You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Nearly every plugin that calls get_key crashed in testing on at least one sample due to it throwing an exception when the key isn't paged in memory, such as:
File "/home/ub/volatility3/volatility3/framework/plugins/windows/hashdump.py", line 391, in get_hbootkey
sam_account_key = cls.get_hive_key(samhive, sam_account_path)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/ub/volatility3/volatility3/framework/plugins/windows/hashdump.py", line 334, in get_hive_key
result = hive.get_key(key)
^^^^^^^^^^^^^^^^^
File "/home/ub/volatility3/volatility3/framework/layers/registry.py", line 175, in get_key
root_node = self.get_node(self.root_cell_offset)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/ub/volatility3/volatility3/framework/layers/registry.py", line 143, in get_node
signature = cell.cast("string", max_length=2, encoding="latin-1")
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/ub/volatility3/volatility3/framework/interfaces/objects.py", line 189, in cast
return object_template(context=self._context, object_info=object_info)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/ub/volatility3/volatility3/framework/objects/templates.py", line 96, in __call__
return self.vol.object_class(
^^^^^^^^^^^^^^^^^^^^^^
File "/home/ub/volatility3/volatility3/framework/objects/__init__.py", line 352, in __new__
cls._unmarshall(
File "/home/ub/volatility3/volatility3/framework/objects/__init__.py", line 202, in _unmarshall
data = context.layers.read(
^^^^^^^^^^^^^^^^^^^^
File "/home/ub/volatility3/volatility3/framework/interfaces/layers.py", line 635, in read
return self[layer].read(offset, length, pad)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/ub/volatility3/volatility3/framework/layers/linear.py", line 63, in read
self._context.layers.read(layer, mapped_offset, mapped_length, pad)
File "/home/ub/volatility3/volatility3/framework/interfaces/layers.py", line 635, in read
return self[layer].read(offset, length, pad)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/ub/volatility3/volatility3/framework/layers/linear.py", line 45, in read
for offset, _, mapped_offset, mapped_length, layer in self.mapping(
File "/home/ub/volatility3/volatility3/framework/layers/intel.py", line 302, in mapping
for offset, size, mapped_offset, mapped_size, map_layer in self._mapping(
File "/home/ub/volatility3/volatility3/framework/layers/intel.py", line 358, in _mapping
chunk_offset, page_size, layer_name = self._translate(offset)
^^^^^^^^^^^^^^^^^^^^^^^
File "/home/ub/volatility3/volatility3/framework/layers/intel.py", line 510, in _translate
return self._translate_swap(self, offset, self._bits_per_register // 2)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/ub/volatility3/volatility3/framework/layers/intel.py", line 457, in _translate_swap
return super()._translate(offset)
^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/ub/volatility3/volatility3/framework/layers/intel.py", line 166, in _translate
raise exceptions.PagedInvalidAddressException(
volatility3.framework.exceptions.PagedInvalidAddressException: Page Fault at entry 0xffffffff00000430 in page entry
After #1472 is resolved, we then need to audit every call to get_key to ensure it catches the invalid page exception.
The text was updated successfully, but these errors were encountered:
Nearly every plugin that calls
get_key
crashed in testing on at least one sample due to it throwing an exception when the key isn't paged in memory, such as:After #1472 is resolved, we then need to audit every call to
get_key
to ensure it catches the invalid page exception.The text was updated successfully, but these errors were encountered: