WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 11:47:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Windows - protect handles from smear

Browse Source
This commit is contained in:
atcuno
2019-10-17 11:03:48 -04:00
parent 2cad54ea6b
commit e0097ac9c1
1 changed files with 18 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/handles.py
+18 -6
View File
@@ -168,6 +168,11 @@ class Handles(interfaces.plugins.PluginInterface):
except exceptions.SymbolError: except exceptions.SymbolError:
table_addr = ntkrnlmp.get_symbol("ObpObjectTypes").address table_addr = ntkrnlmp.get_symbol("ObpObjectTypes").address
trans_layer = context.layers[layer_name]
if not trans_layer.is_valid(kvo + table_addr):
return type_map
ptrs = ntkrnlmp.object(object_type = "array", ptrs = ntkrnlmp.object(object_type = "array",
offset = table_addr, offset = table_addr,
subtype = ntkrnlmp.get_type("pointer"), subtype = ntkrnlmp.get_type("pointer"),
@@ -178,13 +183,17 @@ class Handles(interfaces.plugins.PluginInterface):
# loop when we encounter the first null entry after that # loop when we encounter the first null entry after that
if i > 0 and ptr == 0: if i > 0 and ptr == 0:
break break
objt = ptr.dereference().cast(symbol_table + constants.BANG + "_OBJECT_TYPE")
try:
objt = ptr.dereference().cast(symbol_table + constants.BANG + "_OBJECT_TYPE")
except exceptions.InvalidAddressException:
continue
try: try:
type_name = objt.Name.String type_name = objt.Name.String
except exceptions.InvalidAddressException: except exceptions.InvalidAddressException:
vollog.log(constants.LOGLEVEL_VVV, vollog.log(constants.LOGLEVEL_VVV,
"Cannot access _OBJECT_HEADER.Name at {0:#x}".format(objt.Name.vol.offset)) "Cannot access _OBJECT_HEADER Name at {0:#x}".format(objt.vol.offset))
continue continue
type_map[i] = type_name type_map[i] = type_name
@@ -276,28 +285,31 @@ class Handles(interfaces.plugins.PluginInterface):
type_map = self.get_type_map(context = self.context, type_map = self.get_type_map(context = self.context,
layer_name = self.config["primary"], layer_name = self.config["primary"],
symbol_table = self.config["nt_symbols"]) symbol_table = self.config["nt_symbols"])
cookie = self.find_cookie(context = self.context, cookie = self.find_cookie(context = self.context,
layer_name = self.config["primary"], layer_name = self.config["primary"],
symbol_table = self.config["nt_symbols"]) symbol_table = self.config["nt_symbols"])
for proc in procs: for proc in procs:
try: try:
object_table = proc.ObjectTable object_table = proc.ObjectTable
except exceptions.InvalidAddressException: except exceptions.InvalidAddressException:
vollog.log(constants.LOGLEVEL_VVV, vollog.log(constants.LOGLEVEL_VVV,
"Cannot access _EPROCESS.ObjectType at {0:#x}".format(proc.ObjectTable.vol.offset)) "Cannot access _EPROCESS.ObjectType at {0:#x}".format(proc.vol.offset))
continue continue
process_name = utility.array_to_string(proc.ImageFileName) process_name = utility.array_to_string(proc.ImageFileName)
for entry in self.handles(object_table): for entry in self.handles(object_table):
try: try:
obj_type = entry.get_object_type(type_map, cookie) self.context.layers[self.config["primary"]].is_valid(entry.vol.offset)
except exceptions.InvalidAddressException:
continue
try:
obj_type = entry.get_object_type(type_map, cookie)
if obj_type == None: if obj_type == None:
continue continue
if obj_type == "File": if obj_type == "File":
item = entry.Body.cast("_FILE_OBJECT") item = entry.Body.cast("_FILE_OBJECT")
obj_name = item.file_name_with_device() obj_name = item.file_name_with_device()