WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-31 12:19:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

Remove paging files (since they're OS specific) and add in a windows page validity test.

Browse Source
This commit is contained in:
Mike Auty
2013-05-19 13:41:28 +01:00
parent dff1c167b2
commit 562ed6d506
1 changed files with 25 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/layers/intel.py
+25 -8
View File
@@ -11,18 +11,18 @@ from volatility.framework import interfaces, exceptions
class Intel(interfaces.layers.TranslationLayerInterface):
"""Translation Layer for the Intel IA32 memory mapping"""
def __init__(self, context, name, memory_layer, pagefile_layer = None, page_map_offset = None):
def __init__(self, context, name, memory_layer, page_map_offset):
interfaces.layers.TranslationLayerInterface.__init__(self, context, name)
self._base_layer = memory_layer
self._pagefile = pagefile_layer
self._page_map_offset = page_map_offset
# All Intel address spaces work on 4096 byte pages
self._page_size_in_bits = 12
# These can vary depending on the type of space
self._entry_format = "<I"
self._maxphyaddr = 32
self._bits_per_register = 32
self._maxphyaddr = 32
self._maxvirtaddr = self._maxphyaddr
self._index_shift = int(math.log(struct.calcsize(self._entry_format), 2))
self._structure = [('page directory', 10, False),
('page table', 10, True)]
@@ -49,7 +49,7 @@ class Intel(interfaces.layers.TranslationLayerInterface):
# Position maintains the number of bits left to process
# We or with 0x1 to ensure our page_map_offset is always valid
entry = self._mask(self._page_map_offset, self._bits_per_register - 1, 0) | 0x1
position = min(self._maxphyaddr, self._bits_per_register) - 1
position = min(self._maxvirtaddr, self._bits_per_register) - 1
# Run through the offset in various chunks
for (name, size, large_page) in self._structure:
@@ -59,6 +59,7 @@ class Intel(interfaces.layers.TranslationLayerInterface):
# Check if we're a large page
if large_page and (entry & (1 << 7)):
# We're a large page, the rest is finished below
# TODO: We'd have to implement PSE-36 here
break
# Figure out how much of the offset we should be using
start = position
@@ -90,9 +91,10 @@ class IntelPAE(Intel):
Intel.__init__(self, *args, **kwargs)
# These can vary depending on the type of space
self._maxphyaddr = 36
self._bits_per_register = 32
self._entry_format = "<Q"
self._bits_per_register = 32
self._maxphyaddr = 40
self._maxvirtaddr = self._maxphyaddr
self._index_shift = int(math.log(struct.calcsize(self._entry_format), 2))
self._structure = [('page directory pointer', 2, False),
('page directory', 9, True),
@@ -104,11 +106,26 @@ class Intel32e(Intel):
Intel.__init__(self, *args, **kwargs)
# These can vary depending on the type of space
self._maxphyaddr = 48
self._bits_per_register = 64
self._entry_format = "<Q"
self._bits_per_register = 64
self._maxphyaddr = 52
self._maxvirtaddr = 48
self._index_shift = int(math.log(struct.calcsize(self._entry_format), 2))
self._structure = [('page map layer 4', 9, False),
('page directory pointer', 9, True),
('page directory', 9, True),
('page table', 9, True)]
class WindowsMixin(object):
def _page_is_valid(self, entry):
"""Returns whether a particular page is valid based on its entry
Windows uses additional "available" bits to store flags
These flags allow windows to determine whether a page is still valid
Bit 11 is the transition flag, and Bit 10 is the prototype flag
For more information, see Windows Internals (6th Ed, Part 2, pages 268-269)
"""
return (entry & 1) or ((entry & 1 << 11) and not (entry & 1 << 10))