Skip to content

Windows: verify Intel layers using translation checks#1992

Open
Abyss-W4tcher wants to merge 4 commits into
volatilityfoundation:developfrom
Abyss-W4tcher:windows_intel_layer_checks
Open

Windows: verify Intel layers using translation checks#1992
Abyss-W4tcher wants to merge 4 commits into
volatilityfoundation:developfrom
Abyss-W4tcher:windows_intel_layer_checks

Conversation

@Abyss-W4tcher

@Abyss-W4tcher Abyss-W4tcher commented Jun 10, 2026

Copy link
Copy Markdown
Contributor

Hi,

#1929 introduced a new DTB sanity check to filter out broken DTBs on recent Windows versions. While this fix worked in some cases, it also introduced regressions:

Checking if a DTB has a certain number of valid pointers to be considered valid can lead to false positives, and is probably not the way DTBs should be validated.

I've looked at vol2 source code and found out that Windows' Intel layers were validated using translation checks:

These checks rely on the historical _KUSER_SHARED_DATA data structure address translated both in kernel and user space.

  • Mass testing: on 200 windows samples, all passed the layer stacking stage.

@Abyss-W4tcher Abyss-W4tcher marked this pull request as draft June 10, 2026 14:58
Comment thread volatility3/framework/automagic/windows.py Fixed
@Abyss-W4tcher Abyss-W4tcher marked this pull request as ready for review June 11, 2026 17:15
@Abyss-W4tcher Abyss-W4tcher requested a review from ikelos June 11, 2026 17:15
@Abyss-W4tcher

Copy link
Copy Markdown
Contributor Author

This is ready for review

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants