From f707c0c4e9b22612578a4f12d006fa2b8027dddd Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 18 Nov 2016 17:14:48 +0000 Subject: [PATCH] Add in first shot at an 'efficient' virtual memory scanner. Uses page misses to calculate skipping distances. --- volatility/framework/layers/intel.py | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/volatility/framework/layers/intel.py b/volatility/framework/layers/intel.py index 5ee64a166..8ef2d9d90 100644 --- a/volatility/framework/layers/intel.py +++ b/volatility/framework/layers/intel.py @@ -148,6 +148,32 @@ class Intel(interfaces.layers.TranslationLayerInterface): requirements.IntRequirement(name = 'page_map_offset', optional = False)] + def scan(self, context, scanner, progress_callback = None, min_address = None, max_address = None): + min_address, max_address, scanner, total_size = self._pre_scan(context, min_address, max_address, + progress_callback, scanner) + current = min_address + range_start = None + while current <= max_address: + progress_callback((current - min_address) / total_size) + try: + if range_start is None: + range_start = current + address, page_size = self._translate(current) + if not context.memory[self._base_layer].is_valid(address): + if current - range_start > 0: + chunk = self.read(range_start, current - range_start) + for result in scanner(chunk, range_start): + yield result + range_start = None + current += page_size + except exceptions.PagedInvalidAddressException as e: + if current - range_start > 0: + chunk = self.read(range_start, current - range_start) + for result in scanner(chunk, range_start): + yield result + range_start = None + current += (1 << e.invalid_bits) + class IntelPAE(Intel): """Class for handling Physical Address Extensions for Intel architectures"""