From 87cc571fbba8d6d04aecda758f36729fba44b0ec Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 14 Apr 2025 10:18:17 -0500 Subject: [PATCH 1/5] ShimcacheMem: Fix symbol table These SHIM_CACHE_ENTRY offsets aren't correct - should be identical to those in the other XP symbol tables. --- .../windows/shimcache/shimcache-xp-sp2-x86.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/symbols/windows/shimcache/shimcache-xp-sp2-x86.json b/volatility3/framework/symbols/windows/shimcache/shimcache-xp-sp2-x86.json index 6114e6c85..6c990f9f5 100644 --- a/volatility3/framework/symbols/windows/shimcache/shimcache-xp-sp2-x86.json +++ b/volatility3/framework/symbols/windows/shimcache/shimcache-xp-sp2-x86.json @@ -331,23 +331,23 @@ "LastModified": { "type": { "kind": "union", - "name": "LARGE_INTEGER" + "name": "_LARGE_INTEGER" }, - "offset": 4 + "offset": 528 }, "FileSize": { "type": { "kind": "base", "name": "long long" }, - "offset": 8 + "offset": 536 }, "LastUpdate": { "type": { "kind": "union", - "name": "LARGE_INTEGER" + "name": "_LARGE_INTEGER" }, - "offset": 12 + "offset": 544 } }, "kind": "struct", From b80c52873b62a325453b9b443446e7f2ef4ad575 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 14 Apr 2025 10:19:01 -0500 Subject: [PATCH 2/5] ShimcacheMem: Use `address_to_string` Uses the new `address_to_string` utility function to read filepaths, in case a filepath crosses a boundary to a swapped page. --- .../framework/symbols/windows/extensions/shimcache.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/shimcache.py b/volatility3/framework/symbols/windows/extensions/shimcache.py index b84a7df6f..279a1995c 100644 --- a/volatility3/framework/symbols/windows/extensions/shimcache.py +++ b/volatility3/framework/symbols/windows/extensions/shimcache.py @@ -8,6 +8,7 @@ from datetime import datetime from typing import Dict, Optional, Tuple, Union from volatility3.framework import constants, exceptions, interfaces, objects, renderers +from volatility3.framework.objects.utility import address_to_string from volatility3.framework.symbols.windows.extensions import conversion vollog = logging.getLogger(__name__) @@ -126,8 +127,12 @@ class SHIM_CACHE_ENTRY(objects.StructType): return self._file_path if not hasattr(self.Path, "Buffer"): - return self.Path.cast( - "string", max_length=self.Path.vol.count, encoding="utf-16le" + return address_to_string( + self._context, + self.Path.vol.layer_name, + self.Path.vol.offset, + 520, + encoding="utf-16le", ) try: From 079d2801f51f4191996ec9d2a1ace4edb9d956a9 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 14 Apr 2025 10:19:55 -0500 Subject: [PATCH 3/5] ShimcacheMem: Fix offset tracking This fixes a bug in the plugin logic that causes valid entries to be excluded in the following scenario: - An entry is discovered but deemed invalid due to unreadable size/timestamps. - The offset gets placed into the `seen` tracking set anyway - Another entry (this time, with valid filesize/timestamps) with the same physical offset is encountered, but is skipped because this offset is already in the `seen` tracking set. This updates the logic to only add the offset to the tracker if the shimcache entry is valid. --- volatility3/framework/plugins/windows/shimcachemem.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/shimcachemem.py b/volatility3/framework/plugins/windows/shimcachemem.py index 7883dfba3..f60e5c5cf 100644 --- a/volatility3/framework/plugins/windows/shimcachemem.py +++ b/volatility3/framework/plugins/windows/shimcachemem.py @@ -174,6 +174,8 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf vad.get_start() + SHIM_NUM_ENTRIES_OFFSET, ) + vollog.debug(f"Found {num_entries} shimcache entries") + if num_entries > SHIM_MAX_ENTRIES: continue @@ -204,7 +206,6 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf if physical_addr in seen: continue - seen.add(physical_addr) shim_entry = proc_layer.context.object( shimcache_symbol_table + constants.BANG + "SHIM_CACHE_ENTRY", @@ -216,6 +217,8 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf if not shim_entry.is_valid(): continue + seen.add(physical_addr) + yield shim_entry @classmethod From 1d4893156e04b0feb94249f1dc5536cb39ea2a75 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 14 Apr 2025 11:13:03 -0500 Subject: [PATCH 4/5] Shimcache Extension: Fix logic error in `exec_flag` Adds needed return statements in `exec_flag` method in order to avoid `InvalidAddressException` when reading from invalid memory after an `is_valid` check has already been performed. --- .../framework/symbols/windows/extensions/shimcache.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/volatility3/framework/symbols/windows/extensions/shimcache.py b/volatility3/framework/symbols/windows/extensions/shimcache.py index 279a1995c..a80ecc0ea 100644 --- a/volatility3/framework/symbols/windows/extensions/shimcache.py +++ b/volatility3/framework/symbols/windows/extensions/shimcache.py @@ -57,12 +57,14 @@ class SHIM_CACHE_ENTRY(objects.StructType): blob_offset, blob_size ): self._exec_flag = renderers.UnparsableValue() + return self._exec_flag raw_flag = self._context.layers[self.vol.native_layer_name].read( blob_offset, blob_size ) if not raw_flag: self._exec_flag = renderers.UnparsableValue() + return self._exec_flag try: self._exec_flag = bool(struct.unpack(" Date: Mon, 14 Apr 2025 11:41:00 -0500 Subject: [PATCH 5/5] Shimcache: Use `self.Path.vol.count` instead of hardcoded value --- volatility3/framework/symbols/windows/extensions/shimcache.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/windows/extensions/shimcache.py b/volatility3/framework/symbols/windows/extensions/shimcache.py index a80ecc0ea..2e7c68fa9 100644 --- a/volatility3/framework/symbols/windows/extensions/shimcache.py +++ b/volatility3/framework/symbols/windows/extensions/shimcache.py @@ -136,7 +136,7 @@ class SHIM_CACHE_ENTRY(objects.StructType): self._context, self.Path.vol.layer_name, self.Path.vol.offset, - 520, + self.Path.vol.count, encoding="utf-16le", )