From 76264cee3435dfe4bcdf9e71159de4005a220bef Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 8 Nov 2018 22:23:33 +0000 Subject: [PATCH] Catch invalid _OBJECT_HEADER objects. --- .../framework/symbols/windows/extensions/__init__.py | 7 +++++-- volatility/plugins/windows/poolscanner.py | 7 ++++--- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 3f5979f46..fe88a00b1 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -470,10 +470,13 @@ class _OBJECT_HEADER(objects.Struct): def is_valid(self) -> bool: """Determine if the object is valid""" - #if self.InfoMask > 0x48: + # if self.InfoMask > 0x48: # return False - if self.PointerCount > 0x1000000 or self.PointerCount < 0: + try: + if self.PointerCount > 0x1000000 or self.PointerCount < 0: + return False + except exceptions.InvalidAddressException: return False return True diff --git a/volatility/plugins/windows/poolscanner.py b/volatility/plugins/windows/poolscanner.py index c23db89bf..d23a88524 100644 --- a/volatility/plugins/windows/poolscanner.py +++ b/volatility/plugins/windows/poolscanner.py @@ -155,8 +155,9 @@ class PoolScanner(plugins.PluginInterface): layer_name: str, symbol_table: str, pool_constraints: typing.List[PoolConstraint], - alignment: int = 8) -> typing.Generator[typing.Tuple[PoolConstraint, - interfaces.objects.ObjectInterface], None, None]: + alignment: int = 8, + progress_callback: typing.Optional[validity.ProgressCallback] = None) \ + -> typing.Generator[typing.Tuple[PoolConstraint, interfaces.objects.ObjectInterface], None, None]: """Returns the _POOL_HEADER object (based on the symbol_table template) after scanning through layer_name returning all headers that match any of the constraints provided. Only one constraint can be provided per tag""" # Setup the pattern @@ -198,7 +199,7 @@ class PoolScanner(plugins.PluginInterface): # Run the scan locating the offsets of a particular tag layer = context.memory[layer_name] scanner = scanners.MultiStringScanner([c for c in constraint_lookup.keys()]) - for offset, pattern in layer.scan(context, scanner): + for offset, pattern in layer.scan(context, scanner, progress_callback = progress_callback): for constraint in constraint_lookup[pattern]: header = module.object(type_name = "_POOL_HEADER", offset = offset - header_offset)