Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added handling of prototype and VAD hardware / unknown PTEs on Windows x64 #1073

Open
wants to merge 2 commits into
base: develop
Choose a base branch
from

Conversation

thejanit0r
Copy link

The bug was found while dumping and analyzing user-mode memory regions of ntdll.dll.

Info about prototype and VAD hardware / unknown PTEs:

It has been tested on a Windows 10 x64 memory dump.

Windows x86 / PAE is currently not supported, but should be relatively easily portable given test data.

@ikelos
Copy link
Member

ikelos commented Feb 20, 2024

Hiya, I have been thinking this over. My concern is that it no longer allows intel layers to be constructed except via the add_process method otherwise you might get conflicting results. The vad root value also doesn't get recorded in the configuration as a parameter, so saving this to a config file won't result in the same layer being reconstructable simply by reading the config. Strictly, this should be an optional requirement on an intel space, but that then starts getting really hacky with windows having different requirements from other OSes, so it needs further consideration I'm afraid.

If you want to be making forward progress, please get rid of the hidden _vad_root parameter, and make it an explicit (but still optional) integer requirement of the Windows mixins. This should then be passed as a configuration option (much like the dtb is here ), but that may require altering the add_process method to accept other configuration parameters (which in turn may require a bump of the API version). So, complex but doable and we want to do it the right way if we're going to add it...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants