From c45b1b3423fff9376346025f13e1539418d55f28 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 21 Dec 2020 15:52:40 +0000 Subject: [PATCH 1/7] Automagic: Windows DTB finder was too limited The DTB finder test returns a full DTB, if that's over the scan chunk size it'll get discarded, so we remove that test. --- volatility/framework/automagic/windows.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/volatility/framework/automagic/windows.py b/volatility/framework/automagic/windows.py index 3f33f1c58..d55ff8c23 100644 --- a/volatility/framework/automagic/windows.py +++ b/volatility/framework/automagic/windows.py @@ -225,8 +225,7 @@ class PageMapScanner(interfaces.layers.ScannerInterface): for page_offset in range(0, len(data), 0x1000): result = test(data, data_offset, page_offset) if result is not None: - if result[0] < self.chunk_size: - yield (test, result[0]) + yield (test, result[0]) class WintelHelper(interfaces.automagic.AutomagicInterface): From ccef55e44893aded13250f346524c08edf4c788a Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 21 Dec 2020 15:57:18 +0000 Subject: [PATCH 2/7] Linux: Use native_layer when constructing from a pointer offset --- volatility/framework/symbols/mac/extensions/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/framework/symbols/mac/extensions/__init__.py b/volatility/framework/symbols/mac/extensions/__init__.py index 787e7b56d..e433318ae 100644 --- a/volatility/framework/symbols/mac/extensions/__init__.py +++ b/volatility/framework/symbols/mac/extensions/__init__.py @@ -270,7 +270,7 @@ class vm_map_entry(objects.StructType): if found: vpager = context.object(config_prefix + constants.BANG + "vnode_pager", - layer_name = vnode_object.vol.layer_name, + layer_name = vnode_object.vol.native_layer_name, offset = vnode_object.pager) ret = vpager.vnode_handle else: From d1b10781d41023e8daad256999949dac61b237e1 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 30 Dec 2020 18:06:37 +0000 Subject: [PATCH 3/7] CLI: Parse windows file as files not URIs Fixes #408 --- volatility/cli/__init__.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility/cli/__init__.py b/volatility/cli/__init__.py index 3e680aa26..0c038a322 100644 --- a/volatility/cli/__init__.py +++ b/volatility/cli/__init__.py @@ -436,7 +436,8 @@ class CommandLine: if value is not None: if isinstance(requirement, requirements.URIRequirement): if isinstance(value, str): - if not parse.urlparse(value).scheme: + scheme = parse.urlparse(value).scheme + if not scheme or len(scheme) <= 1: if not os.path.exists(value): raise FileNotFoundError( "Non-existant file {} passed to URIRequirement".format(value)) From f75e77997d123ec0fa5ef1f05726a3323889138f Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 3 Jan 2021 10:38:49 +0000 Subject: [PATCH 4/7] Layerwriter: Remove erroneous debugging statements --- volatility/framework/plugins/layerwriter.py | 2 -- 1 file changed, 2 deletions(-) diff --git a/volatility/framework/plugins/layerwriter.py b/volatility/framework/plugins/layerwriter.py index 1bd6b0a7c..571079f6f 100644 --- a/volatility/framework/plugins/layerwriter.py +++ b/volatility/framework/plugins/layerwriter.py @@ -82,8 +82,6 @@ class LayerWriter(plugins.PluginInterface): for name in self.context.layers: yield 0, (name, ) else: - import pdb - pdb.set_trace() # Choose the most recently added layer that isn't virtual if self.config['layers'] is None: self.config['layers'] = [] From 53397117ef5c049df7f5a3fb1e8e01c6cc781a28 Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Wed, 6 Jan 2021 10:30:01 -0600 Subject: [PATCH 5/7] remove unnecessary and unused imports from the windows extensions init file --- volatility/framework/symbols/windows/extensions/__init__.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 9352b04d3..dd7684de4 100755 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -6,9 +6,8 @@ import collections.abc import datetime import functools import logging -import struct import math -from typing import Iterable, Iterator, Optional, Union, Dict, Tuple, List +from typing import Iterable, Iterator, Optional, Union, Tuple, List from volatility.framework import constants, exceptions, interfaces, objects, renderers, symbols from volatility.framework.layers import intel From d7d176d04010ec2f1caebdcd473c644d8ed87792 Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Wed, 6 Jan 2021 11:36:56 -0600 Subject: [PATCH 6/7] add Is64Bit and IsPAE properties to the windows.info plugin --- volatility/framework/plugins/windows/info.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility/framework/plugins/windows/info.py b/volatility/framework/plugins/windows/info.py index 90ede538a..8a40f305a 100644 --- a/volatility/framework/plugins/windows/info.py +++ b/volatility/framework/plugins/windows/info.py @@ -5,7 +5,7 @@ import time from typing import List, Tuple, Iterable -from volatility.framework import constants, interfaces, layers +from volatility.framework import constants, interfaces, layers, symbols from volatility.framework.configuration import requirements from volatility.framework.interfaces import plugins from volatility.framework.renderers import TreeGrid @@ -158,6 +158,8 @@ class Info(plugins.PluginInterface): yield (0, ("Kernel Base", hex(self.config["primary.kernel_virtual_offset"]))) yield (0, ("DTB", hex(self.config["primary.page_map_offset"]))) yield (0, ("Symbols", self.config["nt_symbols.isf_url"])) + yield (0, ("Is64Bit", str(symbols.symbol_table_is_64bit(self.context, symbol_table)))) + yield (0, ("IsPAE", str(self.context.layers[layer_name].metadata.get("pae", False)))) for i, layer in self.get_depends(self.context, "primary"): yield (0, (layer.name, "{} {}".format(i, layer.__class__.__name__))) From e1032623fed1268875089180d02c9261628e934a Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 6 Jan 2021 19:28:24 +0000 Subject: [PATCH 7/7] Layers: Ensure intel PAE reports pae in the metadata --- volatility/framework/layers/intel.py | 1 + 1 file changed, 1 insertion(+) diff --git a/volatility/framework/layers/intel.py b/volatility/framework/layers/intel.py index cc5aa98aa..86bf26de7 100644 --- a/volatility/framework/layers/intel.py +++ b/volatility/framework/layers/intel.py @@ -247,6 +247,7 @@ class IntelPAE(Intel): _maxphyaddr = 40 _maxvirtaddr = 32 _structure = [('page directory pointer', 2, False), ('page directory', 9, True), ('page table', 9, True)] + _direct_metadata = collections.ChainMap({'pae', True}, Intel._direct_metadata) class Intel32e(Intel):