admin/volatilityfoundation-volatility
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility synced 2026-06-08 18:04:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

the --fix parameter to PE dumping plugins was broken on wow64

Browse Source 
explicitly define _IMAGE_OPTIONAL_HEADER32 so we can apply it to 32-bit
PE files when running under 64-bit windows
This commit is contained in:
Michael Ligh
2016-05-12 16:44:18 -07:00
parent aac23ab607
commit c6841586cc
1 changed files with 45 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/plugins/overlays/windows/pe_vtypes.py
+45 -2
View File
@@ -127,6 +127,40 @@ pe_vtypes = {
'FileSubType': [0x28, ['unsigned long']],
'FileDate': [0x2C, ['WinTimeStamp']],
} ],
'_IMAGE_OPTIONAL_HEADER32' : [ 0xe0, {
'Magic' : [ 0x0, ['unsigned short']],
'MajorLinkerVersion' : [ 0x2, ['unsigned char']],
'MinorLinkerVersion' : [ 0x3, ['unsigned char']],
'SizeOfCode' : [ 0x4, ['unsigned long']],
'SizeOfInitializedData' : [ 0x8, ['unsigned long']],
'SizeOfUninitializedData' : [ 0xc, ['unsigned long']],
'AddressOfEntryPoint' : [ 0x10, ['unsigned long']],
'BaseOfCode' : [ 0x14, ['unsigned long']],
'BaseOfData' : [ 0x18, ['unsigned long']],
'ImageBase' : [ 0x1c, ['unsigned long']],
'SectionAlignment' : [ 0x20, ['unsigned long']],
'FileAlignment' : [ 0x24, ['unsigned long']],
'MajorOperatingSystemVersion' : [ 0x28, ['unsigned short']],
'MinorOperatingSystemVersion' : [ 0x2a, ['unsigned short']],
'MajorImageVersion' : [ 0x2c, ['unsigned short']],
'MinorImageVersion' : [ 0x2e, ['unsigned short']],
'MajorSubsystemVersion' : [ 0x30, ['unsigned short']],
'MinorSubsystemVersion' : [ 0x32, ['unsigned short']],
'Win32VersionValue' : [ 0x34, ['unsigned long']],
'SizeOfImage' : [ 0x38, ['unsigned long']],
'SizeOfHeaders' : [ 0x3c, ['unsigned long']],
'CheckSum' : [ 0x40, ['unsigned long']],
'Subsystem' : [ 0x44, ['unsigned short']],
'DllCharacteristics' : [ 0x46, ['unsigned short']],
'SizeOfStackReserve' : [ 0x48, ['unsigned long']],
'SizeOfStackCommit' : [ 0x4c, ['unsigned long']],
'SizeOfHeapReserve' : [ 0x50, ['unsigned long']],
'SizeOfHeapCommit' : [ 0x54, ['unsigned long']],
'LoaderFlags' : [ 0x58, ['unsigned long']],
'NumberOfRvaAndSizes' : [ 0x5c, ['unsigned long']],
'DataDirectory' : [ 0x60, ['array', 16, ['_IMAGE_DATA_DIRECTORY']]],
} ],
}
pe_vtypes_64 = {
@@ -163,6 +197,9 @@ resource_types = {
'RT_HTML' : 23,
}
IMAGE_NT_OPTIONAL_HDR32_MAGIC = 0x10b
IMAGE_NT_OPTIONAL_HDR64_MAGIC = 0x20b
class _IMAGE_EXPORT_DIRECTORY(obj.CType):
"""Class for PE export directory"""
@@ -652,8 +689,14 @@ class _IMAGE_DOS_HEADER(obj.CType):
provided base address
"""
imb_offs = nt_header.OptionalHeader.ImageBase.obj_offset - self.obj_offset
imb = nt_header.OptionalHeader.ImageBase
opthdr = nt_header.OptionalHeader
if opthdr.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC:
if opthdr.obj_vm.profile.metadata.get("memory_model") == "64bit":
opthdr = opthdr.cast("_IMAGE_OPTIONAL_HEADER32")
imb_offs = opthdr.ImageBase.obj_offset - self.obj_offset
imb = opthdr.ImageBase
newval = struct.pack(imb.format_string, int(self.obj_offset))
return header[:imb_offs] + newval + header[imb_offs+imb.size():]