Closed GoogleCodeExporter closed 9 years ago
Yeah, I noticed that too when writing a patch for hibernation file support that
_KGDTENTRY is defined in all vtypes and varies somewhat between OSes. I think
presently the only place it is used is in hibinfo
(http://code.google.com/p/volatility/source/browse/trunk/volatility/plugins/hibi
nfo.py#42) and that (to get NtTibAddress) code only works as is for XP and 2K3
x86.
Original comment by jamie.l...@gmail.com
on 14 Feb 2012 at 11:29
OK thanks to Gleeda and AW for some thoughts, we have a patch. Please take a
look and let me know.
So there are several compelling reasons why the code must be patched:
* The current method that relies on finding TEB (NtTibAddress) by looking up
the 7th (0x3B >> 3) entry in the GDT only applies to XP/2K3 x86
* In other words the current method specifically does not work on any x64
* Even on XP/2K3 x86 the current method isn't guaranteed to work. The 7th entry
in the GDT may be 0 based on context switch at the time of the memory dump. For
example from 4 different XP samples, using the gdt plugin, 75% of the time the
value was 0.
Sel Base Limit Type DPL Gr Pr
0x38 0x0 0xfff Data RW Ac 3 By P
0x38 0x7ffdd000 0xfff Data RW Ac 3 By P
0x38 0x0 0xfff Data RW Ac 3 By P
0x38 0x0 0xfff Data RW Ac 3 By P
* The current method requires the KGDTENTRY vtype in hibernate_vtypes.py which
overwrites/masks the real profile's KGDTENTRY vtype definition.
The method in the proposed patch (is really Gleeda's method) works for all OS
on x86 and x64.
Original comment by michael.hale@gmail.com
on 15 Feb 2012 at 5:47
Attachments:
Looks good from a code point of view, no idea if Peb blocks are the same
between different tasks, or if it doesn't matter. I'll leave that matter up to
a different reviewer... 5:)
Original comment by mike.auty@gmail.com
on 15 Feb 2012 at 10:12
The Peb blocks are technically different (different virtual addresses in each
process, many fields *can* and are different between processes), but the only
fields printed by hibinfo (peb.OSMajorVersion, peb.OSMinorVersion,
peb.OSBuildNumber) should definitely be the same in all Pebs.
Original comment by michael.hale@gmail.com
on 15 Feb 2012 at 10:17
I'll commit this later today if no one objects.
Original comment by michael.hale@gmail.com
on 16 Feb 2012 at 2:17
This issue was closed by revision r1449.
Original comment by mike.auty@gmail.com
on 18 Feb 2012 at 11:01
Original issue reported on code.google.com by
michael.hale@gmail.com
on 14 Feb 2012 at 10:50