WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-13 21:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add in initial shot at PAE page entry handling.

Browse Source
This commit is contained in:
Mike Auty
2018-01-28 16:29:28 +00:00
parent 35be4c5a84
commit deb7da246b
1 changed files with 22 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/layers/intel.py
+22 -1
View File
@@ -308,7 +308,28 @@ class WindowsMixin(object):
class WindowsIntel(WindowsMixin, Intel): pass
class WindowsIntelPAE(WindowsMixin, IntelPAE): pass
class WindowsIntelPAE(WindowsMixin, IntelPAE):
def _translate(self, offset):
try:
return super()._translate(offset)
except exceptions.PagedInvalidAddressException as excp:
entry = excp.entry
tbit = bool(entry & (1 << 11))
pbit = bool(entry & (1 << 10))
vbit = bool(entry & 1)
if (not tbit and not pbit and not vbit) and (self._mask(entry, 64, 32) >> 32) != 0:
swap_offset = (self._mask(entry, 64, 32) >> 32 << excp.invalid_bits) | self._mask(excp.invalid_address,
excp.invalid_bits, 0)
print("OFFSET", hex(offset),
"ENTRY", hex(entry),
"SWAP_OFFSET", hex(swap_offset),
"INVALID_BITS", excp.invalid_bits)
pagefile_number = 0
if len(self.config.get('swap_layers', [])) >= (pagefile_number + 1):
swap_layer_name = self.config['swap_layers'][pagefile_number]
return swap_offset, 1 << excp.invalid_bits, swap_layer_name
raise
class WindowsIntel32e(WindowsMixin, Intel32e): pass