Windows: update psscan to fix issue #591 #1788
Conversation
|
I'll get that test fixed! |
|
|
||
| if self.config["dump"]: |
There was a problem hiding this comment.
Ideally we'd guard for if vproc is None:. If we hand it in, it will debug log but otherwise return None, so it's not catastrophic, but feels like an easy thing we can check (and catchall exception handlers aren't ideal, so that may go away at some point in the future)...
|
|
||
| # windows 10 objects (maybe others in the future) are already in virtual memory | ||
| # if the proc native_layer_name and layer_name match then it is in 'virtual' memory. | ||
| if proc.vol.layer_name == proc.vol.native_layer_name: |
There was a problem hiding this comment.
This isn't a robust test (it only works when scan_processes returns carved processes), and I don't really want people using it to determine whether an address is physical or not. The poolscanner's been asked to scan the kernel layer, so... it should only ever return virtual results? Have you verified that the "else" branch ever gets hit?
|
@ikelos that's a really good point. I've just been focused on getting rid of the back trace for @garanews rather than looking at the plugin as a whole. The windows psscan is very different to the linux one. Linux will always scan the 'memory layer' and produce results from that, e.g. always physical addresses and it doesn't scan an intel layer. What are peoples thoughts on changing the windows one to be closer to the linux counterpart? It's a bigger change to how psscan works but to my knowledge there aren't any public plugins that rely on psscan. It would make the logic a lot simpler. |
|
I think as long as we don't lose functionality (ie, it can still give you virtual addresses, if that's what you expect) then it should be fine? |
Hello 👋
This is a continuation of PR #1215 but I completely messed up that branch with a rebase that went very wrong, and my git-fu isn't strong enough to fix it.
This fixes an issue where if you attempt to use the
--physicaloption on some windows samples psscan will crash. This PR fixes those issues and includes the changes suggested by @ikelos in the previous PR.🦊