From 63ba549bcab61799042ecc4b020bcae7359af787 Mon Sep 17 00:00:00 2001 From: Jan Date: Sun, 10 Jan 2021 17:08:14 +0100 Subject: [PATCH 1/2] fixes off-by-one error in port bitmap parsing --- volatility/framework/plugins/windows/netstat.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/framework/plugins/windows/netstat.py b/volatility/framework/plugins/windows/netstat.py index b0d3c8bcf..96da1618b 100644 --- a/volatility/framework/plugins/windows/netstat.py +++ b/volatility/framework/plugins/windows/netstat.py @@ -97,7 +97,7 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): for idx in range(bitmap_size_in_byte-1): current_byte = context.layers[layer_name].read(bitmap_offset + idx, 1)[0] current_offs = idx * 8 - for bit in range(7): + for bit in range(8): if current_byte & (1 << bit) != 0: ret.append(bit + current_offs) return ret From e92920f6e66a0dfb3f56354676d5963446d4e041 Mon Sep 17 00:00:00 2001 From: Jan Date: Sun, 10 Jan 2021 17:23:00 +0100 Subject: [PATCH 2/2] another off-by-one error when parsing bitmaps --- volatility/framework/plugins/windows/netstat.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/framework/plugins/windows/netstat.py b/volatility/framework/plugins/windows/netstat.py index 96da1618b..67e781380 100644 --- a/volatility/framework/plugins/windows/netstat.py +++ b/volatility/framework/plugins/windows/netstat.py @@ -94,7 +94,7 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): The list of indices at which a 1 was found. """ ret = [] - for idx in range(bitmap_size_in_byte-1): + for idx in range(bitmap_size_in_byte): current_byte = context.layers[layer_name].read(bitmap_offset + idx, 1)[0] current_offs = idx * 8 for bit in range(8):