WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 19:57:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #533 from volatilityfoundation/issues/issue_457_registry_mapping_sids

Browse Source 
Issues/issue 457 registry mapping sids
This commit is contained in:
ikelos
2021-07-14 16:51:12 +01:00
committed by GitHub
parent f65199845d d613b384d2
commit df48d3a8d3
3 changed files with 14 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/layers/registry.py
+10 -3
View File
@@ -66,13 +66,13 @@ class RegistryHive(linear.LinearlyMappedLayer):
self._hive_maxaddr_non_volatile = self.hive.Storage[0].Length
self._hive_maxaddr_volatile = self.hive.Storage[1].Length
self._maxaddr = 0x80000000 | self._hive_maxaddr_volatile
vollog.log(constants.LOGLEVEL_VVV, "Setting hive max address to {}".format(hex(self._maxaddr)))
vollog.log(constants.LOGLEVEL_VVVV, f"Setting hive {self.name} max address to {hex(self._maxaddr)}")
except exceptions.InvalidAddressException:
self._hive_maxaddr_non_volatile = 0x7fffffff
self._hive_maxaddr_volatile = 0x7fffffff
self._maxaddr = 0x80000000 | self._hive_maxaddr_volatile
vollog.log(constants.LOGLEVEL_VVV,
"Exception when setting hive max address, using {}".format(hex(self._maxaddr)))
vollog.log(constants.LOGLEVEL_VVVV,
f"Exception when setting hive {self.name} max address, using {hex(self._maxaddr)}")
def _get_hive_maxaddr(self, volatile):
return self._hive_maxaddr_volatile if volatile else self._hive_maxaddr_non_volatile
@@ -199,6 +199,13 @@ class RegistryHive(linear.LinearlyMappedLayer):
# Ignore the volatile bit when determining maxaddr validity
volatile = self._mask(offset, 31, 31) >> 31
if offset & 0x7fffffff > self._get_hive_maxaddr(volatile):
vollog.log(constants.LOGLEVEL_VVV,
"Layer {} couldn't translate offset {}, greater than {} in {} store of {}".format(
self.name,
hex(offset & 0x7fffffff),
hex(self._get_hive_maxaddr(volatile)),
"volative" if volatile else "non-volatile",
self.get_name()))
raise RegistryInvalidIndex(self.name, "Mapping request for value greater than maxaddr")
storage = self.hive.Storage[volatile]
volatility3/framework/plugins/windows/getservicesids.py
+3 -2
View File
@@ -62,13 +62,14 @@ class GetServiceSIDs(interfaces.plugins.PluginInterface):
def _generator(self):
# Go all over the hives
# Get the system hive
for hive in hivelist.HiveList.list_hives(context = self.context,
base_config_path = self.config_path,
layer_name = self.config['primary'],
symbol_table = self.config['nt_symbols'],
filter_string = 'machine\\system',
hive_offsets = None):
# Get ConrolSet\Services.
# Get ControlSet\Services.
try:
services = hive.get_key(r"CurrentControlSet\Services")
except (KeyError, exceptions.InvalidAddressException):
volatility3/framework/plugins/windows/getsids.py
+1
View File
@@ -81,6 +81,7 @@ class GetSIDs(interfaces.plugins.PluginInterface):
base_config_path = self.config_path,
layer_name = self.config['primary'],
symbol_table = self.config['nt_symbols'],
filter_string = 'config\\software',
hive_offsets = None):
try: