From d74032fd531f93255c4dcadebd00b647d83fcad8 Mon Sep 17 00:00:00 2001 From: cesare Date: Tue, 1 Sep 2020 00:11:56 +0200 Subject: [PATCH] Added maxsize option to vadinfo as optional parameter, as in Vol2. Right now the default is set to 0 (no limit) as opposed to Vol2 where it is set to 1GB. --- .../framework/plugins/windows/vadinfo.py | 33 +++++++++++++++---- 1 file changed, 26 insertions(+), 7 deletions(-) diff --git a/volatility/framework/plugins/windows/vadinfo.py b/volatility/framework/plugins/windows/vadinfo.py index c2191f46e..4ed75195d 100644 --- a/volatility/framework/plugins/windows/vadinfo.py +++ b/volatility/framework/plugins/windows/vadinfo.py @@ -34,6 +34,7 @@ class VadInfo(interfaces.plugins.PluginInterface): """Lists process memory ranges.""" _version = (1, 1, 0) + MAXSIZE_DEFAULT = 0 def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -60,7 +61,12 @@ class VadInfo(interfaces.plugins.PluginInterface): requirements.BooleanRequirement(name = 'dump', description = "Extract listed memory ranges", default = False, - optional = True) + optional = True), + requirements.IntRequirement(name = 'maxsize', + description = "Maximum size for dumped VAD sections " \ + "(all the bigger sections will be ignored)", + default = cls.MAXSIZE_DEFAULT, + optional = True), ] @classmethod @@ -102,17 +108,31 @@ class VadInfo(interfaces.plugins.PluginInterface): @classmethod def vad_dump(cls, context: interfaces.context.ContextInterface, proc: interfaces.objects.ObjectInterface, - vad: interfaces.objects.ObjectInterface) -> interfaces.plugins.FileInterface: + vad: interfaces.objects.ObjectInterface, + maxsize = MAXSIZE_DEFAULT) -> interfaces.plugins.FileInterface: """Extracts the complete data for Vad as a FileInterface. Args: context: The context to retrieve required elements (layers, symbol tables) from proc: an _EPROCESS instance vad: The suspected VAD to extract (ObjectInterface) + maxsize: Max size of VAD section (default MAXSIZE_DEFAULT) Returns: A FileInterface object containing the complete data for the process or None in the case of failure """ + + try: + vad_start = vad.get_start() + vad_end = vad.get_end() + except Exception as excp: + vollog.debug("Unable to get VAD information") + return + + if maxsize != 0 and (vad_end - vad_start) > maxsize: + vollog.debug("Skip VAD dump {0:#x}-{1:#x} due to maxsize limit".format(vad_start, vad_end)) + return + proc_id = "Unknown" try: proc_id = proc.UniqueProcessId @@ -123,8 +143,6 @@ class VadInfo(interfaces.plugins.PluginInterface): return proc_layer = context.layers[proc_layer_name] - vad_start = vad.get_start() - vad_end = vad.get_end() file_name = "pid.{0}.vad.{1:#x}-{2:#x}.dmp".format(proc_id, vad_start, vad_end) try: filedata = interfaces.plugins.FileInterface(file_name) @@ -164,9 +182,10 @@ class VadInfo(interfaces.plugins.PluginInterface): dumped = False if self.config['dump']: - filedata = self.vad_dump(self.context, proc, vad) - self.produce_file(filedata) - dumped = True + filedata = self.vad_dump(self.context, proc, vad, self.config['maxsize']) + if filedata: + self.produce_file(filedata) + dumped = True yield (0, (proc.UniqueProcessId, process_name, format_hints.Hex(vad.vol.offset), format_hints.Hex(vad.get_start()), format_hints.Hex(vad.get_end()), vad.get_tag(),