From d51dd2a992f1fd18b8ce7aff69db7734f84e69b9 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 24 Dec 2016 19:44:06 +0000 Subject: [PATCH] Add in TODOs for future heuristic enhancements. --- volatility/framework/automagic/pdbscan.py | 1 + volatility/framework/automagic/windows.py | 1 + 2 files changed, 2 insertions(+) diff --git a/volatility/framework/automagic/pdbscan.py b/volatility/framework/automagic/pdbscan.py index dce5f1d34..5d9b18b70 100644 --- a/volatility/framework/automagic/pdbscan.py +++ b/volatility/framework/automagic/pdbscan.py @@ -229,6 +229,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): vollog.debug("Kernel base randomized, searching layer for base address offset") # If we're here, chances are high we're in a Win10 x64 image with kernel base randomization physical_layer = context.memory[physical_layer_name] + # TODO: On older windows, this might be \WINDOWS\system32\nt rather than \SystemRoot\system32\nt results = physical_layer.scan(context, scanners.BytesScanner(b"\\SystemRoot\\system32\\nt")) seen = set() for result in results: diff --git a/volatility/framework/automagic/windows.py b/volatility/framework/automagic/windows.py index f80bb0275..245b00d89 100644 --- a/volatility/framework/automagic/windows.py +++ b/volatility/framework/automagic/windows.py @@ -199,6 +199,7 @@ class WintelHelper(interfaces.automagic.AutomagicInterface, interfaces.automagic if layer is None: vollog.debug("Self-referential pointer not in well-known location, moving to recent windows heuristic") # There is a very high chance that the DTB will live in this narrow segment, assuming we couldn't find it previously + # TODO: This scan takes time, it might be worth adding a progress callback to it hits = context.memory[layer_name].scan(context, PageMapScanner([DtbSelfRef64bit()]), min_address = 0x1a0000, max_address = 0x1f0000) # Flatten the generator