From f2b24da4d9b4e5ab3be2ce0959385083a5ab1c52 Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Thu, 28 Jun 2012 19:09:18 +0000 Subject: [PATCH] tweak malfind's injection filter - the criteria it uses to detect potentially malicious memory segments. fixes Issue #278 --- volatility/plugins/malware/malfind.py | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/volatility/plugins/malware/malfind.py b/volatility/plugins/malware/malfind.py index 6720aa09..1d632246 100644 --- a/volatility/plugins/malware/malfind.py +++ b/volatility/plugins/malware/malfind.py @@ -152,9 +152,22 @@ class MalwareEPROCESS(windows._EPROCESS): contain injected code. """ protect = vadinfo.PROTECT_FLAGS.get(vad.u.VadFlags.Protection.v(), "") + write_exec = "EXECUTE" in protect and "WRITE" in protect - return (vad.u.VadFlags.PrivateMemory == 1 and "EXECUTE" in protect and - "WRITE" in protect and vad.Tag == "VadS") + # The Write/Execute check applies to everything + if not write_exec: + return False + + # This is a typical VirtualAlloc'd injection + if vad.u.VadFlags.PrivateMemory == 1 and vad.Tag == "VadS": + return True + + # This is a stuxnet-style injection + if (vad.u.VadFlags.PrivateMemory == 0 and + protect != "PAGE_EXECUTE_WRITECOPY"): + return True + + return False def _mapped_file_filter(self, vad): """