diff --git a/volatility3/framework/automagic/windows.py b/volatility3/framework/automagic/windows.py index bed2a4376..b9c9bedf9 100644 --- a/volatility3/framework/automagic/windows.py +++ b/volatility3/framework/automagic/windows.py @@ -153,8 +153,7 @@ class DtbSelfRefPae(DtbSelfReferential): # Mask off the page bits of top level page map page_table_mask = b"\x00\xf0\xff\xff\xff\xff\xff\xff" * 4 page_table = data[ - top_pae_page - - data_offset : top_pae_page + top_pae_page - data_offset : top_pae_page - data_offset + (4 * self.ptr_size) ] @@ -287,22 +286,35 @@ class WindowsIntelStacker(interfaces.automagic.StackerLayerInterface): """Key used to sort by tests""" return tests.index(x[0]), x[1] - def get_max_pointer(page_table, test, ptr_size: int): - """Determines a pointer from a page_table""" - max_ptr = 0 + def get_valid_page_table_pointers(page_table, ptr_size: int): for index in range(0, len(page_table), ptr_size): pointer = struct.unpack( test.ptr_struct, page_table[index : index + ptr_size] )[0] # Make sure the pointer is valid, ignore large pages which would require more calculation if pointer & 0x1 and not pointer & 0x80: - max_ptr = max( - max_ptr, - (pointer ^ (pointer & 0xFFF)) - % test.layer_type.maximum_address, - ) + yield pointer + + def get_max_pointer(page_table, test, ptr_size: int): + """Determines a pointer from a page_table""" + max_ptr = 0 + for pointer in get_valid_page_table_pointers(page_table, ptr_size): + max_ptr = max( + max_ptr, + (pointer ^ (pointer & 0xFFF)) % test.layer_type.maximum_address, + ) return max_ptr + def page_table_is_dummy(page_table, ptr_size): + valid_pointers = 0 + for _ in get_valid_page_table_pointers(page_table, ptr_size): + valid_pointers += 1 + if valid_pointers >= 10: + # Do not consume the entire generator to enhance performance + return False + vollog.debug(f"Found {valid_pointers} valid pointers") + return True + hits = sorted(list(hits), key=sort_by_tests) vollog.debug(f"WindowsIntelStacker hits: {hits}") @@ -310,16 +322,15 @@ class WindowsIntelStacker(interfaces.automagic.StackerLayerInterface): for test, page_map_offset in hits: # Turn the page tables into integers and find the largest one page_table = base_layer.read(page_map_offset, 0x1000) + ptr_size = struct.calcsize(test.ptr_struct) # Modern windows can have a dummy page table with only about 2 entries, so sanity check - null_count = sum([1 if page_table[x] else 0 for x in page_table]) - if null_count > 0xFA0: + if page_table_is_dummy(page_table, ptr_size): vollog.debug( f"DTB {page_map_offset:x} contains less than 12 valid pointers, ignoring" ) continue - ptr_size = struct.calcsize(test.ptr_struct) max_pointer = get_max_pointer(page_table, test, ptr_size) if max_pointer <= base_layer.maximum_address: