From d232be2f6e30106375e9e659a9a59b7b2b93a6de Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Sat, 1 Oct 2016 22:13:42 +0100
Subject: [PATCH] Try to update the generic dtb finder to rule out false
 positives.

---
 development/dtbfinder.py                  | 24 ++++++++++++-----------
 volatility/framework/automagic/windows.py |  3 ++-
 2 files changed, 15 insertions(+), 12 deletions(-)

diff --git a/development/dtbfinder.py b/development/dtbfinder.py
index 1437c8377..5d71ba401 100644
--- a/development/dtbfinder.py
+++ b/development/dtbfinder.py
@@ -1,3 +1,4 @@
+import statistics
 import sys
 
 # TODO: Rather nasty hack, when volatility's actually installed this would be unnecessary
@@ -85,18 +86,19 @@ if __name__ == '__main__':
 
                     test_dict = selfref_results[test]
                     for ref in sorted(test_dict, key = lambda x: -len(test_dict[x])):
-                        if args.verbose > 1 or not best_found:
-                            print("       " + hex(ref) + ": " + ", ".join([hex(x) for x in sorted(test_dict[ref])]))
+                        # Most self-referential DTBs should turn up multiple times because multiple processes should have their own DTB
+                        if len(test_dict[ref]) < 2:
+                            continue
                         if best_found is None:
-                            for dtb in test_dict[ref]:
-                                scan_results.append((test, dtb))
-                            best_found = ref
-                        else:
-                            # Remove results that had multiple matches, a real DTB probably won't reference itself twice
-                            for dtb in test_dict[ref]:
-                                if (test, dtb) in scan_results:
-                                    scan_results.remove((test, dtb))
-                print("   Results")
+                            # Most processes are spread out across significantly different pages
+                            # Therefore the standard deviation should be significant
+                            if statistics.stdev(test_dict[ref]) > 0x100000:
+                                for dtb in test_dict[ref]:
+                                    scan_results.append((test, dtb))
+                                best_found = ref
+                        if args.verbose > 1 or best_found == ref:
+                            print("       " + hex(ref) + ": " + ", ".join([hex(x) for x in sorted(test_dict[ref])]))
+            print("   Results")
 
             # Populate the guesses based on the scan_results
             guesses = dict([(test.layer_type.__name__, set()) for test in tests])
diff --git a/volatility/framework/automagic/windows.py b/volatility/framework/automagic/windows.py
index 0b17f3462..f42a5fd87 100644
--- a/volatility/framework/automagic/windows.py
+++ b/volatility/framework/automagic/windows.py
@@ -104,7 +104,8 @@ class DtbSelfReferential(DtbTest):
                 ptr, = struct.unpack(self.ptr_struct, ptr_data)
                 if ((ptr & self.mask) == (data_offset + page_offset)) and (data_offset + page_offset > 0):
                     ref_pages.add(ref)
-        if ref_pages:
+        # The DTB is extremely unlikely to refer back to itself. so the number of reference should always be exactly 1
+        if len(ref_pages) == 1:
             return (data_offset + page_offset), ref_pages