From 05ae20c78bd982e95ab3dd99d92a2efaf68be3b3 Mon Sep 17 00:00:00 2001 From: Paul Kermann Date: Sun, 22 May 2022 11:49:18 +0300 Subject: [PATCH 1/4] fix off by in filelayer --- volatility3/framework/layers/physical.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/layers/physical.py b/volatility3/framework/layers/physical.py index 73d46b211..5d5fd17a9 100644 --- a/volatility3/framework/layers/physical.py +++ b/volatility3/framework/layers/physical.py @@ -118,7 +118,7 @@ class FileLayer(interfaces.layers.DataLayerInterface): with self._lock: orig = self._file.tell() self._file.seek(0, 2) - self._size = self._file.tell() + self._size = self._file.tell() - 1 self._file.seek(orig) return self._size From a3c63fbdf893324df2754b999e51db6655f3b06a Mon Sep 17 00:00:00 2001 From: Paul Kermann Date: Mon, 23 May 2022 09:25:30 +0300 Subject: [PATCH 2/4] rename variable --- volatility3/framework/layers/physical.py | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/layers/physical.py b/volatility3/framework/layers/physical.py index 5d5fd17a9..728fdcf31 100644 --- a/volatility3/framework/layers/physical.py +++ b/volatility3/framework/layers/physical.py @@ -113,14 +113,15 @@ class FileLayer(interfaces.layers.DataLayerInterface): def maximum_address(self) -> int: """Returns the largest available address in the space.""" # Zero based, so we return the size of the file minus 1 - if self._size: - return self._size + if self._maximum_address + return self._maximum_address with self._lock: orig = self._file.tell() self._file.seek(0, 2) - self._size = self._file.tell() - 1 + self._size = self._file.tell() self._file.seek(orig) - return self._size + self._maximum_address = self._size - 1 + return self._maximum_address @property def minimum_address(self) -> int: From be82c1639c051f929cbc17c6aa8e7250d6711f8b Mon Sep 17 00:00:00 2001 From: Paul Kermann Date: Mon, 23 May 2022 09:40:25 +0300 Subject: [PATCH 3/4] fix missing --- volatility3/framework/layers/physical.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/layers/physical.py b/volatility3/framework/layers/physical.py index 728fdcf31..5d757f482 100644 --- a/volatility3/framework/layers/physical.py +++ b/volatility3/framework/layers/physical.py @@ -113,7 +113,7 @@ class FileLayer(interfaces.layers.DataLayerInterface): def maximum_address(self) -> int: """Returns the largest available address in the space.""" # Zero based, so we return the size of the file minus 1 - if self._maximum_address + if self._maximum_address: return self._maximum_address with self._lock: orig = self._file.tell() From e15fa0ebad1a46fd990d31181d2dbe8f6b5b994d Mon Sep 17 00:00:00 2001 From: Paul Kermann Date: Mon, 23 May 2022 09:43:49 +0300 Subject: [PATCH 4/4] declared in constructor --- volatility3/framework/layers/physical.py | 1 + 1 file changed, 1 insertion(+) diff --git a/volatility3/framework/layers/physical.py b/volatility3/framework/layers/physical.py index 5d757f482..5cf0b776d 100644 --- a/volatility3/framework/layers/physical.py +++ b/volatility3/framework/layers/physical.py @@ -88,6 +88,7 @@ class FileLayer(interfaces.layers.DataLayerInterface): self._accessor = resources.ResourceAccessor() self._file_: Optional[IO[Any]] = None self._size: Optional[int] = None + self._maximum_address: Optional[int] = None # Construct the lock now (shared if made before threading) in case we ever need it self._lock: Union[DummyLock, threading.Lock] = DummyLock() if constants.PARALLELISM == constants.Parallelism.Threading: