Skip to content
This repository has been archived by the owner on Oct 18, 2020. It is now read-only.

Commit

Permalink
fixes bug in VA translation process (#538)
Browse files Browse the repository at this point in the history
The current implementation continues on an invalid PDPTE, leading in some cases to falsely valid PDE/PTEs and hence to returning memory where no memory should be.

For comparison regarding fix see: https://github.com/f-block/rekall/blob/master/rekall-core/rekall/plugins/addrspaces/intel.py#L363
  • Loading branch information
f-block committed Aug 5, 2020
1 parent ca6ee6b commit b6f632f
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions rekall-core/rekall/plugins/addrspaces/amd64.py
Expand Up @@ -98,6 +98,7 @@ def describe_vtop(self, vaddr, collection=None):

if not pdpte_value & self.valid_mask:
collection.add(intel.InvalidAddress, "Invalid PDPTE\n")
return collection

# Large page mapping.
if pdpte_value & self.page_size_mask:
Expand Down

0 comments on commit b6f632f

Please sign in to comment.