diff --git a/volatility/plugins/malware/malfind.py b/volatility/plugins/malware/malfind.py index 56b8fe47..646ac96f 100644 --- a/volatility/plugins/malware/malfind.py +++ b/volatility/plugins/malware/malfind.py @@ -379,9 +379,18 @@ class YaraScan(taskmods.DllList): # the starting range is 0x80000000 because we may be dealing with # an image with the /3GB boot switch. kdbg = tasks.get_kdbg(addr_space) - start = kdbg.MmSystemRangeStart.dereference_as("address") - # Addresses should be truncated to 48 bits. + # FIXME: Addresses should be truncated to 48 bits. Currently + # we do that in Pointer.__eq__ but not in Pointer.v(). This prevents + # module lookups in yarascan's --kernel mode on x64 from working + # properly because win32.tasks.find_module cannot match the truncated + # address with non-truncated mod.DllBase.v(). Changing Pointer.v() + # could have wide spread effects, so this yarascan issue will need to + # be a "known issue" for 2.1 and we'll fix it immediately after, so + # code moving forward handles it right. In particular, after fixing it, + # we can dereference MmSystemRangeStart as a Pointer instead of an + # address and then remove the manual bitmask below. + start = kdbg.MmSystemRangeStart.dereference_as("address") start = start & 0xffffffffffff # Modules so we can map addresses to owners