WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-20 13:42:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

Windows - protect handles from smear

Browse Source
This commit is contained in:
atcuno
2019-10-17 11:03:48 -04:00
parent 2cad54ea6b
commit e0097ac9c1
1 changed files with 18 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/handles.py
+18 -6
View File
@@ -167,6 +167,11 @@ class Handles(interfaces.plugins.PluginInterface):
table_addr = ntkrnlmp.get_symbol("ObTypeIndexTable").address
except exceptions.SymbolError:
table_addr = ntkrnlmp.get_symbol("ObpObjectTypes").address
trans_layer = context.layers[layer_name]
if not trans_layer.is_valid(kvo + table_addr):
return type_map
ptrs = ntkrnlmp.object(object_type = "array",
offset = table_addr,
@@ -178,13 +183,17 @@ class Handles(interfaces.plugins.PluginInterface):
# loop when we encounter the first null entry after that
if i > 0 and ptr == 0:
break
objt = ptr.dereference().cast(symbol_table + constants.BANG + "_OBJECT_TYPE")
try:
objt = ptr.dereference().cast(symbol_table + constants.BANG + "_OBJECT_TYPE")
except exceptions.InvalidAddressException:
continue
try:
type_name = objt.Name.String
except exceptions.InvalidAddressException:
vollog.log(constants.LOGLEVEL_VVV,
"Cannot access _OBJECT_HEADER.Name at {0:#x}".format(objt.Name.vol.offset))
"Cannot access _OBJECT_HEADER Name at {0:#x}".format(objt.vol.offset))
continue
type_map[i] = type_name
@@ -276,28 +285,31 @@ class Handles(interfaces.plugins.PluginInterface):
type_map = self.get_type_map(context = self.context,
layer_name = self.config["primary"],
symbol_table = self.config["nt_symbols"])
cookie = self.find_cookie(context = self.context,
layer_name = self.config["primary"],
symbol_table = self.config["nt_symbols"])
for proc in procs:
try:
object_table = proc.ObjectTable
except exceptions.InvalidAddressException:
vollog.log(constants.LOGLEVEL_VVV,
"Cannot access _EPROCESS.ObjectType at {0:#x}".format(proc.ObjectTable.vol.offset))
"Cannot access _EPROCESS.ObjectType at {0:#x}".format(proc.vol.offset))
continue
process_name = utility.array_to_string(proc.ImageFileName)
for entry in self.handles(object_table):
try:
obj_type = entry.get_object_type(type_map, cookie)
self.context.layers[self.config["primary"]].is_valid(entry.vol.offset)
except exceptions.InvalidAddressException:
continue
try:
obj_type = entry.get_object_type(type_map, cookie)
if obj_type == None:
continue
if obj_type == "File":
item = entry.Body.cast("_FILE_OBJECT")
obj_name = item.file_name_with_device()