From fb54a2cade948d791e2705f39bc99d672ff73e57 Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Tue, 30 Mar 2021 21:23:46 -0500 Subject: [PATCH] report segments in the crash layer with LOGLEVEL_VVVV --- volatility3/framework/layers/crash.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/volatility3/framework/layers/crash.py b/volatility3/framework/layers/crash.py index 895b4cedf..8d6b479fc 100644 --- a/volatility3/framework/layers/crash.py +++ b/volatility3/framework/layers/crash.py @@ -150,6 +150,15 @@ class WindowsCrashDump32Layer(segmented.SegmentedLayer): if len(segments) == 0: raise WindowsCrashDumpFormatException(self.name, "No Crash segments defined in {}".format(self._base_layer)) + else: + # report the segments for debugging. this is valuable for dev/troubleshooting but + # not important enough for a dedicated plugin. + for idx, (start_position, mapped_offset, length, _) in enumerate(segments): + vollog.log(constants.LOGLEVEL_VVVV, + "Segment {}: Position {:#x} Offset {:#x} Length {:#x}".format(idx, + start_position, + mapped_offset, + length)) self._segments = segments