Skip to content

Commit 37bdb6c

Browse files
ikelosikelos
authored
Merge pull request #1632 from volatilityfoundation/fix_poolscanners
Check Win10+ SlushSize member to support Windows 11 pool scanning. Re…
2 parents 2ffb3ac + ba56e42 commit 37bdb6c

File tree

2 files changed

+18
-15
lines changed

2 files changed

+18
-15
lines changed

‎volatility3/framework/plugins/windows/poolscanner.py‎

Lines changed: 15 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -205,6 +205,7 @@ def builtin_constraints(
205205
b"AtmT",
206206
type_name=symbol_table + constants.BANG + "_RTL_ATOM_TABLE",
207207
size=(200, None),
208+
# TODO - update this after the GUI code goes on
208209
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
209210
),
210211
# processes on windows before windows 8
@@ -214,7 +215,7 @@ def builtin_constraints(
214215
object_type="Process",
215216
size=(600, None),
216217
skip_type_test=True,
217-
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
218+
page_type=PoolType.NONPAGED | PoolType.FREE,
218219
),
219220
# processes on windows starting with windows 8
220221
PoolConstraint(
@@ -223,7 +224,7 @@ def builtin_constraints(
223224
object_type="Process",
224225
size=(600, None),
225226
skip_type_test=True,
226-
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
227+
page_type=PoolType.NONPAGED | PoolType.FREE,
227228
),
228229
# threads on windows before windows8
229230
PoolConstraint(
@@ -232,55 +233,55 @@ def builtin_constraints(
232233
object_type="Thread",
233234
size=(600, None), # -> 0x0258 - size of struct in win5.1
234235
skip_type_test=True,
235-
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
236+
page_type=PoolType.NONPAGED | PoolType.FREE,
236237
),
237238
# threads on windows starting with windows8
238239
PoolConstraint(
239240
b"Thre",
240241
type_name=symbol_table + constants.BANG + "_ETHREAD",
241242
object_type="Thread",
242243
size=(600, None), # -> 0x0258 - size of struct in win5.1
243-
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
244+
page_type=PoolType.NONPAGED | PoolType.FREE,
244245
),
245246
# files on windows before windows 8
246247
PoolConstraint(
247248
b"Fil\xe5",
248249
type_name=symbol_table + constants.BANG + "_FILE_OBJECT",
249250
object_type="File",
250251
size=(150, None),
251-
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
252+
page_type=PoolType.NONPAGED | PoolType.FREE,
252253
),
253254
# files on windows starting with windows 8
254255
PoolConstraint(
255256
b"File",
256257
type_name=symbol_table + constants.BANG + "_FILE_OBJECT",
257258
object_type="File",
258259
size=(150, None),
259-
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
260+
page_type=PoolType.NONPAGED | PoolType.FREE,
260261
),
261262
# mutants on windows before windows 8
262263
PoolConstraint(
263264
b"Mut\xe1",
264265
type_name=symbol_table + constants.BANG + "_KMUTANT",
265266
object_type="Mutant",
266267
size=(64, None),
267-
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
268+
page_type=PoolType.NONPAGED | PoolType.FREE,
268269
),
269270
# mutants on windows starting with windows 8
270271
PoolConstraint(
271272
b"Muta",
272273
type_name=symbol_table + constants.BANG + "_KMUTANT",
273274
object_type="Mutant",
274275
size=(64, None),
275-
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
276+
page_type=PoolType.NONPAGED | PoolType.FREE,
276277
),
277278
# drivers on windows before windows 8
278279
PoolConstraint(
279280
b"Dri\xf6",
280281
type_name=symbol_table + constants.BANG + "_DRIVER_OBJECT",
281282
object_type="Driver",
282283
size=(248, None),
283-
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
284+
page_type=PoolType.NONPAGED | PoolType.FREE,
284285
additional_structures=["_DRIVER_EXTENSION"],
285286
),
286287
# drivers on windows starting with windows 8
@@ -289,37 +290,37 @@ def builtin_constraints(
289290
type_name=symbol_table + constants.BANG + "_DRIVER_OBJECT",
290291
object_type="Driver",
291292
size=(248, None),
292-
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
293+
page_type=PoolType.NONPAGED | PoolType.FREE,
293294
),
294295
# kernel modules
295296
PoolConstraint(
296297
b"MmLd",
297298
type_name=symbol_table + constants.BANG + "_LDR_DATA_TABLE_ENTRY",
298299
size=(76, None),
299-
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
300+
page_type=PoolType.NONPAGED | PoolType.FREE,
300301
),
301302
# symlinks on windows before windows 8
302303
PoolConstraint(
303304
b"Sym\xe2",
304305
type_name=symbol_table + constants.BANG + "_OBJECT_SYMBOLIC_LINK",
305306
object_type="SymbolicLink",
306307
size=(72, None),
307-
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
308+
page_type=PoolType.NONPAGED | PoolType.FREE,
308309
),
309310
# symlinks on windows starting with windows 8
310311
PoolConstraint(
311312
b"Symb",
312313
type_name=symbol_table + constants.BANG + "_OBJECT_SYMBOLIC_LINK",
313314
object_type="SymbolicLink",
314315
size=(72, None),
315-
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
316+
page_type=PoolType.NONPAGED | PoolType.FREE,
316317
),
317318
# registry hives
318319
PoolConstraint(
319320
b"CM10",
320321
type_name=symbol_table + constants.BANG + "_CMHIVE",
321322
size=(800, None),
322-
page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE,
323+
page_type=PoolType.PAGED | PoolType.FREE,
323324
skip_type_test=True,
324325
),
325326
]

‎volatility3/framework/symbols/windows/__init__.py‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,9 @@ def __init__(self, *args, **kwargs) -> None:
4848

4949
# This doesn't exist in very specific versions of windows
5050
with contextlib.suppress(ValueError):
51-
if self.get_type("_POOL_TRACKER_BIG_PAGES").has_member("PoolType"):
51+
if self.get_type("_POOL_TRACKER_BIG_PAGES").has_member(
52+
"PoolType"
53+
) or self.get_type("_POOL_TRACKER_BIG_PAGES").has_member("SlushSize"):
5254
self.set_type_class("_POOL_HEADER", pool.POOL_HEADER_VISTA)
5355
else:
5456
self.set_type_class("_POOL_HEADER", pool.POOL_HEADER)

0 commit comments

Comments
 (0)