From 0b33a79dc6465884105a60cb3d2054c61885a2eb Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 2 Nov 2022 21:10:51 +0000 Subject: [PATCH] Report IRP entries that point inside a hidden module. This is a common rootkit technique. --- volatility3/framework/plugins/windows/driverirp.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/volatility3/framework/plugins/windows/driverirp.py b/volatility3/framework/plugins/windows/driverirp.py index 7f9bc6b08..4013bdb8f 100644 --- a/volatility3/framework/plugins/windows/driverirp.py +++ b/volatility3/framework/plugins/windows/driverirp.py @@ -48,7 +48,10 @@ class DriverIrp(interfaces.plugins.PluginInterface): for i, address in enumerate(driver.MajorFunction): module_symbols = collection.get_module_symbols_by_absolute_location(address) + module_found = False + for module_name, symbol_generator in module_symbols: + module_found = True symbols_found = False for symbol in symbol_generator: @@ -60,6 +63,11 @@ class DriverIrp(interfaces.plugins.PluginInterface): yield (0, (format_hints.Hex(driver.vol.offset), driver_name, MAJOR_FUNCTIONS[i], format_hints.Hex(address), module_name, renderers.NotAvailableValue())) + if not module_found: + yield (0, (format_hints.Hex(driver.vol.offset), driver_name, MAJOR_FUNCTIONS[i], + format_hints.Hex(address), renderers.NotAvailableValue(), renderers.NotAvailableValue())) + + def run(self): return renderers.TreeGrid([