diff --git a/volatility3/framework/plugins/windows/pebmasquerade.py b/volatility3/framework/plugins/windows/pebmasquerade.py index dc5293271..c1bfca67f 100644 --- a/volatility3/framework/plugins/windows/pebmasquerade.py +++ b/volatility3/framework/plugins/windows/pebmasquerade.py @@ -219,6 +219,12 @@ class PebMasquerade(interfaces.plugins.PluginInterface): filter_func=pid_filter, ): proc_id = proc.UniqueProcessId + try: + peb = proc.get_peb() + except (exceptions.InvalidAddressException, AttributeError): + vollog.debug( + "Unable to access PEB for PID %d, skipping process", proc_id + ) notes = [] ( @@ -300,6 +306,46 @@ class PebMasquerade(interfaces.plugins.PluginInterface): f"SeAuditProcessCreationInfo comparison error: {str(e)[:30]}" ) + if isinstance(peb_imagefilepath, str) and peb: + try: + + # Length values are of type USHORT + peb_imagefilepath_length = ( + peb.ProcessParameters.ImagePathName.Length // 2 + ) + peb_imagefilepath_maxlength = ( + peb.ProcessParameters.ImagePathName.MaximumLength // 2 - 1 + ) + + if (peb_imagefilepath_length != len(peb_imagefilepath)) or ( + peb_imagefilepath_maxlength != len(peb_imagefilepath) + ): + notes.append( + f"'PEB.ImageFilePath Length Mismatch: Length={peb_imagefilepath_length}, MaximumLength={peb_imagefilepath_maxlength}, Actual={len(peb_imagefilepath)}'" + ) + except Exception as e: + notes.append( + f"PEB.ImageFilePath Length comparison error: {str(e)[:30]}" + ) + + if isinstance(peb_cmdline, str) and peb: + try: + # Length values are of type USHORT + peb_cmdline_length = peb.ProcessParameters.CommandLine.Length // 2 + peb_cmdline_maxlength = ( + peb.ProcessParameters.CommandLine.MaximumLength // 2 - 1 + ) + + if (peb_cmdline_length != len(peb_cmdline)) or ( + peb_cmdline_maxlength != len(peb_cmdline) + ): + notes.append( + f"'PEB.CommandLine Length Mismatch: Commandline={peb_cmdline}, Length={peb_cmdline_length}, MaximumLength={peb_cmdline_maxlength}, Actual={len(peb_cmdline)}'" + ) + except Exception as e: + notes.append( + f"PEB.CommandLine Length comparison error: {str(e)[:30]}" + ) yield ( 0, (