From 3fc17f16bd4c28fec590bfd0532b6d593ce4b13e Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 11 Apr 2018 09:25:47 +0100 Subject: [PATCH 1/3] Change the type for array of pointers to accept any object. --- volatility/framework/objects/utility.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/framework/objects/utility.py b/volatility/framework/objects/utility.py index 77c8c7910..716e065cb 100644 --- a/volatility/framework/objects/utility.py +++ b/volatility/framework/objects/utility.py @@ -29,7 +29,7 @@ def pointer_to_string(pointer: objects.Pointer, return char.cast("string", max_length = count, errors = errors) -def array_of_pointers(array: objects.Array, +def array_of_pointers(array: interfaces.objects.ObjectInterface, count: int, subtype: templates.ObjectTemplate = None, context: interfaces.context.ContextInterface = None) -> interfaces.objects.ObjectInterface: From 470b8e1bea3155734115ae6fe9f598de59f90234 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 11 Apr 2018 09:34:09 +0100 Subject: [PATCH 2/3] More typing updates to allow for string subtypes. --- volatility/framework/objects/utility.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility/framework/objects/utility.py b/volatility/framework/objects/utility.py index 716e065cb..2399df54f 100644 --- a/volatility/framework/objects/utility.py +++ b/volatility/framework/objects/utility.py @@ -31,13 +31,13 @@ def pointer_to_string(pointer: objects.Pointer, def array_of_pointers(array: interfaces.objects.ObjectInterface, count: int, - subtype: templates.ObjectTemplate = None, + subtype: typing.Optional[typing.Union[str, templates.ObjectTemplate]] = None, context: interfaces.context.ContextInterface = None) -> interfaces.objects.ObjectInterface: """Takes an object, and recasts it as an array of pointers to subtype""" if isinstance(subtype, str) and context is not None: subtype = context.symbol_space.get_type(subtype) if not isinstance(subtype, templates.ObjectTemplate) or subtype is None: - raise TypeError("Subtype must be a valid object template") + raise TypeError("Subtype must be a valid object template (or string name of an object template)") subtype_pointer = objects.templates.ObjectTemplate(objects.Pointer, type_name = 'pointer', subtype = subtype) return array.cast("array", count = count, subtype = subtype_pointer) From aa774ffca68a633aa5b280344c853c56867e911c Mon Sep 17 00:00:00 2001 From: Michael Ligh Date: Wed, 11 Apr 2018 09:24:02 -0500 Subject: [PATCH 3/3] Refs #21 fix vadinfo's get_private_memory() on 10.0.14393.x --- .../framework/symbols/windows/extensions/__init__.py | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 4e3965db8..459982fce 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -182,7 +182,7 @@ class _MMVAD_SHORT(objects.Struct): if hasattr(self, "u1") and hasattr(self.u1, "VadFlags1"): return self.u1.VadFlags1.CommitCharge - if hasattr(self, "u") and hasattr(self.u, "VadFlags"): + elif hasattr(self, "u") and hasattr(self.u, "VadFlags"): return self.u.VadFlags.CommitCharge elif hasattr(self, "Core"): @@ -193,14 +193,18 @@ class _MMVAD_SHORT(objects.Struct): def get_private_memory(self): """Get the VAD's private memory setting""" - if hasattr(self, "u1") and hasattr(self.u1, "VadFlags1"): + if hasattr(self, "u1") and hasattr(self.u1, "VadFlags1") and hasattr(self.u1.VadFlags1, "PrivateMemory"): return self.u1.VadFlags1.PrivateMemory - if hasattr(self, "u") and hasattr(self.u, "VadFlags"): + elif hasattr(self, "u") and hasattr(self.u, "VadFlags") and hasattr(self.u.VadFlags, "PrivateMemory"): return self.u.VadFlags.PrivateMemory elif hasattr(self, "Core"): - return self.Core.u1.VadFlags1.PrivateMemory + if hasattr(self.Core, "u1") and hasattr(self.Core.u1, "VadFlags1") and hasattr(self.Core.u1.VadFlags1, "PrivateMemory"): + return self.Core.u1.VadFlags1.PrivateMemory + + elif hasattr(self.Core, "u") and hasattr(self.Core.u, "VadFlags") and hasattr(self.Core.u.VadFlags, "PrivateMemory"): + return self.Core.u.VadFlags.PrivateMemory raise AttributeError("Unable to find the private memory member")