From 60193b2a3f1313b2d898bf18b5275f05f96aa32b Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Tue, 16 Jul 2019 22:25:18 -0500 Subject: [PATCH] remove HBIN bounds check --- volatility/framework/layers/registry.py | 27 +++---------------------- 1 file changed, 3 insertions(+), 24 deletions(-) diff --git a/volatility/framework/layers/registry.py b/volatility/framework/layers/registry.py index b4c33380e..6f9b1d502 100644 --- a/volatility/framework/layers/registry.py +++ b/volatility/framework/layers/registry.py @@ -221,35 +221,14 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface): def mapping(self, offset: int, length: int, ignore_errors: bool = False) -> Iterable[Tuple[int, int, int, str]]: - # TODO: Check the offset and offset + length are not outside the norms if length < 0: raise ValueError("Mapping length of RegistryHive must be positive or zero") - # Try using the symbol first at the start of the page + # Return the translated offset without checking bounds within the HBIN. The check runs into + # issues when pages are swapped on large HBINs, and did not seem to find any errors on single page + # HBINs while dramatically slowing performance. translated_offset = self._translate(offset) - hbin_offset = self._translate(self._mask(offset, 31, 12)) - hbin = self.context.object( - self._reg_table_name + constants.BANG + "_HBIN", offset = hbin_offset, layer_name = self._base_layer) - - if hbin.Signature.cast("string", max_length=4, encoding="latin-1") == 'hbin': - # the offset is in a single page hbin, so we can check that the length doesn't exceed the bounds - if translated_offset + length > hbin_offset + hbin.Size and hbin.Size > 0: - raise RegistryFormatException("Cell address {} outside expected HBIN limit: {}".format( - hex(translated_offset + length), hex(hbin_offset + hbin.Size))) - else: - # This is most likely a large page. Previously, we attempted to walk backwards and find - # the first page, then perform the bounds check. This ran into issues because: - # 1) if a page between the desired offset and the HBIN is paged, the loop will raise an exception - # 2) if the HBIN itself is paged, the check will not be possible, and we could keep walking back - # and find the wrong HBIN anyway - # Either of the above scenarios will result in skipped nodes that are otherwise valid, so it's not - # a very useful check for these large pages, so just log it and return the translated offset - vollog.log(constants.LOGLEVEL_VVV, - "First page of HBIN for {} not available, can't do bounds check".format( - hex(offset))) - response = [(offset, translated_offset, length, self._base_layer)] - return response @property