] for index in range(indicies_len): indicies.append( - self._context.object("unsigned int", + self._context.object("vmware!unsigned int", offset = offset + name_len + 2 + (index * index_len), layer_name = self._meta_layer)) - data = self._context.object("unsigned int", layer_name = self._meta_layer, + data = self._context.object("vmware!unsigned int", layer_name = self._meta_layer, offset = offset + 2 + name_len + (indicies_len * index_len)) tags[(name, tuple(indicies))] = (flags, data) offset += 2 + name_len + (indicies_len * index_len) + self._context.symbol_space.get_type( - "unsigned int").size + "vmware!unsigned int").size + if tags[("regionsCount", ())][1] == 0: + raise ValueError("VMware VMEM is not split into regions") for region in range(tags[("regionsCount", ())][1]): offset = tags[("regionPPN", (region,))][1] * PAGE_SIZE mapped_offset = tags[("regionPageNum", (region,))][1] * PAGE_SIZE diff --git a/volatility/framework/symbols/__init__.py b/volatility/framework/symbols/__init__.py index 77869dc0b..a7688eb26 100644 --- a/volatility/framework/symbols/__init__.py +++ b/volatility/framework/symbols/__init__.py @@ -69,7 +69,7 @@ class SymbolSpace(collections.abc.Mapping): def append(self, value): """Adds a symbol_list to the end of the space""" - if not isinstance(value, interfaces.symbols.SymbolTableInterface): + if not isinstance(value, interfaces.symbols.BaseSymbolTableInterface): raise TypeError(value) if value.name in self._dict: self.remove(value.name) diff --git a/volatility/framework/symbols/native.py b/volatility/framework/symbols/native.py index 420116c49..5a12c870d 100644 --- a/volatility/framework/symbols/native.py +++ b/volatility/framework/symbols/native.py @@ -76,23 +76,24 @@ class NativeTable(interfaces.symbols.NativeTableInterface): **additional) -native_types = {'int': (objects.Integer, 'H'), - 'short': (objects.Integer, 'H'), + 'short': (objects.Integer, '