admin/volatilityfoundation-volatility
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility synced 2026-06-08 18:04:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

Mac - route cache smear protection

Browse Source
This commit is contained in:
Andrew Case
2019-05-21 14:37:01 -05:00
parent 74f1134865
commit f44fe060a4
1 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/plugins/mac/route.py
+17 -2
View File
@@ -34,10 +34,15 @@ class mac_route(common.AbstractMacCommand):
def _get_table(self, tbl):
rnh = tbl #obj.Object("radix_node", offset=tbl.v(), vm=self.addr_space)
rn = rnh.rnh_treetop
seen = set()
while rn.is_valid() and rn.rn_bit >= 0:
rn = rn.rn_u.rn_node.rn_L
if rn.v() in seen:
break
seen.add(rn.v())
rn = rn.rn_u.rn_node.rn_L
rnhash = {}
while rn.is_valid():
@@ -48,7 +53,12 @@ class mac_route(common.AbstractMacCommand):
rnhash[rn] = 1
seen = set()
while rn.is_valid() and rn.rn_parent.rn_u.rn_node.rn_R == rn and rn.rn_flags & 2 == 0:
if rn.v() in seen:
break
seen.add(rn.v())
rn = rn.rn_parent
rn = rn.rn_parent.rn_u.rn_node.rn_R
@@ -60,7 +70,12 @@ class mac_route(common.AbstractMacCommand):
nextptr = rn
seen = set()
while base.v() != 0:
if base.v() in seen:
break
seen.add(base.v())
rn = base
base = rn.rn_u.rn_leaf.rn_Dupedkey