From 8da9d90c1965627b9e560e2304579535c30dcbc7 Mon Sep 17 00:00:00 2001 From: xabiugarte Date: Fri, 25 Oct 2019 11:12:18 -0400 Subject: [PATCH] Small fix on EPROCESS is_valid --- .../framework/symbols/windows/extensions/__init__.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index a9908e9a9..80316d33c 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -692,11 +692,17 @@ class EPROCESS(generic.GenericIntelProcess, ExecutiveObject): if self.UniqueProcessId % 4 != 0: return False - if self.Pcb.DirectoryTableBase == 0: + # check for all 0s besides the PCID entries + if isinstance(self.Pcb.DirectoryTableBase, objects.Array): + dtb = self.Pcb.DirectoryTableBase.cast("unsigned long long") + else: + dtb = self.Pcb.DirectoryTableBase + + if dtb == 0: return False # check for all 0s besides the PCID entries - if self.Pcb.DirectoryTableBase[0] & ~0xfff == 0: + if dtb & ~0xfff == 0: return False ## TODO: we can also add the thread Flink and Blink tests if necessary