bdpayne/libvmi — pull request #108 by tklengyel (2013-10-11 18:38:02+00:00)
Title: Fix unicode string read function for Windows x64 and update module-list example.

Under Windows7 x64 the unicode string reading function wasn't returning anything. After some debugging and comparing the values to Volatility I noticed the following pattern:

LibVMI was trying to read the unicode buffer from, for example, the VA 0x234221800000000 for a module with base VA 0xfffffa8000000000, which failed. At the same time Volatility succeeded, but the offset Volatility used was 0xfffffa8002342218.

Changing the buffer VA address to be (vaddr & 0xFFFFFFFF00000000) + (us64.pBuffer >> 32) solved the issue. Maybe someone with a better understanding of the x64 Windows unicode management can verify this, but it works for me for both the kernel module list and for walking the PEB lists.

I'm also updating the module-list example to work with 64-bit Windows.