From 562ed6d50672a814a4487f2c4cb420148ca30de8 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Sun, 19 May 2013 13:41:28 +0100
Subject: [PATCH] Remove paging files (since they're OS specific) and add in a
 windows page validity test.

---
 volatility/framework/layers/intel.py | 33 +++++++++++++++++++++-------
 1 file changed, 25 insertions(+), 8 deletions(-)

diff --git a/volatility/framework/layers/intel.py b/volatility/framework/layers/intel.py
index dc4a5a694..18adb798c 100644
--- a/volatility/framework/layers/intel.py
+++ b/volatility/framework/layers/intel.py
@@ -11,18 +11,18 @@ from volatility.framework import interfaces, exceptions
 class Intel(interfaces.layers.TranslationLayerInterface):
     """Translation Layer for the Intel IA32 memory mapping"""
 
-    def __init__(self, context, name, memory_layer, pagefile_layer = None, page_map_offset = None):
+    def __init__(self, context, name, memory_layer, page_map_offset):
         interfaces.layers.TranslationLayerInterface.__init__(self, context, name)
         self._base_layer = memory_layer
-        self._pagefile = pagefile_layer
         self._page_map_offset = page_map_offset
         # All Intel address spaces work on 4096 byte pages
         self._page_size_in_bits = 12
 
         # These can vary depending on the type of space
         self._entry_format = "<I"
-        self._maxphyaddr = 32
         self._bits_per_register = 32
+        self._maxphyaddr = 32
+        self._maxvirtaddr = self._maxphyaddr
         self._index_shift = int(math.log(struct.calcsize(self._entry_format), 2))
         self._structure = [('page directory', 10, False),
                            ('page table', 10, True)]
@@ -49,7 +49,7 @@ class Intel(interfaces.layers.TranslationLayerInterface):
         # Position maintains the number of bits left to process
         # We or with 0x1 to ensure our page_map_offset is always valid
         entry = self._mask(self._page_map_offset, self._bits_per_register - 1, 0) | 0x1
-        position = min(self._maxphyaddr, self._bits_per_register) - 1
+        position = min(self._maxvirtaddr, self._bits_per_register) - 1
 
         # Run through the offset in various chunks
         for (name, size, large_page) in self._structure:
@@ -59,6 +59,7 @@ class Intel(interfaces.layers.TranslationLayerInterface):
             # Check if we're a large page
             if large_page and (entry & (1 << 7)):
                 # We're a large page, the rest is finished below
+                # TODO: We'd have to implement PSE-36 here
                 break
             # Figure out how much of the offset we should be using
             start = position
@@ -90,9 +91,10 @@ class IntelPAE(Intel):
         Intel.__init__(self, *args, **kwargs)
 
         # These can vary depending on the type of space
-        self._maxphyaddr = 36
-        self._bits_per_register = 32
         self._entry_format = "<Q"
+        self._bits_per_register = 32
+        self._maxphyaddr = 40
+        self._maxvirtaddr = self._maxphyaddr
         self._index_shift = int(math.log(struct.calcsize(self._entry_format), 2))
         self._structure = [('page directory pointer', 2, False),
                            ('page directory', 9, True),
@@ -104,11 +106,26 @@ class Intel32e(Intel):
         Intel.__init__(self, *args, **kwargs)
 
         # These can vary depending on the type of space
-        self._maxphyaddr = 48
-        self._bits_per_register = 64
         self._entry_format = "<Q"
+        self._bits_per_register = 64
+        self._maxphyaddr = 52
+        self._maxvirtaddr = 48
         self._index_shift = int(math.log(struct.calcsize(self._entry_format), 2))
         self._structure = [('page map layer 4', 9, False),
                            ('page directory pointer', 9, True),
                            ('page directory', 9, True),
                            ('page table', 9, True)]
+
+class WindowsMixin(object):
+
+    def _page_is_valid(self, entry):
+        """Returns whether a particular page is valid based on its entry
+        
+           Windows uses additional "available" bits to store flags
+           These flags allow windows to determine whether a page is still valid
+           
+           Bit 11 is the transition flag, and Bit 10 is the prototype flag
+           
+           For more information, see Windows Internals (6th Ed, Part 2, pages 268-269)
+        """
+        return (entry & 1) or ((entry & 1 << 11) and not (entry & 1 << 10))