Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

drakrun: Add missing T_64PCHAR pdbparse base_types #642

Merged
merged 1 commit into from
Sep 22, 2021

Conversation

Jack28
Copy link
Contributor

@Jack28 Jack28 commented Sep 22, 2021

Installation with Windows 10 x64 leads to the following error during
postinstall:

[2021-09-20 14:36:20,042][DEBUG] Parsing PDB into JSON profile...
[2021-09-20 14:36:21,678][DEBUG] stdout: {"Plugin": "inject", "TimeStamp": "1632141365.020867", "Status": "Success", "ProcessName": "C:\\Windows\\System32\\win32k.sys", "Arguments": "", "InjectedPid": 0, "InjectedTid": 0}

[2021-09-20 14:36:21,679][DEBUG] stderr: DRAKVUF injector v0.8-git20210807130654+d74df17-1 Copyright (C) 2014-2021 Tamas K Lengyel

[2021-09-20 14:36:21,679][DEBUG] rc: 0
[2021-09-20 14:36:21,679][DEBUG] Traceback (most recent call last):
  File "/opt/venvs/drakrun/lib/python3.8/site-packages/drakrun/draksetup.py", line 579, in create_rekall_profile
    profile = make_pdb_profile(
  File "/opt/venvs/drakrun/lib/python3.8/site-packages/drakrun/drakpdb.py", line 368, in make_pdb_profile
    struct_specs = {
  File "/opt/venvs/drakrun/lib/python3.8/site-packages/drakrun/drakpdb.py", line 368, in <dictcomp>
    struct_specs = {
  File "/opt/venvs/drakrun/lib/python3.8/site-packages/drakrun/drakpdb.py", line 327, in traverse_tree
    yield from traverse_tree([struct.index.utype], visited=visited)
  File "/opt/venvs/drakrun/lib/python3.8/site-packages/drakrun/drakpdb.py", line 311, in traverse_tree
    yield info.name, process_struct(info)
  File "/opt/venvs/drakrun/lib/python3.8/site-packages/drakrun/drakpdb.py", line 348, in process_struct
    typ = get_field_type_info(field)
  File "/opt/venvs/drakrun/lib/python3.8/site-packages/drakrun/drakpdb.py", line 295, in get_field_type_info
    return TYPE_ENUM_TO_VTYPE[str(field.index)]
KeyError: 'T_64PCHAR'

[2021-09-20 14:36:21,679][INFO] Deleted /var/lib/drakrun/profiles/amd64_win32k_profile

Adding the missing T_64PCHAR type to the enum makes installation succed.

Installation with Windows 10 x64 leads to the following error during
postinstall:

[2021-09-20 14:36:20,042][DEBUG] Parsing PDB into JSON profile...
[2021-09-20 14:36:21,678][DEBUG] stdout: {"Plugin": "inject", "TimeStamp": "1632141365.020867", "Status": "Success", "ProcessName": "C:\\Windows\\System32\\win32k.sys", "Arguments": "", "InjectedPid": 0, "InjectedTid": 0}

[2021-09-20 14:36:21,679][DEBUG] stderr: DRAKVUF injector v0.8-git20210807130654+d74df17-1 Copyright (C) 2014-2021 Tamas K Lengyel

[2021-09-20 14:36:21,679][DEBUG] rc: 0
[2021-09-20 14:36:21,679][DEBUG] Traceback (most recent call last):
  File "/opt/venvs/drakrun/lib/python3.8/site-packages/drakrun/draksetup.py", line 579, in create_rekall_profile
    profile = make_pdb_profile(
  File "/opt/venvs/drakrun/lib/python3.8/site-packages/drakrun/drakpdb.py", line 368, in make_pdb_profile
    struct_specs = {
  File "/opt/venvs/drakrun/lib/python3.8/site-packages/drakrun/drakpdb.py", line 368, in <dictcomp>
    struct_specs = {
  File "/opt/venvs/drakrun/lib/python3.8/site-packages/drakrun/drakpdb.py", line 327, in traverse_tree
    yield from traverse_tree([struct.index.utype], visited=visited)
  File "/opt/venvs/drakrun/lib/python3.8/site-packages/drakrun/drakpdb.py", line 311, in traverse_tree
    yield info.name, process_struct(info)
  File "/opt/venvs/drakrun/lib/python3.8/site-packages/drakrun/drakpdb.py", line 348, in process_struct
    typ = get_field_type_info(field)
  File "/opt/venvs/drakrun/lib/python3.8/site-packages/drakrun/drakpdb.py", line 295, in get_field_type_info
    return TYPE_ENUM_TO_VTYPE[str(field.index)]
KeyError: 'T_64PCHAR'

[2021-09-20 14:36:21,679][INFO] Deleted /var/lib/drakrun/profiles/amd64_win32k_profile

Adding the missing T_64PCHAR type to the enum makes installation succed.
@chivay
Copy link
Collaborator

chivay commented Sep 22, 2021

Thanks!

@chivay chivay merged commit 4d6ab9a into CERT-Polska:master Sep 22, 2021
@icedevml
Copy link
Contributor

Thanks for this contribution and bug fix! :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants