From da2f3b38d36309fc2588bd8e05fb51931431e729 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 8 Dec 2018 14:27:17 +0000 Subject: [PATCH] Add in page-table repetition blocking code (helps with windows 10 virtual space). --- volatility/framework/layers/intel.py | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/volatility/framework/layers/intel.py b/volatility/framework/layers/intel.py index e5154ac99..f7976723f 100644 --- a/volatility/framework/layers/intel.py +++ b/volatility/framework/layers/intel.py @@ -136,11 +136,21 @@ class Intel(interfaces.layers.TranslationLayerInterface): # Grab the base address of the table we'll be getting the next entry from base_address = self._mask(entry, self._maxphyaddr - 1, size + self._index_shift) - # Create the offset for the next entry - table_offset = base_address | (index << self._index_shift) + + table = self._context.memory.read(self._base_layer, base_address, self.page_size) + + # If the table is entirely duplicates, then mark the whole table as bad + if (table == table[:struct.calcsize(self._entry_format)] * + (self.page_size // struct.calcsize(self._entry_format))): + raise exceptions.PagedInvalidAddressException(self.name, offset, position + 1, entry, + "Page Fault at entry " + hex(entry) + " in table " + name) + # Read the data for the next entry + entry_data = table[(index << self._index_shift): + (index << self._index_shift) + struct.calcsize(self._entry_format)] + # Read out the new entry from memory - entry, = struct.unpack(self._entry_format, self._context.memory.read(self._base_layer, table_offset, - struct.calcsize(self._entry_format))) + entry, = struct.unpack(self._entry_format, entry_data) + return entry, position def _process_table(self, entry: int, page: int, layer_name: str) -> None: