Comments (3)
this blows up due to this code path:
in render_text this is called:
self.parse_string(object_name_info_obj.Name)
which is the line shown in the backtrace. The object_name_info_obj comes from
line 246 in the calculate function in class MutantScan(FileScan):
## Now we need to work out the _OBJECT_NAME_INFO object
object_name_info_obj = obj.Object("_OBJECT_NAME_INFO", vm = address_space,
offset = object_obj.offset - \
object_obj.NameInfoOffset )
so I grepped for _OBJECT_NAME_INFO and the only reference is in
plugins/overlays/Windows/vtypes.py and its hardcoded to have a directory and
name member, but when I look the vtypes file for XP SP3. I see a structure
OBJECT_NAME_INFORMATION that has the definition:
'_OBJECT_NAME_INFORMATION' : [ 0x8, {
'Name' : [ 0x0, ['_UNICODE_STRING']],
} ],
which only has the name member. I assuming that the differences in the
_OBJECT_NAME_INFO structure between vtypes.py and the xp sp3 vtypes is the
problem. the code should properly be changed to use a _OBJECT_NAME_INFORMATION
structure instead of the "INFO" version unless I am missing something.
Original comment by [email protected]
on 26 Aug 2010 at 1:52
from volatility.
I edited the code to use OBJECT_NAME_INFORMATION and it seems to work now as
lines like this are coming back in the results:
0x018df700 0x00000005 -506228896 1 1 0x00000000
WindowsUpdateTracingMutex
there are a bunch of jibberish lines though like this one:
0x018bf3f0 0x00000003 -510376504 1 1 0x00000000
㼿㼿㼿㼿㼿㼿㼿㼿㼿㼿㼿
which may be normal since its hitting unallocated memory. either way it works a
lot better and doesn't break
Original comment by [email protected]
on 26 Aug 2010 at 2:18
from volatility.
Excellent, thanks. This is the kind of bug I was expecting to hit because the
names in vtypes were entered manually and people might have used their own
versions (like using INFO rather than INFORMATION). I've made the change
(r400), and it still seems to work with XPSP2 (even though
OBJECT_NAME_INFORMATION seems to have a directory pointer in SP2). Thanks for
spotting it, and tracking down the fix! 5:)
Original comment by [email protected]
on 26 Aug 2010 at 11:16
- Changed state: Fixed
from volatility.
Related Issues (20)
- HPAKExtract HOT 2
- python tools/mac/convert.py converted-10.9.4.64bit.dwarfdump > 10.9.4.64bit.vtypes results in KeyError: 'AT_data_member_location' HOT 3
- Volatility 2.4 fails to decompress win8 hiberfil.sys HOT 2
- Cannot run the 'make' command HOT 19
- Unable to obtain password hashes HOT 1
- KiFastSystemCall I want to know where is next step? HOT 2
- Error when I make profile in Window 8 Pro (64 bits) HOT 1
- Except psscan no other cmds are working HOT 1
- Getting several "no such option" errors HOT 1
- Volatility was functioning, now errors out HOT 1
- Running VF from Jython HOT 2
- Failed to import volatility.plugins.overlays.linux.linux (ValueError: too many values to unpack) HOT 2
- File new issues on github: https://github.com/volatilityfoundation/volatility/issues HOT 17
- yarascan fails to ececute grep expression (attached) HOT 4
- imageinfo takes forever HOT 1
- How to know the device is using by how many processes in the computer system ? HOT 1
- Error adding new plugin in 2.3.1 HOT 2
- Cant run volatility command Pslist from Eclipse(python IDE) HOT 1
- "This command does not support the profile" Error HOT 1
- Volatility Standalone for Windows incorrectly states profile is invalid HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from volatility.