diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py index 25a98fc21..dc88c20bf 100644 --- a/volatility3/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -174,13 +174,13 @@ class Intel(linear.LinearlyMappedLayer): f"Page Fault at entry {hex(entry)} in page entry", ) - pfn = self.pte_pfn(entry) + pfn = self._pte_pfn(entry) page_offset = self._mask(offset, position, 0) page = pfn << self.page_shift | page_offset return page, 1 << (position + 1), self._base_layer - def pte_pfn(self, entry: int) -> int: + def _pte_pfn(self, entry: int) -> int: """Extracts the page frame number (PFN) from the page table entry (PTE) entry""" return entry >> self.page_shift @@ -520,11 +520,11 @@ class WindowsIntel32e(WindowsMixin, Intel32e): class LinuxMixin(Intel): @functools.cached_property - def register_mask(self) -> int: + def _register_mask(self) -> int: return (1 << self._bits_per_register) - 1 @functools.cached_property - def physical_mask(self) -> int: + def _physical_mask(self) -> int: # From kernels 4.18 the physical mask is dynamic: See AMD SME, Intel Multi-Key Total # Memory Encryption and CONFIG_DYNAMIC_PHYSICAL_MASK: 94d49eb30e854c84d1319095b5dd0405a7da9362 physical_mask = (1 << self._maxphyaddr) - 1 @@ -536,42 +536,44 @@ class LinuxMixin(Intel): # Note that within the Intel class it's a class method. However, since it uses # complement operations and we are working in Python, it would be more careful to # limit it to the architecture's pointer size. - return ~(self.page_size - 1) & self.register_mask + return ~(self.page_size - 1) & self._register_mask @functools.cached_property - def physical_page_mask(self) -> int: - return self.page_mask & self.physical_mask + def _physical_page_mask(self) -> int: + return self.page_mask & self._physical_mask @functools.cached_property - def pte_pfn_mask(self) -> int: - return self.physical_page_mask + def _pte_pfn_mask(self) -> int: + return self._physical_page_mask @functools.cached_property - def pte_flags_mask(self) -> int: - return ~self.pte_pfn_mask & self.register_mask + def _pte_flags_mask(self) -> int: + return ~self._pte_pfn_mask & self._register_mask - def pte_flags(self, pte) -> int: - return pte & self.pte_flags_mask + def _pte_flags(self, pte) -> int: + return pte & self._pte_flags_mask - def is_pte_present(self, entry: int) -> bool: - return (self.pte_flags(entry) & (self._PAGE_PRESENT | self._PAGE_PROTNONE)) != 0 + def _is_pte_present(self, entry: int) -> bool: + return ( + self._pte_flags(entry) & (self._PAGE_PRESENT | self._PAGE_PROTNONE) + ) != 0 def _page_is_valid(self, entry: int) -> bool: # Overrides the Intel static method with the Linux-specific implementation - return self.is_pte_present(entry) + return self._is_pte_present(entry) - def pte_needs_invert(self, entry) -> bool: + def _pte_needs_invert(self, entry) -> bool: # Entries that were set to PROT_NONE (PAGE_PRESENT/PAGE_GLOBAL) are inverted return not (entry & self._PAGE_PRESENT) - def protnone_mask(self, entry: int) -> int: + def _protnone_mask(self, entry: int) -> int: """Gets a mask to XOR with the page table entry to get the correct PFN""" - return ~0 & self.register_mask if self.pte_needs_invert(entry) else 0 + return ~0 & self._register_mask if self._pte_needs_invert(entry) else 0 - def pte_pfn(self, entry: int) -> int: + def _pte_pfn(self, entry: int) -> int: """Extracts the page frame number from the page table entry""" - pfn = entry ^ self.protnone_mask(entry) - return (pfn & self.pte_pfn_mask) >> self.page_shift + pfn = entry ^ self._protnone_mask(entry) + return (pfn & self._pte_pfn_mask) >> self.page_shift class LinuxIntel(LinuxMixin, Intel):