WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-27 12:04:50 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add in page-table repetition blocking code (helps with windows 10 virtual space).

Browse Source
This commit is contained in:
Mike Auty
2018-12-13 01:16:05 +00:00
committed by ikelos
parent 736a1c6e50
commit da2f3b38d3
1 changed files with 14 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/layers/intel.py
+14 -4
View File
@@ -136,11 +136,21 @@ class Intel(interfaces.layers.TranslationLayerInterface):
# Grab the base address of the table we'll be getting the next entry from
base_address = self._mask(entry, self._maxphyaddr - 1, size + self._index_shift)
# Create the offset for the next entry
table_offset = base_address | (index << self._index_shift)
table = self._context.memory.read(self._base_layer, base_address, self.page_size)
# If the table is entirely duplicates, then mark the whole table as bad
if (table == table[:struct.calcsize(self._entry_format)] *
(self.page_size // struct.calcsize(self._entry_format))):
raise exceptions.PagedInvalidAddressException(self.name, offset, position + 1, entry,
"Page Fault at entry " + hex(entry) + " in table " + name)
# Read the data for the next entry
entry_data = table[(index << self._index_shift):
(index << self._index_shift) + struct.calcsize(self._entry_format)]
# Read out the new entry from memory
entry, = struct.unpack(self._entry_format, self._context.memory.read(self._base_layer, table_offset,
struct.calcsize(self._entry_format)))
entry, = struct.unpack(self._entry_format, entry_data)
return entry, position
def _process_table(self, entry: int, page: int, layer_name: str) -> None: