From dec52f7a4306cf87b192d4fe34407fc389e5d48b Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Tue, 24 Jul 2012 19:37:11 +0000 Subject: [PATCH] bring back the ability for malfind to ignore VADs whose entire region is either unavailable due to paging or all 0's...this was lost in r2077 because we avoided reading the entire range into memory at once. --- volatility/plugins/malware/malfind.py | 28 +++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/volatility/plugins/malware/malfind.py b/volatility/plugins/malware/malfind.py index ab75fb12..56b8fe47 100644 --- a/volatility/plugins/malware/malfind.py +++ b/volatility/plugins/malware/malfind.py @@ -456,10 +456,38 @@ class YaraScan(taskmods.DllList): class Malfind(vadinfo.VADDump): "Find hidden and injected code" + def _is_vad_empty(self, vad, address_space): + """ + Check if a VAD region is either entirely unavailable + due to paging, entirely consiting of zeros, or a + combination of the two. This helps ignore false positives + whose VAD flags match task._injection_filter requirements + but there's no data and thus not worth reporting it. + + @param vad: an MMVAD object in kernel AS + @param address_space: the process address space + """ + + PAGE_SIZE = 0x1000 + all_zero_page = "\x00" * PAGE_SIZE + + offset = 0 + while offset < vad.Length: + next_addr = vad.Start + offset + if (address_space.is_valid_address(next_addr) and + address_space.read(next_addr, PAGE_SIZE) != all_zero_page): + return False + offset += PAGE_SIZE + + return True + def render_text(self, outfd, data): for task in data: for vad, address_space in task.get_vads(vad_filter = task._injection_filter): + if self._is_vad_empty(vad, address_space): + continue + content = address_space.zread(vad.Start, 64) outfd.write("Process: {0} Pid: {1} Address: {2:#x}\n".format(