bring back the ability for malfind to ignore VADs whose entire region is either unavailable due to paging or all 0's...this was lost in r2077 because we avoided reading the entire range into memory at once.

volatility/plugins/malware/malfind.py

@@ -456,10 +456,38 @@ class YaraScan(taskmods.DllList):
 class Malfind(vadinfo.VADDump):
     "Find hidden and injected code"
 
+    def _is_vad_empty(self, vad, address_space):
+        """
+        Check if a VAD region is either entirely unavailable 
+        due to paging, entirely consiting of zeros, or a 
+        combination of the two. This helps ignore false positives
+        whose VAD flags match task._injection_filter requirements
+        but there's no data and thus not worth reporting it. 
+
+        @param vad: an MMVAD object in kernel AS
+        @param address_space: the process address space 
+        """
+        
+        PAGE_SIZE = 0x1000
+        all_zero_page = "\x00" * PAGE_SIZE
+
+        offset = 0
+        while offset < vad.Length:
+            next_addr = vad.Start + offset
+            if (address_space.is_valid_address(next_addr) and 
+                    address_space.read(next_addr, PAGE_SIZE) != all_zero_page):
+                return False
+            offset += PAGE_SIZE
+
+        return True
+
     def render_text(self, outfd, data):
         for task in data:
             for vad, address_space in task.get_vads(vad_filter = task._injection_filter):
 
+                if self._is_vad_empty(vad, address_space):
+                    continue
+
                 content = address_space.zread(vad.Start, 64)
 
                 outfd.write("Process: {0} Pid: {1} Address: {2:#x}\n".format(