From 7c4cb0d2917f732d5fe59491a29fa1a5e8671280 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 13 Dec 2018 00:30:02 +0000 Subject: [PATCH] Remove attempts to improve speed that may not help. --- volatility/framework/layers/intel.py | 30 +++------------------------- 1 file changed, 3 insertions(+), 27 deletions(-) diff --git a/volatility/framework/layers/intel.py b/volatility/framework/layers/intel.py index f7976723f..c1d2ac7a8 100644 --- a/volatility/framework/layers/intel.py +++ b/volatility/framework/layers/intel.py @@ -258,12 +258,8 @@ class Intel32e(Intel): class WindowsMixin(Intel): - def __init__(self, *args, **kwargs): - self._bad_pages = set() - self._checked_entries = set() - super().__init__(*args, **kwargs) - - def _page_is_valid(self, entry: int) -> bool: + @staticmethod + def _page_is_valid(entry: int) -> bool: """Returns whether a particular page is valid based on its entry Windows uses additional "available" bits to store flags @@ -273,31 +269,11 @@ class WindowsMixin(Intel): For more information, see Windows Internals (6th Ed, Part 2, pages 268-269) """ - if entry in self._bad_pages: - return False return bool((entry & 1) or ((entry & 1 << 11) and not entry & 1 << 10)) def _translate_swap(self, layer: Intel, offset: int, bit_offset: int): try: - entry, position = self._translate_entry(offset) - - page = self._mask(entry, self._maxphyaddr - 1, position + 1) | self._mask(offset, position, 0) - - # Now we're done - if not self._page_is_valid(entry): - raise exceptions.PagedInvalidAddressException(self.name, offset, position + 1, entry, - "Page Fault at entry {} in page entry".format(hex(entry))) - - if entry not in self._checked_entries and (entry & 0xffff << 48 == 0x1 << 63) and (entry & 0xfff == 0x121): - self._checked_entries.add(entry) - data = self.context.memory.read(self._base_layer, page, 1 << (position + 1)) - if data == b"\xff" * (1 << (position + 1)) or data == b"\x00" * (1 << (position + 1)): - self._bad_pages.add(entry) - raise exceptions.PagedInvalidAddressException(self.name, offset, position + 1, entry, - "Page Fault at entry {} in page entry".format( - hex(entry))) - - return page, 1 << (position + 1), self._base_layer + return super()._translate(offset) except exceptions.PagedInvalidAddressException as excp: entry = excp.entry tbit = bool(entry & (1 << 11))