diff --git a/volatility/framework/layers/crash.py b/volatility/framework/layers/crash.py index 5c11d100a..c1a4f3a56 100644 --- a/volatility/framework/layers/crash.py +++ b/volatility/framework/layers/crash.py @@ -35,15 +35,19 @@ class WindowsCrashDump32Layer(segmented.SegmentedLayer): config_path: str, name: str) -> None: - # Construct these so we can use self.config self._context = context self._config_path = config_path self._page_size = 0x1000 #self._base_layer, self._meta_layer = self.config["base_layer"], self.config["meta_layer"] self._base_layer = self.config["base_layer"] - # Create a custom SymbolSpace + #self._crash_table_name = intermed.IntermediateSymbolTable.create(context, + # self._config_path, + # 'windows', + # 'crash') + #context.symbol_space.append(self._crash_table_name) + self._crash_table_name = context.symbol_space.free_table_name("crash") crash_path = "file://" + os_path.join(os_path.dirname(__file__), '..', \ 'symbols', 'windows', 'crash.json') @@ -70,11 +74,8 @@ class WindowsCrashDump32Layer(segmented.SegmentedLayer): if self.header.DumpType != 0x1: raise WindowsCrashDump32FormatException("unsupported dump format 0x{:x}".format(self.header.DumpType)) - # Then call the super, which will call load_segments super().__init__(context, config_path, name) - #self._load_segments() - def _load_segments(self) -> None: """Loads up the segments from the meta_layer""" diff --git a/volatility/framework/symbols/windows/crash.json b/volatility/framework/symbols/windows/crash.json index 9ce818997..d27d4a27e 100644 --- a/volatility/framework/symbols/windows/crash.json +++ b/volatility/framework/symbols/windows/crash.json @@ -16,7 +16,7 @@ } }, "ValidDump": { - "offset": 0, + "offset": 4, "type": { "count": 4, "kind": "array", @@ -47,6 +47,102 @@ "name": "unsigned long" } }, + "PfnDataBase": { + "offset": 20, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "PsLoadedModuleList": { + "offset": 24, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "PsActiveProcessHead": { + "offset": 28, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "MachineImageType": { + "offset": 32, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "NumberProcessors": { + "offset": 36, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "BugCheckCode": { + "offset": 40, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "BugCheckCodeParameter": { + "offset": 44, + "type": { + "count": 4, + "kind": "array", + "subtype": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "VersionUser": { + "offset": 60, + "type": { + "count": 32, + "kind": "array", + "subtype": { + "kind": "base", + "name": "unsigned char" + } + } + }, + "PaeEnabled": { + "offset": 92, + "type": { + "kind": "base", + "name": "unsigned char" + } + }, + "KdSecondaryVersion": { + "offset": 93, + "type": { + "kind": "base", + "name": "unsigned char" + } + }, + "VersionUser2": { + "offset": 94, + "type": { + "count": 2, + "kind": "array", + "subtype": { + "kind": "base", + "name": "unsigned char" + } + } + }, + "KdDebuggerDataBlock": { + "offset": 96, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, "PhysicalMemoryBlockBuffer": { "offset": 100, "type": { @@ -54,17 +150,165 @@ "name": "_PHYSICAL_MEMORY_DESCRIPTOR" } }, + "ContextRecord": { + "offset": 800, + "type": { + "count": 1200, + "kind": "array", + "subtype": { + "kind": "base", + "name": "unsigned char" + } + } + }, + "Exception": { + "offset": 2000, + "type": { + "kind": "struct", + "name": "_EXCEPTION_RECORD32" + } + }, + "Comment": { + "offset": 2080, + "type": { + "count": 128, + "kind": "array", + "subtype": { + "kind": "base", + "name": "unsigned char" + } + } + }, "DumpType": { "offset": 3976, "type": { "kind": "base", "name": "unsigned long" } + }, + "MiniDumpFields": { + "offset": 3980, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "SecondaryDataState": { + "offset": 3984, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "ProductType": { + "offset": 3988, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "SuiteMask": { + "offset": 3992, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "WriterStatus": { + "offset": 3996, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "RequiredDumpSpace": { + "offset": 4000, + "type": { + "kind": "base", + "name": "unsigned long long" + } + }, + "SystemUpTime": { + "offset": 4024, + "type": { + "kind": "base", + "name": "unsigned long long" + } + }, + "SystemTime": { + "offset": 4032, + "type": { + "kind": "base", + "name": "unsigned long long" + } + }, + "reserved3": { + "offset": 4040, + "type": { + "count": 56, + "kind": "array", + "subtype": { + "kind": "base", + "name": "unsigned char" + } + } } }, "kind": "struct", "size": 4096 }, + "_EXCEPTION_RECORD32": { + "fields": { + "ExceptionCode": { + "offset": 0, + "type": { + "kind": "base", + "name": "long" + } + }, + "ExceptionFlags": { + "offset": 4, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "ExceptionRecord": { + "offset": 8, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "ExceptionAddress": { + "offset": 12, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "NumberParameters": { + "offset": 16, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "ExceptionInformation": { + "offset": 20, + "type": { + "count": 15, + "kind": "array", + "subtype": { + "kind": "base", + "name": "unsigned long" + } + } + } + }, + "kind": "struct", + "size": 80 + }, "_PHYSICAL_MEMORY_DESCRIPTOR": { "fields": { "NumberOfPages": { @@ -165,10 +409,10 @@ }, "metadata": { "producer": { - "version": "0.0.1", - "name": "ikelos-by-hand", - "datetime": "2017-09-04T22:45:22" + "version": "0.0.2", + "name": "awalters-by-hand", + "datetime": "2018-05-01T16:30:00" }, - "format": "4.0.0" + "format": "4.1.0" } }