WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-24 15:12:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

Small fix on EPROCESS is_valid

Browse Source
This commit is contained in:
xabiugarte
2019-12-02 13:07:04 +00:00
committed by ikelos
parent 1123ed074d
commit 8da9d90c19
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/symbols/windows/extensions/__init__.py
+8 -2
View File
@@ -692,11 +692,17 @@ class EPROCESS(generic.GenericIntelProcess, ExecutiveObject):
if self.UniqueProcessId % 4 != 0:
return False
if self.Pcb.DirectoryTableBase == 0:
# check for all 0s besides the PCID entries
if isinstance(self.Pcb.DirectoryTableBase, objects.Array):
dtb = self.Pcb.DirectoryTableBase.cast("unsigned long long")
else:
dtb = self.Pcb.DirectoryTableBase
if dtb == 0:
return False
# check for all 0s besides the PCID entries
if self.Pcb.DirectoryTableBase[0] & ~0xfff == 0:
if dtb & ~0xfff == 0:
return False
## TODO: we can also add the thread Flink and Blink tests if necessary