Version 5.8.19

yiluoe · Dec 12, 2023 · 81b005b · 81b005b
1 parent 211e520
commit 81b005b
Show file tree

Hide file tree

Showing 9 changed files with 25 additions and 15 deletions.
diff --git a/m_vmemd/version.h b/m_vmemd/version.h
@@ -3,8 +3,8 @@
 
 #define VERSION_MAJOR               5
 #define VERSION_MINOR               8
-#define VERSION_REVISION            18
-#define VERSION_BUILD               138
+#define VERSION_REVISION            19
+#define VERSION_BUILD               139
 
 #define VER_FILE_DESCRIPTION_STR    "MemProcFS : Plugin vmemd"
 #define VER_FILE_VERSION            VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD

diff --git a/memprocfs/version.h b/memprocfs/version.h
@@ -3,8 +3,8 @@
 
 #define VERSION_MAJOR               5
 #define VERSION_MINOR               8
-#define VERSION_REVISION            18
-#define VERSION_BUILD               138
+#define VERSION_REVISION            19
+#define VERSION_BUILD               139
 
 #define VER_FILE_DESCRIPTION_STR    "MemProcFS"
 #define VER_FILE_VERSION            VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD

diff --git a/vmm/modules/m_fc_ntfs.c b/vmm/modules/m_fc_ntfs.c
@@ -998,12 +998,21 @@ int FcNtfs2_FcIngestFinalize_MergeSortCompare(_In_ PFCNTFS2 *ppe1, _In_ PFCNTFS2
 VOID FcNtfs2_FcIngestFinalize_MergeSort(_In_ VMM_HANDLE H, _In_ POB_FCNTFS2_INIT_CONTEXT ctx)
 {
     DWORD iEntry, cEntries, i;
-    DWORD cChildArrayMax = 0x00100000 / sizeof(PFCNTFS2);
-    PFCNTFS2 *pChildArray = (PFCNTFS2*)ctx->pb1M, pDir, pe;
+    DWORD cChildArrayMax = 0x80000;     // 512k entries
+    PFCNTFS2 *pChildArray, pDir, pe;
+    pChildArray = (PFCNTFS2*)LocalAlloc(0, cChildArrayMax * sizeof(SIZE_T));
+    if(!pChildArray) {
+        VmmLog(H, ctx->MID, LOGLEVEL_1_CRITICAL, "Out of memory.");
+        return;
+    }
     cEntries = ObMap_Size(ctx->pmMft);
     for(iEntry = 0; iEntry < cEntries; iEntry++) {
         pDir = (PFCNTFS2)ObMap_GetByIndex(ctx->pmMft, iEntry);
-        if((pDir->cChild < 2) && (pDir->cChild < (0x00100000 / sizeof(PFCNTFS2)))) { continue; }
+        if(pDir->cChild < 2) { continue; }
+        if(pDir->cChild >= cChildArrayMax) {
+            VmmLog(H, ctx->MID, LOGLEVEL_2_WARNING, "Large number of files (>%uk) in directory '%s'. If possible to share memory dump file create an issue @Github!", cChildArrayMax >> 10, pDir->uszName);
+            continue;
+        }
         pe = pDir->pChild;
         i = 0;
         while(pe) {
@@ -1019,6 +1028,7 @@ VOID FcNtfs2_FcIngestFinalize_MergeSort(_In_ VMM_HANDLE H, _In_ POB_FCNTFS2_INIT
             pDir->pChild = pe;
         }
     }
+    LocalFree(pChildArray);
 }
 
 int FcNtfs2_FcIngestFinalize_VolumeCountSort_Compare(PFCNTFS2_VOLUME p1, PFCNTFS2_VOLUME p2)

diff --git a/vmm/version.h b/vmm/version.h
@@ -3,8 +3,8 @@
 
 #define VERSION_MAJOR               5
 #define VERSION_MINOR               8
-#define VERSION_REVISION            18
-#define VERSION_BUILD               138
+#define VERSION_REVISION            19
+#define VERSION_BUILD               139
 
 #define VER_FILE_DESCRIPTION_STR    "MemProcFS : Core"
 #define VER_FILE_VERSION            VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD

diff --git a/vmmpyc/version.h b/vmmpyc/version.h
@@ -3,8 +3,8 @@
 
 #define VERSION_MAJOR               5
 #define VERSION_MINOR               8
-#define VERSION_REVISION            18
-#define VERSION_BUILD               138
+#define VERSION_REVISION            19
+#define VERSION_BUILD               139
 
 #define VER_FILE_DESCRIPTION_STR    "MemProcFS : Python API"
 #define VER_FILE_VERSION            VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD

diff --git a/vmmrust/leechcore_example/Cargo.toml b/vmmrust/leechcore_example/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "leechcore_example"
-version = "5.8.18"
+version = "5.8.19"
 edition = "2021"
 publish = false
 

diff --git a/vmmrust/m_example_plugin/Cargo.toml b/vmmrust/m_example_plugin/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "m_example_plugin"
-version = "5.8.18"
+version = "5.8.19"
 edition = "2021"
 publish = false
 

diff --git a/vmmrust/memprocfs/Cargo.toml b/vmmrust/memprocfs/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "memprocfs"
-version = "5.8.18"
+version = "5.8.19"
 edition = "2021"
 description = "MemProcFS - Physical Memory Analysis Framework"
 homepage = "https://github.com/ufrisk/MemProcFS"

diff --git a/vmmrust/memprocfs_example/Cargo.toml b/vmmrust/memprocfs_example/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "memprocfs_example"
-version = "5.8.18"
+version = "5.8.19"
 edition = "2021"
 publish = false