From 89252b8bef29b70f3312bfde3dab5ad2690a29a2 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 9 Feb 2016 21:09:54 +0000 Subject: [PATCH] Get rid of potential DTBs with bad page bits (still need to find out what those mean). --- dtbfinder.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/dtbfinder.py b/dtbfinder.py index 1d3d5e0d7..ac6a45224 100644 --- a/dtbfinder.py +++ b/dtbfinder.py @@ -29,15 +29,18 @@ class DTBFinder(object): self.page_map = {} def scan(self, pointer_size, pointer_struct, magic): - for offset in range(self.ctx.memory['data'].minimum_address, self.ctx.memory['data'].maximum_address, + for offset in range(self.ctx.memory['data'].minimum_address, + self.ctx.memory['data'].maximum_address - PAGE_SIZE, PAGE_SIZE): null = struct.unpack("<" + pointer_struct, self.ctx.memory.read('data', offset, pointer_size))[0] val = self.ctx.memory.read('data', offset + (magic * pointer_size), pointer_size) test_val = struct.unpack("<" + pointer_struct, val)[0] & 0xFFFFFFFFFFFFF000 + mask = struct.unpack("<" + pointer_struct, val)[0] & 0xFFF offsetstr = ("{0:#0" + str((pointer_size * 2) + 2) + "x}").format(offset) testvalstr = ("{0:#0" + str((pointer_size * 2) + 2) + "x}").format(test_val) if offset == test_val and offset != 0: - print("MATCH at", offsetstr, "with magic", magic, "null", null) + if (mask & 0xFF0) == 0x60: + print("MATCH at", offsetstr, "with magic", magic, "with mask", "{0:#04x}".format(mask)) def scan32(self): self.scan(4, "I", 0x300)