From 87dc0d7e0652185c06aad685e243cd4e6432cb50 Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Tue, 24 Jul 2012 19:47:05 +0000 Subject: [PATCH] add a comment to yarascan which explains why module lookups will fail when operating in kernelmode on x64. it'll be a known issue of the plugin for 2.1, after which time we'll update trunk's Pointer.v() and be able to test more thoroughly before a release --- volatility/plugins/malware/malfind.py | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/volatility/plugins/malware/malfind.py b/volatility/plugins/malware/malfind.py index 56b8fe47..646ac96f 100644 --- a/volatility/plugins/malware/malfind.py +++ b/volatility/plugins/malware/malfind.py @@ -379,9 +379,18 @@ class YaraScan(taskmods.DllList): # the starting range is 0x80000000 because we may be dealing with # an image with the /3GB boot switch. kdbg = tasks.get_kdbg(addr_space) - start = kdbg.MmSystemRangeStart.dereference_as("address") - # Addresses should be truncated to 48 bits. + # FIXME: Addresses should be truncated to 48 bits. Currently + # we do that in Pointer.__eq__ but not in Pointer.v(). This prevents + # module lookups in yarascan's --kernel mode on x64 from working + # properly because win32.tasks.find_module cannot match the truncated + # address with non-truncated mod.DllBase.v(). Changing Pointer.v() + # could have wide spread effects, so this yarascan issue will need to + # be a "known issue" for 2.1 and we'll fix it immediately after, so + # code moving forward handles it right. In particular, after fixing it, + # we can dereference MmSystemRangeStart as a Pointer instead of an + # address and then remove the manual bitmask below. + start = kdbg.MmSystemRangeStart.dereference_as("address") start = start & 0xffffffffffff # Modules so we can map addresses to owners