From 88a8cde9ac2febc1028d0160587a97912e5fbd94 Mon Sep 17 00:00:00 2001 From: superponible Date: Wed, 24 Feb 2021 10:34:38 -0600 Subject: [PATCH 1/4] #457 - add debugging for registry mapping --- volatility3/framework/layers/registry.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/layers/registry.py b/volatility3/framework/layers/registry.py index 32acbc4a9..82a6ad150 100644 --- a/volatility3/framework/layers/registry.py +++ b/volatility3/framework/layers/registry.py @@ -66,13 +66,13 @@ class RegistryHive(linear.LinearlyMappedLayer): self._hive_maxaddr_non_volatile = self.hive.Storage[0].Length self._hive_maxaddr_volatile = self.hive.Storage[1].Length self._maxaddr = 0x80000000 | self._hive_maxaddr_volatile - vollog.log(constants.LOGLEVEL_VVV, "Setting hive max address to {}".format(hex(self._maxaddr))) + vollog.log(constants.LOGLEVEL_VVV, "Setting hive {} max address to {}".format(self.name, hex(self._maxaddr))) except exceptions.InvalidAddressException: self._hive_maxaddr_non_volatile = 0x7fffffff self._hive_maxaddr_volatile = 0x7fffffff self._maxaddr = 0x80000000 | self._hive_maxaddr_volatile vollog.log(constants.LOGLEVEL_VVV, - "Exception when setting hive max address, using {}".format(hex(self._maxaddr))) + "Exception when setting hive {} max address, using {}".format(self.name, hex(self._maxaddr))) def _get_hive_maxaddr(self, volatile): return self._hive_maxaddr_volatile if volatile else self._hive_maxaddr_non_volatile @@ -199,6 +199,12 @@ class RegistryHive(linear.LinearlyMappedLayer): # Ignore the volatile bit when determining maxaddr validity volatile = self._mask(offset, 31, 31) >> 31 if offset & 0x7fffffff > self._get_hive_maxaddr(volatile): + vollog.log(constants.LOGLEVEL_VVV, + "Couldn't translate offset {}, greater than {} in {} store of {}".format( + hex(offset & 0x7fffffff), + hex(self._get_hive_maxaddr(volatile)), + "volative" if volatile else "non-volatile", + self.name)) raise RegistryInvalidIndex(self.name, "Mapping request for value greater than maxaddr") storage = self.hive.Storage[volatile] From 8c7b6b29d1b94d750c059cdb211101997eb561b0 Mon Sep 17 00:00:00 2001 From: superponible Date: Wed, 10 Mar 2021 14:50:27 -0600 Subject: [PATCH 2/4] #457 - include hive name in debug message --- volatility3/framework/layers/registry.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/layers/registry.py b/volatility3/framework/layers/registry.py index 82a6ad150..1cf7bcaf6 100644 --- a/volatility3/framework/layers/registry.py +++ b/volatility3/framework/layers/registry.py @@ -200,11 +200,12 @@ class RegistryHive(linear.LinearlyMappedLayer): volatile = self._mask(offset, 31, 31) >> 31 if offset & 0x7fffffff > self._get_hive_maxaddr(volatile): vollog.log(constants.LOGLEVEL_VVV, - "Couldn't translate offset {}, greater than {} in {} store of {}".format( + "Layer {} couldn't translate offset {}, greater than {} in {} store of {}".format( + self.name, hex(offset & 0x7fffffff), hex(self._get_hive_maxaddr(volatile)), "volative" if volatile else "non-volatile", - self.name)) + self.get_name())) raise RegistryInvalidIndex(self.name, "Mapping request for value greater than maxaddr") storage = self.hive.Storage[volatile] From a7cc978ac6f9b2f650e97c8e17e35b332c8445c8 Mon Sep 17 00:00:00 2001 From: superponible Date: Wed, 10 Mar 2021 14:52:21 -0600 Subject: [PATCH 3/4] #457 - filter hives for getsids and getservicesids --- volatility3/framework/plugins/windows/getservicesids.py | 5 +++-- volatility3/framework/plugins/windows/getsids.py | 1 + 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/getservicesids.py b/volatility3/framework/plugins/windows/getservicesids.py index 2b5ab11f4..f8a78dfcd 100644 --- a/volatility3/framework/plugins/windows/getservicesids.py +++ b/volatility3/framework/plugins/windows/getservicesids.py @@ -62,13 +62,14 @@ class GetServiceSIDs(interfaces.plugins.PluginInterface): def _generator(self): - # Go all over the hives + # Get the system hive for hive in hivelist.HiveList.list_hives(context = self.context, base_config_path = self.config_path, layer_name = self.config['primary'], symbol_table = self.config['nt_symbols'], + filter_string = 'machine\\system', hive_offsets = None): - # Get ConrolSet\Services. + # Get ControlSet\Services. try: services = hive.get_key(r"CurrentControlSet\Services") except (KeyError, exceptions.InvalidAddressException): diff --git a/volatility3/framework/plugins/windows/getsids.py b/volatility3/framework/plugins/windows/getsids.py index 30503b2bf..89b1f5f4f 100644 --- a/volatility3/framework/plugins/windows/getsids.py +++ b/volatility3/framework/plugins/windows/getsids.py @@ -81,6 +81,7 @@ class GetSIDs(interfaces.plugins.PluginInterface): base_config_path = self.config_path, layer_name = self.config['primary'], symbol_table = self.config['nt_symbols'], + filter_string = 'config\\software', hive_offsets = None): try: From d613b384d2cc8b29943bc8e5b7f12af338cb174b Mon Sep 17 00:00:00 2001 From: superponible Date: Mon, 12 Jul 2021 21:55:30 -0500 Subject: [PATCH 4/4] #457 - raise log level and use f-strings --- volatility3/framework/layers/registry.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/layers/registry.py b/volatility3/framework/layers/registry.py index 1cf7bcaf6..6f0d66beb 100644 --- a/volatility3/framework/layers/registry.py +++ b/volatility3/framework/layers/registry.py @@ -66,13 +66,13 @@ class RegistryHive(linear.LinearlyMappedLayer): self._hive_maxaddr_non_volatile = self.hive.Storage[0].Length self._hive_maxaddr_volatile = self.hive.Storage[1].Length self._maxaddr = 0x80000000 | self._hive_maxaddr_volatile - vollog.log(constants.LOGLEVEL_VVV, "Setting hive {} max address to {}".format(self.name, hex(self._maxaddr))) + vollog.log(constants.LOGLEVEL_VVVV, f"Setting hive {self.name} max address to {hex(self._maxaddr)}") except exceptions.InvalidAddressException: self._hive_maxaddr_non_volatile = 0x7fffffff self._hive_maxaddr_volatile = 0x7fffffff self._maxaddr = 0x80000000 | self._hive_maxaddr_volatile - vollog.log(constants.LOGLEVEL_VVV, - "Exception when setting hive {} max address, using {}".format(self.name, hex(self._maxaddr))) + vollog.log(constants.LOGLEVEL_VVVV, + f"Exception when setting hive {self.name} max address, using {hex(self._maxaddr)}") def _get_hive_maxaddr(self, volatile): return self._hive_maxaddr_volatile if volatile else self._hive_maxaddr_non_volatile