diff --git a/volatility/cli/__init__.py b/volatility/cli/__init__.py index 89f4c9ecb..063becc3a 100644 --- a/volatility/cli/__init__.py +++ b/volatility/cli/__init__.py @@ -84,7 +84,6 @@ class CommandLine(object): else: ctx.config["automagic.general.single_location"] = "file://" + os.path.abspath(args.file) pass - # ctx.config["automagic.general.single_page_map_offset"] = 0x1ab000 ### # BACK TO THE FRAMEWORK diff --git a/volatility/framework/automagic/windows.py b/volatility/framework/automagic/windows.py index f42a5fd87..e8bcbaf8e 100644 --- a/volatility/framework/automagic/windows.py +++ b/volatility/framework/automagic/windows.py @@ -4,11 +4,14 @@ if __name__ == "__main__": sys.path.append(os.path.abspath(os.path.join(os.path.dirname(__file__), '..', '..', '..'))) +import logging import struct from volatility.framework import interfaces, layers, validity from volatility.framework.configuration import requirements +vollog = logging.getLogger(__name__) + PAGE_SIZE = 0x1000 @@ -193,6 +196,22 @@ class WintelHelper(interfaces.automagic.AutomagicInterface, interfaces.automagic config_path = config_path, name = new_layer_name) break + if layer is None: + # There is a very high chance that the DTB will live in this narrow segment, assuming we couldn't find it previously + hits = context.memory[layer_name].scan(context, PageMapScanner([DtbSelfRef64bit()]), min_address = 0x1a0000, + max_address = 0x1f0000) + # Flatten the generator + hits = list(hits) + if hits: + # TODO: Decide which to use if there are multiple options + page_map_offset = hits[0][1][0] + new_layer_name = context.memory.free_layer_name("IntelLayer") + config_path = interfaces.configuration.path_join("IntelHelper", new_layer_name) + context.config[interfaces.configuration.path_join(config_path, "memory_layer")] = layer_name + context.config[interfaces.configuration.path_join(config_path, "page_map_offset")] = page_map_offset + # TODO: Need to determine the layer type (chances are high it's x64, hence this default) + layer = layers.intel.Intel32e(context, config_path = config_path, name = new_layer_name) + if layer is not None: + vollog.debug("DTB was found at: 0x{:0x}".format( + context.config[interfaces.configuration.path_join(config_path, "page_map_offset")])) return layer - -