reverseame/sigcheck

Volatility plugin to validate Authenticode-signed processes, either with embedded signature or catalog-signed

sigcheck's Issues

relative path for addresses.json

sigcheck/sigcheck.py

Line 100 in a14a740

address_file = 'addresses.json'

address_file = os.path.join(os.path.dirname(file), 'addresses.json')

JSON output

`
def render_json(self, outfd, data):
for gen in data:
for key in gen:
root = key['root']
filtered_keys = self.filter_key(key['key'], key['value'])
for filtered_key in filtered_keys:
if not self._config.MATCH or (self._config.MATCH and filtered_key['reason']):
#if filtered_key['reason']:
# outfd.write('\nWARNING: {0}'.format(warning_message(', '.join(filtered_key['reason']))))
#outfd.write('\n{0}{1}\n'.format(root, self.regapi.reg_get_key_path(filtered_key['key'])))

                    tp, dt = rawreg.value_data(filtered_key['value'])
                    if tp == 'REG_BINARY' or tp == 'REG_NONE':
                        dt = "\n" + "\n".join(["{0:#010x}  {1:<48}  {2}".format(o, h, ''.join(c)) for o, h, c in
                                               utils.Hexdump(dt[:0x40])])
                    dic = {'key': '{0}{1}'.format(root, self.regapi.reg_get_key_path(filtered_key['key'])),
                           'name': self.get_value_name(filtered_key['value']),
                           'type': tp,
                           'value': dt,
                           'warning': ', '.join(filtered_key['reason']) if filtered_key['reason'] else None
                           }

                    #outfd.write('{0}: {1}: {2}\n'.format(self.get_value_name(filtered_key['value']), tp, dt))
                    outfd.write('{0}\n'.format(json.dumps(dic)))

`

*** Failed to import volatility.plugins.sigcheck (ImportError: No module named pefile)

Hi, I tried to run plugin sigcheck in Volatility 2.6.

When I run sigcheck.py in Python, there is no 'import pefile' error.
However, when I run it as a plugin in Volatility, an 'import pefile' error occurs.
Do you know why this error is happening?
For reference, I am using Python 3.8 and Volatility 2.6.

Volatility Foundation Volatility Framework 2.6 *** Failed to import volatility.plugins.sigcheck (ImportError: No module named pefile) *** Failed to import volatility.plugins.sigvalidator (ImportError: No module named pefile)

Thank you.

File type error

sigcheck/sigcheck.py

Line 368 in 2830d85

for new_imagebase in self.frequent_addresses[file_type]:

'DRV' isn't in address.json
Manage when the file type is not defined in the json.

for new_imagebase in self.frequent_addresses.get(file_type): # 'get' returns None if the key isn't in the dictionary
new_imagebase = int(new_imagebase, 16)
...

PermissionError: [WinError 32] The process cannot access the file because it is being used by another process: 'C:\\Users\\username\\AppData\\Local\\Temp\\tmp3v6qi352'

I tried to execute sigvalidator.py without success.

This is my code:

if __name__ == '__main__':

    sigv = sigvalidator.SigValidator()

Here is the error message that I got

Exception ignored in: <function SigValidator.del at 0x03637100>
Traceback (most recent call last):
File "C:\Users\ragehead\Yeager\venv\lib\site-packages\sigvalidator.py", line 62, in del
File "C:\Users\ragehead\Yeager\venv\lib\site-packages\sigvalidator.py", line 96, in clean_workin_dir
File "C:\Users\ragehead\Yeager\venv\lib\site-packages\sigvalidator.py", line 101, in delete_file
PermissionError: [WinError 32] The process cannot access the file because it is being used by another process: 'C:\Users\username\AppData\Local\Temp\tmp3v6qi352'

Thank you for your support