diff --git a/volatility/plugins/addrspaces/intel.py b/volatility/plugins/addrspaces/intel.py index 0d0d4a74..96914328 100644 --- a/volatility/plugins/addrspaces/intel.py +++ b/volatility/plugins/addrspaces/intel.py @@ -84,6 +84,8 @@ class JKIA32PagedMemory(standard.AbstractWritablePagedMemory, addrspace.BaseAddr volmag = obj.VolMagic(self) if not skip_as_check and hasattr(volmag, self.checkname): self.as_assert(getattr(volmag, self.checkname).v(), "Failed valid Address Space check") + else: + self.as_assert(False, "Profile does not have valid Address Space check") # Reserved for future use #self.pagefile = config.PAGEFILE diff --git a/volatility/plugins/overlays/windows/windows.py b/volatility/plugins/overlays/windows/windows.py index 358b4956..6d9cbac9 100644 --- a/volatility/plugins/overlays/windows/windows.py +++ b/volatility/plugins/overlays/windows/windows.py @@ -41,6 +41,7 @@ windows_overlay = { 'KPCR' : [ 0x0, ['VolatilityMagic', dict(value = 0xffdff000, configname = "KPCR")]], 'KDBG' : [ 0x0, ['VolatilityKDBG', dict(configname = "KDBG")]], 'IA32ValidAS': [ 0x0, ['VolatilityIA32ValidAS']], + 'AMD64ValidAS': [ 0x0, ['VolatilityAMD64ValidAS']], # Pool allocations are aligned to this many bytes. 'PoolAlignment': [0x0, ['VolatilityMagic', dict(value = 8)]], #hibrfil.sys values @@ -785,6 +786,17 @@ class VolatilityIA32ValidAS(obj.VolatilityMagic): yield False +class VolatilityAMD64ValidAS(obj.VolatilityMagic): + def generate_suggestions(self): + if self.obj_vm.vtop(0xFFFFF78000000000) != None: + if (self.obj_vm.vtop(0xFFFFF78000000000)) == (self.obj_vm.vtop(0x7FFE0000)): + yield True + raise StopIteration + if obj.Object("_KUSER_SHARED_DATA", offset = 0xFFFFF78000000000, vm = self.obj_vm).Reserved1 == 0x7FFEFFFF: + yield True + raise StopIteration + yield False + class _IMAGE_DOS_HEADER(obj.CType): """DOS header""" @@ -923,6 +935,7 @@ class WindowsObjectClasses(obj.ProfileModification): 'VolatilityKPCR': VolatilityKPCR, 'VolatilityKDBG': VolatilityKDBG, 'VolatilityIA32ValidAS': VolatilityIA32ValidAS, + 'VolatilityAMD64ValidAS': VolatilityAMD64ValidAS, 'VolatilityMaxAddress': VolatilityMaxAddress, '_IMAGE_DOS_HEADER': _IMAGE_DOS_HEADER, '_IMAGE_NT_HEADERS': _IMAGE_NT_HEADERS,