diff --git a/volatility/cli/__init__.py b/volatility/cli/__init__.py index 3e680aa26..0c038a322 100644 --- a/volatility/cli/__init__.py +++ b/volatility/cli/__init__.py @@ -436,7 +436,8 @@ class CommandLine: if value is not None: if isinstance(requirement, requirements.URIRequirement): if isinstance(value, str): - if not parse.urlparse(value).scheme: + scheme = parse.urlparse(value).scheme + if not scheme or len(scheme) <= 1: if not os.path.exists(value): raise FileNotFoundError( "Non-existant file {} passed to URIRequirement".format(value)) diff --git a/volatility/framework/automagic/windows.py b/volatility/framework/automagic/windows.py index 3f33f1c58..d55ff8c23 100644 --- a/volatility/framework/automagic/windows.py +++ b/volatility/framework/automagic/windows.py @@ -225,8 +225,7 @@ class PageMapScanner(interfaces.layers.ScannerInterface): for page_offset in range(0, len(data), 0x1000): result = test(data, data_offset, page_offset) if result is not None: - if result[0] < self.chunk_size: - yield (test, result[0]) + yield (test, result[0]) class WintelHelper(interfaces.automagic.AutomagicInterface): diff --git a/volatility/framework/layers/intel.py b/volatility/framework/layers/intel.py index cc5aa98aa..86bf26de7 100644 --- a/volatility/framework/layers/intel.py +++ b/volatility/framework/layers/intel.py @@ -247,6 +247,7 @@ class IntelPAE(Intel): _maxphyaddr = 40 _maxvirtaddr = 32 _structure = [('page directory pointer', 2, False), ('page directory', 9, True), ('page table', 9, True)] + _direct_metadata = collections.ChainMap({'pae', True}, Intel._direct_metadata) class Intel32e(Intel): diff --git a/volatility/framework/plugins/layerwriter.py b/volatility/framework/plugins/layerwriter.py index 1bd6b0a7c..571079f6f 100644 --- a/volatility/framework/plugins/layerwriter.py +++ b/volatility/framework/plugins/layerwriter.py @@ -82,8 +82,6 @@ class LayerWriter(plugins.PluginInterface): for name in self.context.layers: yield 0, (name, ) else: - import pdb - pdb.set_trace() # Choose the most recently added layer that isn't virtual if self.config['layers'] is None: self.config['layers'] = [] diff --git a/volatility/framework/plugins/windows/info.py b/volatility/framework/plugins/windows/info.py index 90ede538a..8a40f305a 100644 --- a/volatility/framework/plugins/windows/info.py +++ b/volatility/framework/plugins/windows/info.py @@ -5,7 +5,7 @@ import time from typing import List, Tuple, Iterable -from volatility.framework import constants, interfaces, layers +from volatility.framework import constants, interfaces, layers, symbols from volatility.framework.configuration import requirements from volatility.framework.interfaces import plugins from volatility.framework.renderers import TreeGrid @@ -158,6 +158,8 @@ class Info(plugins.PluginInterface): yield (0, ("Kernel Base", hex(self.config["primary.kernel_virtual_offset"]))) yield (0, ("DTB", hex(self.config["primary.page_map_offset"]))) yield (0, ("Symbols", self.config["nt_symbols.isf_url"])) + yield (0, ("Is64Bit", str(symbols.symbol_table_is_64bit(self.context, symbol_table)))) + yield (0, ("IsPAE", str(self.context.layers[layer_name].metadata.get("pae", False)))) for i, layer in self.get_depends(self.context, "primary"): yield (0, (layer.name, "{} {}".format(i, layer.__class__.__name__))) diff --git a/volatility/framework/symbols/mac/extensions/__init__.py b/volatility/framework/symbols/mac/extensions/__init__.py index 787e7b56d..e433318ae 100644 --- a/volatility/framework/symbols/mac/extensions/__init__.py +++ b/volatility/framework/symbols/mac/extensions/__init__.py @@ -270,7 +270,7 @@ class vm_map_entry(objects.StructType): if found: vpager = context.object(config_prefix + constants.BANG + "vnode_pager", - layer_name = vnode_object.vol.layer_name, + layer_name = vnode_object.vol.native_layer_name, offset = vnode_object.pager) ret = vpager.vnode_handle else: diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 9352b04d3..dd7684de4 100755 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -6,9 +6,8 @@ import collections.abc import datetime import functools import logging -import struct import math -from typing import Iterable, Iterator, Optional, Union, Dict, Tuple, List +from typing import Iterable, Iterator, Optional, Union, Tuple, List from volatility.framework import constants, exceptions, interfaces, objects, renderers, symbols from volatility.framework.layers import intel