From 083fd438909425997db30d3dad1fbaadf49a25c4 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 19 Jul 2018 09:22:57 +0100 Subject: [PATCH] Ensure get_module_symbols_by_absolute_location only returns modules at the appropriate offset. --- volatility/framework/contexts/__init__.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility/framework/contexts/__init__.py b/volatility/framework/contexts/__init__.py index 8a178dd64..9481b29aa 100644 --- a/volatility/framework/contexts/__init__.py +++ b/volatility/framework/contexts/__init__.py @@ -209,4 +209,5 @@ class ModuleCollection(validity.ValidityRoutines): typing.Tuple[str, typing.List[str]]]: """Returns a tuple of (module_name, list_of_symbol_names) for each module, where symbols live at the absolute offset in memory provided""" for module in self._modules: - yield (module.name, module.get_symbols_by_absolute_location(offset)) + if module.offset <= offset <= module.offset + module.size: + yield (module.name, module.get_symbols_by_absolute_location(offset))