(self,
                       context: interfaces.context.ContextInterface,
                       vlayer: layers.intel.Intel,
                       pattern: bytes,
                       result_offset: int,
                       progress_callback: constants.ProgressCallback = None)
return valid_kernel
Method for finding a suitable kernel offset based on a module
        table.
Method for finding a suitable kernel offset based on a module
        table.
Method for finding a suitable kernel offset based on a module table .
def _method_offset(self,
                       context: interfaces.context.ContextInterface,
                       vlayer: layers.intel.Intel,
                       pattern: bytes,
                       result_offset: int,
                       progress_callback: constants.ProgressCallback = None) -> Optional[ValidKernelType]:
        """Method for finding a suitable kernel offset based on a module
        table."""
        vollog.debug("Kernel base determination - searching layer module list structure")
        valid_kernel = None  # type: Optional[ValidKernelType]
        # If we're here, chances are high we're in a Win10 x64 image with kernel base randomization
        physical_layer_name = self.get_physical_layer_name(context, vlayer)
        physical_layer = context.layers[physical_layer_name]
        # TODO:  On older windows, this might be \WINDOWS\system32\nt rather than \SystemRoot\system32\nt
        results = physical_layer.scan(context, scanners.BytesScanner(pattern), progress_callback = progress_callback)
        seen = set()  # type: Set[int]
        # Because this will launch a scan of the virtual layer, we want to be careful
        for result in results:
            # TODO: Identify the specific structure we're finding and document this a bit better
            pointer = context.object("pdbscan!unsigned long long",
                                     offset = (result + result_offset),
                                     layer_name = physical_layer_name)
            address = pointer & vlayer.address_mask
            if address in seen:
                continue
            seen.add(address)

            valid_kernel = self.check_kernel_offset(context, vlayer, address, progress_callback)

            if valid_kernel:
                break
        return valid_kernel
def _method_offset ( self , context : interfaces . context . ContextInterface , vlayer : layers . intel . Intel , pattern : bytes , result_offset : int , progress_callback : constants . ProgressCallback = None ) -> Optional [ ValidKernelType ] : vollog . debug ( "Kernel base determination - searching layer module list structure" ) valid_kernel = None # type: Optional[ValidKernelType] # If we're here, chances are high we're in a Win10 x64 image with kernel base randomization physical_layer_name = self . get_physical_layer_name ( context , vlayer ) physical_layer = context . layers [ physical_layer_name ] # TODO:  On older windows, this might be \WINDOWS\system32\nt rather than \SystemRoot\system32\nt results = physical_layer . scan ( context , scanners . BytesScanner ( pattern ) , progress_callback = progress_callback ) seen = set ( ) # type: Set[int] # Because this will launch a scan of the virtual layer, we want to be careful for result in results : # TODO: Identify the specific structure we're finding and document this a bit better pointer = context . object ( "pdbscan!unsigned long long" , offset = ( result + result_offset ) , layer_name = physical_layer_name ) address = pointer & vlayer . address_mask if address in seen : continue seen . add ( address ) valid_kernel = self . check_kernel_offset ( context , vlayer , address , progress_callback ) if valid_kernel : break return valid_kernel