WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-11 20:27:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

UNICODE_STRING length checks to further detect spoofing

Browse Source
This commit is contained in:
SolitudePy
2025-09-17 02:02:14 +03:00
parent 207941759d
commit 72f0bd1bba
1 changed files with 46 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/pebmasquerade.py
+46
View File
@@ -219,6 +219,12 @@ class PebMasquerade(interfaces.plugins.PluginInterface):
filter_func=pid_filter,
):
proc_id = proc.UniqueProcessId
try:
peb = proc.get_peb()
except (exceptions.InvalidAddressException, AttributeError):
vollog.debug(
"Unable to access PEB for PID %d, skipping process", proc_id
)
notes = []
(
@@ -300,6 +306,46 @@ class PebMasquerade(interfaces.plugins.PluginInterface):
f"SeAuditProcessCreationInfo comparison error: {str(e)[:30]}"
)
if isinstance(peb_imagefilepath, str) and peb:
try:
# Length values are of type USHORT
peb_imagefilepath_length = (
peb.ProcessParameters.ImagePathName.Length // 2
)
peb_imagefilepath_maxlength = (
peb.ProcessParameters.ImagePathName.MaximumLength // 2 - 1
)
if (peb_imagefilepath_length != len(peb_imagefilepath)) or (
peb_imagefilepath_maxlength != len(peb_imagefilepath)
):
notes.append(
f"'PEB.ImageFilePath Length Mismatch: Length={peb_imagefilepath_length}, MaximumLength={peb_imagefilepath_maxlength}, Actual={len(peb_imagefilepath)}'"
)
except Exception as e:
notes.append(
f"PEB.ImageFilePath Length comparison error: {str(e)[:30]}"
)
if isinstance(peb_cmdline, str) and peb:
try:
# Length values are of type USHORT
peb_cmdline_length = peb.ProcessParameters.CommandLine.Length // 2
peb_cmdline_maxlength = (
peb.ProcessParameters.CommandLine.MaximumLength // 2 - 1
)
if (peb_cmdline_length != len(peb_cmdline)) or (
peb_cmdline_maxlength != len(peb_cmdline)
):
notes.append(
f"'PEB.CommandLine Length Mismatch: Commandline={peb_cmdline}, Length={peb_cmdline_length}, MaximumLength={peb_cmdline_maxlength}, Actual={len(peb_cmdline)}'"
)
except Exception as e:
notes.append(
f"PEB.CommandLine Length comparison error: {str(e)[:30]}"
)
yield (
0,
(