WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-17 20:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1783 from volatilityfoundation/bugfix/shimcache_tracebacks

Browse Source 
Windows Shimcachemem: Fix tracebacks
This commit is contained in:
ikelos
2025-04-26 21:33:39 +01:00
committed by GitHub
parent 577747f22c 2641e5fc41
commit c6e8c0d4e8
2 changed files with 48 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/shimcachemem.py
+13 -7
View File
@@ -582,13 +582,19 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf
:return: The offset and size of the module, if found; Otherwise, returns `None`
"""
try:
krnl_mod = next(
module
for module in modules.Modules.list_modules(context, kernel_module_name)
if module.BaseDllName.String in module_list
)
except StopIteration:
krnl_mod = None
for module in modules.Modules.list_modules(context, kernel_module_name):
try:
if module.BaseDllName.String in module_list:
krnl_mod = module
break
except exceptions.InvalidAddressException as exc:
vollog.warning(
f"Failed to get kernel module due to {exc.__class__.__name__}: {exc.invalid_address:#x}"
)
if krnl_mod is None:
vollog.warning("Failed to find kernel module")
return None
kernel = context.modules[kernel_module_name]
volatility3/framework/symbols/windows/extensions/shimcache.py
+35 -28
View File
@@ -39,37 +39,44 @@ class SHIM_CACHE_ENTRY(objects.StructType):
if self._exec_flag is not None:
return self._exec_flag
if hasattr(self, "ListEntryDetail") and hasattr(
self.ListEntryDetail, "InsertFlags"
):
self._exec_flag = self.ListEntryDetail.InsertFlags & 0x2 == 2
elif hasattr(self, "InsertFlags"):
self._exec_flag = self.InsertFlags & 0x2 == 2
elif hasattr(self, "ListEntryDetail") and hasattr(
self.ListEntryDetail, "BlobBuffer"
):
blob_offset = self.ListEntryDetail.BlobBuffer
blob_size = self.ListEntryDetail.BlobSize
if not self._context.layers[self.vol.native_layer_name].is_valid(
blob_offset, blob_size
try:
if hasattr(self, "ListEntryDetail") and hasattr(
self.ListEntryDetail, "InsertFlags"
):
self._exec_flag = renderers.UnparsableValue()
return self._exec_flag
self._exec_flag = self.ListEntryDetail.InsertFlags & 0x2 == 2
raw_flag = self._context.layers[self.vol.native_layer_name].read(
blob_offset, blob_size
elif hasattr(self, "InsertFlags"):
self._exec_flag = self.InsertFlags & 0x2 == 2
elif hasattr(self, "ListEntryDetail") and hasattr(
self.ListEntryDetail, "BlobBuffer"
):
blob_offset = self.ListEntryDetail.BlobBuffer
blob_size = self.ListEntryDetail.BlobSize
if not self._context.layers[self.vol.native_layer_name].is_valid(
blob_offset, blob_size
):
self._exec_flag = renderers.UnreadableValue()
return self._exec_flag
raw_flag = self._context.layers[self.vol.native_layer_name].read(
blob_offset, blob_size
)
if not raw_flag:
self._exec_flag = renderers.UnparsableValue()
return self._exec_flag
try:
self._exec_flag = bool(struct.unpack("<I", raw_flag)[0])
except struct.error:
self._exec_flag = renderers.UnparsableValue()
except exceptions.InvalidAddressException:
vollog.debug(
"Failed to read SHIMCACHE_ENTRY exec flag due to invalid address exception"
)
if not raw_flag:
self._exec_flag = renderers.UnparsableValue()
return self._exec_flag
try:
self._exec_flag = bool(struct.unpack("<I", raw_flag)[0])
except struct.error:
self._exec_flag = renderers.UnparsableValue()
self._exec_flag = renderers.UnreadableValue()
else:
# Always set to true for XP/2K3