WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-28 10:49:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

Extensions: Removes the get_raw_dpc method from KTIMER

Browse Source 
This removes the `get_raw_dpc` method from the `KTIMER` extension class.
This method was inaccurate in that it actually returns the masked
pointer value instead of the full 64-bit value encoded in that member,
which is required in order to correctly decode the 'real' pointer.

The invocation of `get_raw_dpc()` was replaced with
`self.Dpc.get_raw_value()`, which was added in the previous commit.
This commit is contained in:
David McDonald
2025-03-20 14:32:04 -05:00
parent 7b9fb91672
commit a8ea3aae01
1 changed files with 1 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/symbols/windows/extensions/__init__.py
+1 -10
View File
@@ -1220,15 +1220,6 @@ class KTIMER(objects.StructType):
return "Yes"
return "-"
def get_raw_dpc(self):
"""Returns the encoded DPC as an unsigned long long since the pointer is actually encoded"""
if symbols.symbol_table_is_64bit(
context=self._context, symbol_table_name=self.get_symbol_table_name()
):
return self.Dpc.cast("unsigned long long")
else:
return self.Dpc.cast("unsigned long")
def valid_type(self):
return self.Header.Type in self.VALID_TYPES
@@ -1263,7 +1254,7 @@ class KTIMER(objects.StructType):
)
low_byte = (wait_never) & 0xFF
entry = utility.rol(self.get_raw_dpc() ^ wait_never, low_byte)
entry = utility.rol(self.Dpc.get_raw_value() ^ wait_never, low_byte)
swap_xor = self._context.layers[self.vol.native_layer_name].canonicalize(
self.vol.offset
)