WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-02 14:28:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add smear checks in MFT parsing code

Browse Source
This commit is contained in:
Andrew Case
2024-09-02 15:09:20 -05:00
parent 483cb7e4ee
commit 660e8a7b89
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/symbols/windows/extensions/mft.py
+8 -2
View File
@@ -29,7 +29,10 @@ class MFTAttribute(objects.StructType):
def get_resident_filename(self) -> str:
# 4MB chosen as cutoff instead of 4KB to allow for recovery from format /L created file systems
# Length as 512 as its 256*2, which is the maximum size for an entire file path, so this is even generous
if self.Attr_Header.ContentOffset > 4194304 or self.Attr_Header.NameLength > 512:
if (
self.Attr_Header.ContentOffset > 4194304
or self.Attr_Header.NameLength > 512
):
return None
# To get the resident name, we jump to relative name offset and read name length * 2 bytes of data
@@ -49,7 +52,10 @@ class MFTAttribute(objects.StructType):
def get_resident_filecontent(self) -> bytes:
# smear observed in mass testing of samples
# 4MB chosen as cutoff instead of 4KB to allow for recovery from format /L created file systems
if self.Attr_Header.ContentOffset > 4194304 or self.Attr_Header.ContentLength > 4194304:
if (
self.Attr_Header.ContentOffset > 4194304
or self.Attr_Header.ContentLength > 4194304
):
return None
# To get the resident content, we jump to relative content offset and read name length * 2 bytes of data